Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

490new WordPress flaws this week

397,270entries in the database

5,583 results · page 97 of 112

Apr 18, 2022Caldera Forms: Does not validate and escape the cf-api parameter before outputting it back in the responseCVE-2022-0879 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Product
Caldera Forms
Fixed in
1.9.7
What to do
Update Caldera Forms to 1.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Daily Prayer Time: Does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users)CVE-2022-0785 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
Product
Daily Prayer Time
Fixed in
2022.03.01
What to do
Update Daily Prayer Time to 2022.03.01 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Loco Translate: Does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panelCVE-2022-0765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
Product
Loco Translate
Fixed in
2.6.1
What to do
Update Loco Translate to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Text Hover: Does not sanitize and escape the text to hoverCVE-2022-0737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Text Hover
Fixed in
4.2
What to do
Update Text Hover to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Easy Digital Downloads: Does not have CSRF check in placeCVE-2022-0707 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack
Product
Easy Digital Downloads
Fixed in
2.11.6
What to do
Update Easy Digital Downloads to 2.11.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 18, 2022Easy Digital Downloads: Does not sanitise and escape the Downloadable File Name in the LogsCVE-2022-0706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Product
Easy Digital Downloads
Fixed in
2.11.6
What to do
Update Easy Digital Downloads to 2.11.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 18, 2022Ad Injection: Does not properly sanitize the body of the adverts injected into the pagesCVE-2022-0661 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
Product
Ad Injection
Affected
up to 1.2.0.19
What to do
Affects up to 1.2.0.19. Update Ad Injection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2022Visual Form Builder: Does not enforce nonce checksCVE-2022-0141 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks
Product
Visual Form Builder
Fixed in
3.0.8
What to do
Update Visual Form Builder to 3.0.8 or newer.
Full record and what to do →NVD record wpscan.com fortiguard.com
Apr 12, 2022Visual Form Builder: Does not perform access control on entry form exportCVE-2022-0140 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
Product
Visual Form Builder
Fixed in
3.0.6
What to do
Update Visual Form Builder to 3.0.6 or newer.
Full record and what to do →NVD record wpscan.com fortiguard.com
Apr 11, 2022Podcast Importer SecondLine: Does not sanitise and properly escape some imported dataCVE-2022-1023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
Product
Podcast Importer SecondLine
Fixed in
1.3.8
What to do
Update Podcast Importer SecondLine to 1.3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022One Click Demo Import: Does not validate the imported fileCVE-2022-1008 · WordPress plugins & themes · reported by WPScanHigh 7.2
The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed
Product
One Click Demo Import
Fixed in
3.1.0
What to do
Update One Click Demo Import to 3.1.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the room parameter before outputting it back in an admin pageCVE-2022-1007 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
Advanced Booking Calendar
Fixed in
1.7.1
What to do
Update Advanced Booking Calendar to 1.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the id parameterCVE-2022-1006 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks
Product
Advanced Booking Calendar
Fixed in
1.7.1
What to do
Update Advanced Booking Calendar to 1.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Image optimization & Lazy Load by Optimole: Does not sanitise and escape its "Lazyload background images for selectors" settingsCVE-2022-0969 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
Product
Image optimization & Lazy Load by Optimole
Fixed in
3.3.2
What to do
Update Image optimization & Lazy Load by Optimole to 3.3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJACVE-2022-0949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
Product
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
Fixed in
6.930
What to do
Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 6.930 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Export All URLs: Does not have CSRF in placeCVE-2022-0914 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
Product
Export All URLs
Fixed in
4.3
What to do
Update Export All URLs to 4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Export All URLs: Does not sanitise and escape the CSV filename before outputting it back in the pageCVE-2022-0892 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Export All URLs
Fixed in
4.2
What to do
Update Export All URLs to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Easy Social Icons: Does not properly escape the image_file fieldCVE-2022-0840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
Product
Easy Social Icons
Fixed in
3.2.1
What to do
Update Easy Social Icons to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Easy Smooth Scroll Links: Does not sanitise and escape its settingsCVE-2022-0728 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Easy Smooth Scroll Links
Fixed in
2.23.1
What to do
Update Easy Smooth Scroll Links to 2.23.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Migration, Backup, Staging: Does not sanitise and escape the sub_page parameter before outputting it back in the pageCVE-2022-0531 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting
Product
Migration, Backup, Staging
Fixed in
0.9.70
What to do
Update Migration, Backup, Staging to 0.9.70 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Favicon by RealFaviconGenerator: Does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboardCVE-2022-0471 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Favicon by RealFaviconGenerator
Fixed in
1.3.23
What to do
Update Favicon by RealFaviconGenerator to 1.3.23 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Post Grid: Does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX actionCVE-2022-0447 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting
Product
Post Grid
Fixed in
2.1.16
What to do
Update Post Grid to 2.1.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Nimble Page Builder: Does not sanitise and escape the preview-level-guid parameter before outputting it back in the pageCVE-2022-0314 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Nimble Page Builder
Fixed in
3.2.2
What to do
Update Nimble Page Builder to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022LearnPress: Does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX actionCVE-2022-0271 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting
Product
LearnPress
Fixed in
4.1.6
What to do
Update LearnPress to 4.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Portfolio Gallery, Product Catalog: Does not have authorisation and CSRF checks in various functions related to AJAX actionsCVE-2021-25090 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
Product
Portfolio Gallery, Product Catalog
Fixed in
2.1.0
What to do
Update Portfolio Gallery, Product Catalog to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Social Share, Social Login and Social Comments: Does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it CVE-2021-24987 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.30
What to do
Update Social Share, Social Login and Social Comments to 7.13.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Post Grid: Does not escape the keyword parameter before outputting it back in an attributeCVE-2021-24986 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form
Product
Post Grid
Fixed in
2.1.16
What to do
Update Post Grid to 2.1.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022Mark Posts: Does not escape new markersCVE-2022-0958 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Mark Posts
Fixed in
2.0.1
What to do
Update Mark Posts to 2.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022Easy Social Icons: Does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statementCVE-2022-0887 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.
Product
Easy Social Icons
Fixed in
3.1.4
What to do
Update Easy Social Icons to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022Profile Builder: Does not sanitise and escape Form Fields titles and descriptionCVE-2022-0884 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed
Product
Profile Builder
Fixed in
3.6.8
What to do
Update Profile Builder to 3.6.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_interval parameter before outputting it back in an admin pageCVE-2022-0864 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
Product
UpdraftPlus WordPress Backup
Fixed in
1.22.9
What to do
Update UpdraftPlus WordPress Backup to 1.22.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Apr 4, 2022Amelia: Does not have proper authorisationCVE-2022-0837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerability to drain out the account balance by keep sending SMS notification.
Product
Amelia
Fixed in
1.0.48
What to do
Update Amelia to 1.0.48 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022FormBuilder: Does not have CSRF checks in placeCVE-2022-0830 · WordPress plugins & themes · reported by WPScanMedium 6.5
The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in them.
Product
FormBuilder
Affected
up to 1.08
What to do
Affects up to 1.08. Update FormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022Amelia: Does not have proper authorisationCVE-2022-0825 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Product
Amelia
Fixed in
1.0.49
What to do
Update Amelia to 1.0.49 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022Insights from Google PageSpeed: Does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboardCVE-2022-0431 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
Product
Insights from Google PageSpeed
Fixed in
4.0.4
What to do
Update Insights from Google PageSpeed to 4.0.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022Material Design for Contact Form 7: Does not check authorization or that the option mentioned in the notice param belongs to the pluginCVE-2022-0404 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.
Product
Material Design for Contact Form 7
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Material Design for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022Dropdown Menu Widget: Does not have authorisation and CSRF checksCVE-2021-25113 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
Product
Dropdown Menu Widget
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update Dropdown Menu Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022KingComposer: Does not have authorisationCVE-2021-25048 · WordPress plugins & themes · reported by WPScanMedium 5.4
The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them
Product
KingComposer
Affected
up to 2.9.6
What to do
Affects up to 2.9.6. Update KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022SpeakOut! Email Petitions: Does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX actionCVE-2022-0846 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Product
SpeakOut! Email Petitions
Fixed in
2.14.15.1
What to do
Update SpeakOut! Email Petitions to 2.14.15.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Church Admin: Does not have authorisation and CSRF in some of its actionCVE-2022-0833 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin's DB data
Product
Church Admin
Fixed in
3.4.135
What to do
Update Church Admin to 3.4.135 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022WooCommerce Affiliate: Does not have authorization and CSRF checks on a specific action handlerCVE-2022-0818 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.
Product
WooCommerce Affiliate
Fixed in
4.16.4.5
What to do
Update WooCommerce Affiliate to 4.16.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Limit Login Attempts (Spam Protection): Does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users)CVE-2022-0787 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections
Product
Limit Login Attempts (Spam Protection)
Fixed in
5.1
What to do
Update Limit Login Attempts (Spam Protection) to 5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Title Experiments Free: Does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users)CVE-2022-0784 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
Product
Title Experiments Free
Fixed in
9.0.1
What to do
Update Title Experiments Free to 9.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Translate WordPress with GTranslate: Does not have CSRF check in some filesCVE-2022-0770 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access to a logged in admin cookies by making them open a malicious link or page
Product
Translate WordPress with GTranslate
Fixed in
2.9.9
What to do
Update Translate WordPress with GTranslate to 2.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Amelia: Does not have proper authorisationCVE-2022-0720 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Product
Amelia
Fixed in
1.0.47
What to do
Update Amelia to 1.0.47 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Bulk Creator: Does not sanitize and escape the post_type parameter before outputting it back in an admin pageCVE-2022-0647 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Bulk Creator
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Bulk Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Bank Mellat: Does not sanitize and escape the orderId parameter before outputting it back in an admin pageCVE-2022-0643 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Bank Mellat
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Bank Mellat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Popup Like box: Does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin pageCVE-2022-0641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Popup Like box
Fixed in
3.6.1
What to do
Update Popup Like box to 3.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022dTabs: Does not sanitize and escape the tab parameter before outputting it back in an admin pageCVE-2022-0621 · WordPress plugins & themes · reported by WPScanMedium 6.1
The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
dTabs
Affected
up to 1.4
What to do
Affects up to 1.4. Update dTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Delete Old Orders: Does not sanitize and escape the date parameter before outputting it back in an admin pageCVE-2022-0620 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Delete Old Orders
Affected
up to 0.2
What to do
Affects up to 0.2. Update Delete Old Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.