Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

560 results · page 10 of 12

Dec 20, 2023Contact Form to DB by BestWebSoft – Messages Database Plugin For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-29096 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.0.
Product
Contact Form to DB by BestWebSoft – Messages Database Plugin For
Affected
up to 1.7.0
What to do
Affects up to 1.7.0. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Advanced Database Cleaner: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-49764 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Younes JFR. Advanced Database Cleaner.This issue affects Advanced Database Cleaner: from n/a through 3.1.2.
Product
Advanced Database Cleaner
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Advanced Database Cleaner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Participants Database: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-48751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5.
Product
Participants Database
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update Participants Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023KB Support – WordPress Help Desk and Knowledge Base: Missing AuthorizationCVE-2023-37890 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88.
Product
KB Support – WordPress Help Desk and Knowledge Base
Affected
up to 1.5.88
What to do
Affects up to 1.5.88. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Advanced Local Pickup for WooCommerce: Time-based SQL InjectionCVE-2023-2841 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with admin-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Advanced Local Pickup for WooCommerce
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Advanced Local Pickup for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.CVE-2023-31235 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.
Fixed in
2.5.0
What to do
Update the plugin to 2.5.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Contact Form to DB by BestWebSoft – Messages Database Plugin For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-36508 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.1.
Product
Contact Form to DB by BestWebSoft – Messages Database Plugin For
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Database for Contact Form 7, WPforms, Elementor forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-31212 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions.CVE-2023-5802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions.
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin <= 5.1 versions.CVE-2023-25980 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CAGE Web Design | Rolf van Gelder Optimize Database after Deleting Revisions plugin <= 5.1 versions.
Affected
up to 5.1
What to do
Affects up to 5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2023WP EasyCart: Time-based SQL InjectionCVE-2023-3023 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, 5.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level or above permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP EasyCart
Affected
up to 5.4.10
What to do
Affects up to 5.4.10. Update WP EasyCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions.CVE-2023-23997 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions.
Fixed in
1.2.8
What to do
Update the plugin to 1.2.8 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 27, 2023Custom 404 Pro: Does not properly sanitize database inputsCVE-2023-2032 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.
Product
Custom 404 Pro
Fixed in
3.8.1
What to do
Update Custom 404 Pro to 3.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023Custom Base Terms: Does not sanitize and escape some of its settingsCVE-2023-2600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Custom Base Terms
Fixed in
1.0.3
What to do
Update Custom Base Terms to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 9, 2023Multiple Page Generator: Time-based SQL InjectionCVE-2023-2607 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Multiple Page Generator
Affected
up to 3.3.17
What to do
Affects up to 3.3.17. Update Multiple Page Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Active Directory Integration: Cross-Site Request Forgery leading to time-based SQL InjectionCVE-2023-2599 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to missing nonce verification on the get_users function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to cause resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
Active Directory Integration
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Active Directory Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Active Directory Integration: Time-based SQL InjectionCVE-2023-2484 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Active Directory Integration
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Active Directory Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 24, 2023Cross-Site Request Forgery (CSRF) vulnerability in weightbasedshipping.Com WooCommerce Weight Based Shipping plugin <= 5.4.1 versions.CVE-2022-46794 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in weightbasedshipping.Com WooCommerce Weight Based Shipping plugin <= 5.4.1 versions.
Affected
up to 5.4.1
What to do
Affects up to 5.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2023Multiple Page Generator: Cross-Site Request Forgery leading to time-based SQL InjectionCVE-2023-2608 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projects_list function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries leading to resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Version 3.3.18 addresses the SQL Injection, which drastically reduced the severity.
Product
Multiple Page Generator
Affected
up to 3.3.17
What to do
Affects up to 3.3.17. Update Multiple Page Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 8, 2023Membership Database: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0514 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Membership Database
Affected
up to 1.0
What to do
Affects up to 1.0. Update Membership Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin <= 2.6 versionCVE-2022-47163 · WordPress plugins & themes · reported by PatchstackLow 3.1
Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin <= 2.6 versions.
Affected
up to 2.6
What to do
Affects up to 2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.CVE-2022-47612 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.
Fixed in
2.4.6
What to do
Update the plugin to 2.4.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 17, 2023WP Coder – add custom html, css and js code: Time-based SQL InjectionCVE-2023-0895 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Coder – add custom html, css and js code
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update WP Coder – add custom html, css and js code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 26, 2022Stop Spammers Security | Block Spam Users, Comments, Forms: Passes base64 encoded user input to the unserialize() PHP functionCVE-2022-4120 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2022.6
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2022.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022Clerk: Is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site optionsCVE-2022-3907 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.
Product
Clerk
Fixed in
4.0.0
What to do
Update Clerk to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 21, 2022Contact Form 7 Database Addon: Does not validate dataCVE-2022-3634 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection
Product
Contact Form 7 Database Addon
Fixed in
1.2.6.5
What to do
Update Contact Form 7 Database Addon to 1.2.6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3537 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
Product
Role Based Pricing for WooCommerce
Fixed in
1.6.2
What to do
Update Role Based Pricing for WooCommerce to 1.6.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3536 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blog
Product
Role Based Pricing for WooCommerce
Fixed in
1.6.3
What to do
Update Role Based Pricing for WooCommerce to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 17, 2022Passster: Stores the password inside a cookie named "passster" using base64 encoding methodCVE-2022-3206 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.
Product
Passster
Fixed in
3.5.5.5.2
What to do
Update Passster to 3.5.5.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2022WP 2FA: Uses comparison operators that don't mitigate time-based attacksCVE-2022-2891 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.
Product
WP 2FA
Fixed in
2.3.0
What to do
Update WP 2FA to 2.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2022Simple SEO: Attribute-based stored Cross-Site ScriptingCVE-2022-1628 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple SEO plugin for WordPress is vulnerable to attribute-based stored Cross-Site Scripting in versions up to, and including 1.7.91, due to insufficient sanitization or escaping on the SEO social and standard title parameters. This can be exploited by authenticated users with Contributor and above permissions to inject arbitrary web scripts into posts/pages that execute whenever an administrator access the page.
Product
Simple SEO
Affected
up to 1.7.91
What to do
Affects up to 1.7.91. Update Simple SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 5, 2022WP Database Backup: Does not escape some of its settingsCVE-2022-2271 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Database Backup
Fixed in
5.9
What to do
Update WP Database Backup to 5.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Student Result or Employee Database: Does not have CSRF in its AJAX actionsCVE-2022-2312 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a role as low as contributor to add/edit and delete students via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site scripting
Product
Student Result or Employee Database
Fixed in
1.7.5
What to do
Update Student Result or Employee Database to 1.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Invitation Based Registrations: Does not sanitise and escape some of its settingsCVE-2022-2325 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Invitation Based Registrations
Affected
up to 2.2.84
What to do
Affects up to 2.2.84. Update Invitation Based Registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Advanced Database Cleaner: Does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
Product
Advanced Database Cleaner
Fixed in
3.1.1
What to do
Update Advanced Database Cleaner to 3.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.CVE-2022-29455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com rotem-bar.com
Jun 13, 2022WP Athletics: Does not sanitize parameters before storing them in the databaseCVE-2022-1549 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.
Product
WP Athletics
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WP Athletics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022Database Backup for: Does not have CSRF check in placeCVE-2022-1577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
Product
Database Backup for
Fixed in
2.5.2
What to do
Update Database Backup for to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 20, 2022KubiQ CPT base plugin <= 5.8 at: Cross-Site Request Forgery (CSRF)CVE-2022-29431 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base.
Product
KubiQ CPT base plugin <= 5.8 at
Affected
up to 5.8
What to do
Affects up to 5.8. Update KubiQ CPT base plugin <= 5.8 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022Web To Print Shop : uDraw: Does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function CVE-2022-0656 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
Product
Web To Print Shop : uDraw
Fixed in
3.3.3
What to do
Update Web To Print Shop : uDraw to 3.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Database Peek: Does not sanitize and escape the match parameter before outputting it back in an admin pageCVE-2022-0619 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Database Peek
Affected
up to 1.2
What to do
Affects up to 1.2. Update Database Peek to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WP Accessibility Helper (WAH): Does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the pageCVE-2022-0150 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue
Product
WP Accessibility Helper (WAH)
Fixed in
0.6.0.7
What to do
Update WP Accessibility Helper (WAH) to 0.6.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
Product
Database Backup for
Fixed in
2.5.1
What to do
Update Database Backup for to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Advanced Database Cleaner: Does not sanitise and escape $_GET keys and values before outputting them back in attributesCVE-2021-24921 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Advanced Database Cleaner
Fixed in
3.0.4
What to do
Update Advanced Database Cleaner to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Futurio Extra: Is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the databaseCVE-2021-25109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
Product
Futurio Extra
Fixed in
1.6.3
What to do
Update Futurio Extra to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21664 · WordPress plugins & themes · reported by GitHubHigh 7.4
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21663 · WordPress plugins & themes · reported by GitHubMedium 6.6
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.sonarsource.com github.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21662 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21661 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com github.com
Dec 22, 2021Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).CVE-2021-36886 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).
Affected
up to 1.2.5.9
What to do
Affects up to 1.2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.