Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

4,619 results · page 87 of 93

Mar 18, 2021Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id".CVE-2021-24138 · WordPress plugins & themes · reported by WPScanMedium 5.5
Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user.
Product
AdRotate
Fixed in
5.8.4
What to do
Update AdRotate to 5.8.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users CVE-2021-24137 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands.
Product
Blog2Social
Fixed in
6.3.1
What to do
Update Blog2Social to 6.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, CVE-2021-24131 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the Anti-Spam by CleanTalk WordPress plugin, versions before 5.149, lead to multiple authenticated SQL injection vulnerabilities, however, it requires high privilege user (admin+).
Product
Anti-Spam by CleanTalk
Fixed in
5.149
What to do
Update Anti-Spam by CleanTalk to 5.149 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable toCVE-2021-24130 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+).
Product
WP Google Map
Fixed in
4.1.5
What to do
Update WP Google Map to 4.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site ScriptCVE-2021-24124 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Shieldon WordPress plugin, version 1.6.3 and below, leads to Unauthenticated Reflected Cross-Site Scripting (XSS) when the CAPTCHA page is shown could lead to privileged escalation.
Product
WP Shieldon
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update WP Shieldon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles.CVE-2020-36157 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a WordPress capability (or any custom Ultimate Member role) and effectively be granted those privileges.
Product
An issue was discovered in the Ultimate Member
Fixed in
2.1.12
What to do
Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD record wordpress.org wpscan.com
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update.CVE-2020-36156 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.
Product
An issue was discovered in the Ultimate Member
Fixed in
2.1.12
What to do
Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD record wordpress.org wpscan.com
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.CVE-2020-36155 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user meta that defines a user's role. During the registration process, submitted registration details were passed to the update_profile function, and any metadata was accepted, e.g., wp_capabilities[administrator] for Administrator access.
Product
An issue was discovered in the Ultimate Member
Fixed in
2.1.12
What to do
Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD record wordpress.org wpscan.com
Dec 31, 2020PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objecCVE-2020-35939 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.
Product
PHP Object injection vulnerabilities in the Team Showcase
Fixed in
1.22.16
What to do
Update PHP Object injection vulnerabilities in the Team Showcase to 1.22.16 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects duCVE-2020-35938 · WordPress plugins & themes · reported by MITREHigh 7.5
PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.
Product
PHP Object injection vulnerabilities in the Post Grid
Fixed in
2.0.73
What to do
Update PHP Object injection vulnerabilities in the Post Grid to 2.0.73 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layoutCVE-2020-35937 · WordPress plugins & themes · reported by MITREHigh 7.5
Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to team_import_xml_layouts.
Product
Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase
Fixed in
1.22.16
What to do
Update Stored Cross-Site Scripting (XSS) vulnerabilities in the Team Showcase to 1.22.16 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts incCVE-2020-35936 · WordPress plugins & themes · reported by MITREHigh 7.5
Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.
Product
Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid
Fixed in
2.0.73
What to do
Update Stored Cross-Site Scripting (XSS) vulnerabilities in the Post Grid to 2.0.73 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victimCVE-2020-35933 · WordPress plugins & themes · reported by MITREMedium 6.5
A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.
Product
A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter
Fixed in
6.8.2
What to do
Update A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers)CVE-2020-35932 · WordPress plugins & themes · reported by MITREHigh 7.5
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.
Product
Insecure Deserialization in the Newsletter
Fixed in
6.8.2
What to do
Update Insecure Deserialization in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 11, 2020The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF.CVE-2020-35135 · WordPress plugins & themes · reported by MITREHigh 8.8
The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF.
Product
ultimate-category-excluder
Fixed in
1.2
What to do
Update ultimate-category-excluder to 1.2 or newer.
Full record and what to do →NVD record advisory.checkmarx.net plugins.trac.wordpress.org
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via tCVE-2020-14207 · WordPress plugins & themes · reported by MITREMedium 5.3
The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via the divelog.php filter_diver parameter.
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org hooperlabs.xyz
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).CVE-2020-14206 · WordPress plugins & themes · reported by MITREMedium 6.1
The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org hooperlabs.xyz
Nov 12, 2020Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which: An unauthenticated SQL InjectionCVE-2020-27481 · WordPress plugins & themes · reported by MITRECritical 9.8
An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization.
Product
Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com gist.github.com
Oct 7, 2020The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the EdiCVE-2020-26596 · WordPress plugins & themes · reported by MITREHigh 8.8
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.
Product
Dynamic OOO widget for the Elementor Pro
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Dynamic OOO widget for the Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record elementor.com ww2.compunet.cl
Sep 14, 2020Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attackeCVE-2020-25379 · WordPress plugins & themes · reported by MITREHigh 8.8
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query.
Affected
0.8 to 0.8
What to do
Affects 0.8 to 0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record zeroaptitude.com zeroaptitude.com
Sep 10, 2020Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticCVE-2020-5780 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.3
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.
Fixed in
4.5.6
What to do
Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Aug 31, 2020The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.CVE-2020-20627 · WordPress plugins & themes · reported by MITREMedium 5.3
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
Product
includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP
Affected
up to 2.5.9
What to do
Affects up to 2.5.9. Update includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Aug 31, 2020lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.CVE-2020-20626 · WordPress plugins & themes · reported by MITREMedium 5.4
lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.
Product
lara-google-analytics.php in Lara Google Analytics
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update lara-google-analytics.php in Lara Google Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Aug 31, 2020Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.CVE-2020-20625 · WordPress plugins & themes · reported by MITREHigh 7.5
Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Aug 24, 2020A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any tCVE-2020-24186 · WordPress plugins & themes · reported by MITRECritical 10
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
Product
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0
Affected
up to 7.0.4
What to do
Affects up to 7.0.4. Update A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 21, 2020Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature.CVE-2020-20634 · WordPress plugins & themes · reported by MITREMedium 6.5
Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog.
Affected
up to 2.9.5
What to do
Affects up to 2.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 21, 2020A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to injecCVE-2020-14063 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.
Product
A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript
Fixed in
1.2.2
What to do
Update A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.CVE-2020-15364 · WordPress plugins & themes · reported by MITREMedium 6.1
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
Product
Nexos
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 12, 2020In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pageCVE-2020-4047 · WordPress plugins & themes · reported by GitHubMedium 6.8
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
May 28, 2020An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.CVE-2020-13693 · WordPress plugins & themes · reported by MITRECritical 9.8
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
Product
An unauthenticated privilege-escalation issue exists in the bbPress
Fixed in
2.6.5
What to do
Update An unauthenticated privilege-escalation issue exists in the bbPress to 2.6.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com bbpress.org
May 13, 2020WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly CVE-2020-12832 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
Fixed in
4.2.8
What to do
Update the plugin to 4.2.8 or newer.
Full record and what to do →NVD record ctulhu.me plugins.trac.wordpress.org
May 5, 2020Import feature in the wp-advanced-search plugin 3.3.6: Authenticated SQL injectionCVE-2020-12104 · WordPress plugins & themes · reported by MITREHigh 8.8
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
Product
Import feature in the wp-advanced-search plugin 3.3.6
Fixed in
3.3.7
What to do
Update Import feature in the wp-advanced-search plugin 3.3.6 to 3.3.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Apr 30, 2020In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditionsCVE-2020-11028 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Apr 23, 2020The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query).CVE-2020-12054 · WordPress plugins & themes · reported by MITREMedium 6.1
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.
Product
Catch Breadcrumb
Fixed in
1.5.4
What to do
Update Catch Breadcrumb to 1.5.4 or newer.
Full record and what to do →NVD record cxsecurity.com wpvulndb.com
Apr 13, 2020WordPress Snap Creek Duplicator Plugin File Download VulnerabilityCVE-2020-11738 · WordPress plugins & themes · reported by MITREExploitedHigh 7.5
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Product
Snap Creek Duplicator Plugin
Fixed in
1.3.28
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 7, 2020Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScrCVE-2020-11516 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
Product
Stored XSS in the Contact Form 7 Datepicker
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update Stored XSS in the Contact Form 7 Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the uCVE-2020-11515 · WordPress plugins & themes · reported by MITREMedium 6.1
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
Product
Rank Math
Affected
up to 1.0.40.2
What to do
Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record rankmath.com wordpress.org
Apr 7, 2020The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escCVE-2020-11514 · WordPress plugins & themes · reported by MITRECritical 9.8
The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
Product
Rank Math
Affected
up to 1.0.40.2
What to do
Affects up to 1.0.40.2. Update Rank Math to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record rankmath.com wordpress.org
Apr 7, 2020Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrCVE-2020-11512 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts.
Product
IMPress for IDX Broker
Fixed in
2.6.2
What to do
Update IMPress for IDX Broker to 2.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Apr 3, 2020includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.CVE-2019-17230 · WordPress plugins & themes · reported by MITREMedium 5.3
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
Product
includes/theme-functions.php in the OneTone
Affected
up to 3.0.6
What to do
Affects up to 3.0.6. Update includes/theme-functions.php in the OneTone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Apr 1, 2020LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.CVE-2020-6009 · WordPress plugins & themes · reported by cve@checkpoint.comCritical 9.8
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.
Fixed in
3.1.6
What to do
Update the plugin to 3.1.6 or newer.
Full record and what to do →NVD record learndash.releasenotes.io learndash.releasenotes.io
Mar 13, 2020The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via adminCVE-2020-10195 · WordPress plugins & themes · reported by MITREMedium 6.3
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.
Product
popup-builder
Fixed in
3.64.1
What to do
Update popup-builder to 3.64.1 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Mar 10, 2020controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via tCVE-2018-14502 · WordPress plugins & themes · reported by MITRECritical 9.8
controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters.
Product
controllers/quizzes.php in the Kiboko Chained Quiz
Fixed in
1.0.9
What to do
Update controllers/quizzes.php in the Kiboko Chained Quiz to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submittCVE-2020-9458 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and chaCVE-2020-9457 · WordPress plugins & themes · reported by MITREHigh 8.8
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their CVE-2020-9456 · WordPress plugins & themes · reported by MITREHigh 8.8
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.
Product
In the RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update In the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 6, 2020The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of theCVE-2020-9455 · WordPress plugins & themes · reported by MITREMedium 4.3
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.
Product
RegistrationMagic
Affected
up to 4.6.0.3
What to do
Affects up to 4.6.0.3. Update RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Feb 26, 2020The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufCVE-2019-19134 · WordPress plugins & themes · reported by MITREMedium 6.1
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record heroplugins.com heroplugins.com
Feb 8, 2020Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitraryCVE-2015-1394 · WordPress plugins & themes · reported by MITREMedium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
Product
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery
Fixed in
1.2.11
What to do
Update Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery to 1.2.11 or newer.
Full record and what to do →NVD record securityfocus.com plugins.trac.wordpress.org
Feb 6, 2020The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass.CVE-2020-8771 · WordPress plugins & themes · reported by MITRECritical 9.8
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
Product
Time Capsule
Fixed in
1.21.16
What to do
Update Time Capsule to 1.21.16 or newer.
Full record and what to do →NVD record wpvulndb.com webarxsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.