Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

652 results · page 10 of 14

Sep 20, 2021Shortcodes Ultimate: Allows users with Contributor roles to perform stored XSS via shortcode attributesCVE-2021-24525 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).
Product
Shortcodes Ultimate
Fixed in
5.10.2
What to do
Update Shortcodes Ultimate to 5.10.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Edit Role functionality in the Display Users: Had an `id` parameterCVE-2021-24400 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Edit Role functionality in the Display Users WordPress plugin through 2.0.0 had an `id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
Edit Role functionality in the Display Users
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Edit Role functionality in the Display Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 13, 2021Smash Balloon Social Post Feed: Does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of iCVE-2021-24508 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
Product
Smash Balloon Social Post Feed
Fixed in
2.19.2
What to do
Update Smash Balloon Social Post Feed to 2.19.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2021.18
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2021.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 2, 2021The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `incluCVE-2021-38314 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Product
Gutenberg Template Library & Redux Framework
Affected
up to 4.2.11
What to do
Affects up to 4.2.11. Update Gutenberg Template Library & Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 23, 2021HM Multiple Roles: Does not have any access control to prevent low privilege users to set themselvesCVE-2021-24602 · WordPress plugins & themes · reported by WPScanHigh 8.8
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
Product
HM Multiple Roles
Fixed in
1.3
What to do
Update HM Multiple Roles to 1.3 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Aug 5, 2021Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g.CVE-2021-34639 · WordPress plugins & themes · reported by WordfenceHigh 7.5
Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Affected
up to 3.1.24
What to do
Affects up to 3.1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 5, 2021Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file inforCVE-2021-34638 · WordPress plugins & themes · reported by WordfenceMedium 6.5
Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Affected
up to 3.1.24
What to do
Affects up to 3.1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 2, 2021The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does nCVE-2021-24492 · WordPress plugins & themes · reported by WPScanHigh 8.8
The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
Product
Handsome Testimonials & Reviews
Fixed in
2.1.1
What to do
Update Handsome Testimonials & Reviews to 2.1.1 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 2, 2021Migrate Users: Does not sanitise or escape its Delimiter option before outputting in a pageCVE-2021-24477 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack.
Product
Migrate Users
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Migrate Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2021Browser Screenshots: Allowed authenticated users with a roleCVE-2021-24439 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Browser Screenshots WordPress plugin before 1.7.6 allowed authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks as the image_class parameter of the browser-shot shortcode was not escaped.
Product
Browser Screenshots
Fixed in
1.7.6
What to do
Update Browser Screenshots to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 7, 2021Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibCVE-2020-24146 · WordPress plugins & themes · reported by MITREHigh 8.1
Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action.
Product
CM Download Manager (aka cm-download-manager)
Affected
2.7.0 to 2.7.0
What to do
Affects 2.7.0 to 2.7.0. Update CM Download Manager (aka cm-download-manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extCVE-2021-34627 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions CVE-2021-34626 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scriptCVE-2021-34625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users CVE-2021-34624 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 6, 2021Export Users With Meta: Did not escape the list of roles to export before using them in a SQL statement in the export functionalityCVE-2021-24451 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection.
Product
Export Users With Meta
Fixed in
0.6.5
What to do
Update Export Users With Meta to 0.6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 6, 2021The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised usCVE-2021-24384 · WordPress plugins & themes · reported by WPScanCritical 9.8
The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE
Product
JoomSport
Fixed in
5.1.8
What to do
Update JoomSport to 5.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021Comments Like Dislike: Allows users to like/dislike posted commentsCVE-2021-24379 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side
Product
Comments Like Dislike
Fixed in
1.1.4
What to do
Update Comments Like Dislike to 1.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021Jetpack Carousel module of the JetPack: Allows users to create a "carousel" type image gallery and allows users to comment on the imagesCVE-2021-24374 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.
Product
Jetpack Carousel module of the JetPack
Fixed in
9.8
What to do
Update Jetpack Carousel module of the JetPack to 9.8 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Jun 21, 2021In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fieCVE-2021-24369 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation.
Product
GetPaid
Fixed in
2.3.4
What to do
Update GetPaid to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021import_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirectsCVE-2021-24353 · WordPress plugins & themes · reported by WPScanHigh 8.8
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
Product
import_data function of the Simple 301 Redirects by BetterLinks
Fixed in
2.0.4
What to do
Update import_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 14, 2021export_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to export a site's redirectsCVE-2021-24352 · WordPress plugins & themes · reported by WPScanHigh 8.8
The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.
Product
export_data function of the Simple 301 Redirects by BetterLinks
Fixed in
2.0.4
What to do
Update export_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 14, 2021The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameCVE-2021-24348 · WordPress plugins & themes · reported by WPScanHigh 7.2
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
Product
Side Menu – add fixed side buttons
Fixed in
3.1.5
What to do
Update Side Menu – add fixed side buttons to 3.1.5 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 14, 2021SP Project & Document Manager: Allows users to upload filesCVE-2021-24347 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
Product
SP Project & Document Manager
Fixed in
4.22
What to do
Update SP Project & Document Manager to 4.22 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jun 14, 2021The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or esCVE-2021-24345 · WordPress plugins & themes · reported by WPScanMedium 6.6
The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
Product
Sendit WP Newsletter
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Sendit WP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 1, 2021wp_ajax_upload-remote-file AJAX action of the External Media: Was vulnerable to arbitrary file uploads via any authenticated usersCVE-2021-24311 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.
Product
wp_ajax_upload-remote-file AJAX action of the External Media
Fixed in
1.0.34
What to do
Update wp_ajax_upload-remote-file AJAX action of the External Media to 1.0.34 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 24, 2021The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilCVE-2021-24307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.
Fixed in
4.1.0.2
What to do
Update the plugin to 4.1.0.2 or newer.
Full record and what to do →NVD record aioseo.com wpscan.com
May 17, 2021ReDi Restaurant Reservation: Provides the functionality to let users make restaurant reservationsCVE-2021-24299 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.
Product
ReDi Restaurant Reservation
Fixed in
21.0426
What to do
Update ReDi Restaurant Reservation to 21.0426 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 17, 2021Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor: Have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.
Product
Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor
Fixed in
2.24.0
What to do
Update Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor to 2.24.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 17, 2021There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta datCVE-2021-24289 · WordPress plugins & themes · reported by WPScanHigh 8.8
There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
Product
Store Locator Plus for
Affected
up to 5.5.14
What to do
Affects up to 5.5.14. Update Store Locator Plus for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to instalCVE-2021-24279 · WordPress plugins & themes · reported by WPScanMedium 6.5
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to install any plugin from the WordPress repository.
Product
Redirection for Contact Form 7
Fixed in
2.3.4
What to do
Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce foCVE-2021-24278 · WordPress plugins & themes · reported by WPScanHigh 7.5
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
Product
Redirection for Contact Form 7
Fixed in
2.3.4
What to do
Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin beforeCVE-2021-24195 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login as User or Customer (User Switching) WordPress plugin before 1.8, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Login as User or Customer (User Switching)
Fixed in
1.8
What to do
Update Login as User or Customer (User Switching) to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin beCVE-2021-24194 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Login Protection - Limit Failed Login Attempts WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Login Protection - Limit Failed Login Attempts
Fixed in
2.9
What to do
Update Login Protection - Limit Failed Login Attempts to 2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12,CVE-2021-24193 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Visitor Traffic Real Time Statistics WordPress plugin before 2.12, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Visitor Traffic Real Time Statistics
Fixed in
2.12
What to do
Update Visitor Traffic Real Time Statistics to 2.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (iCVE-2021-24192 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Tree Sitemap
Fixed in
2.9
What to do
Update Tree Sitemap to 2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin befCVE-2021-24191 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
WP Maintenance Mode & Site Under Construction
Fixed in
1.8.2
What to do
Update WP Maintenance Mode & Site Under Construction to 1.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1CVE-2021-24190 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
WooCommerce Conditional Marketing Mailer
Fixed in
1.5.2
What to do
Update WooCommerce Conditional Marketing Mailer to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress pluginCVE-2021-24189 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
Captchinoo, Google recaptcha for admin login page
Fixed in
2.4
What to do
Update Captchinoo, Google recaptcha for admin login page to 2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin beforCVE-2021-24188 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
WP Content Copy Protection & No Right Click
Fixed in
3.1.5
What to do
Update WP Content Copy Protection & No Right Click to 3.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Contact Form Check Tester: Settings are visible to all registered users in the dashboard and are lacking any sanitisationCVE-2021-24247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
Product
Contact Form Check Tester
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Contact Form Check Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 5, 2021Clever Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Clever Addons for Elementor
Fixed in
2.1.0
What to do
Update Clever Addons for Elementor to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Ultimate Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Ultimate Addons for Elementor
Fixed in
1.30.0
What to do
Update Ultimate Addons for Elementor to 1.30.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021DeTheme Kit for Elementor: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24270 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
DeTheme Kit for Elementor
Fixed in
1.5.5.5
What to do
Update DeTheme Kit for Elementor to 1.5.5.5 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Sina Extension for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24269 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Sina Extension for Elementor
Fixed in
3.3.12
What to do
Update Sina Extension for Elementor to 3.3.12 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021JetWidgets For Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24268 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
JetWidgets For Elementor
Fixed in
1.0.9
What to do
Update JetWidgets For Elementor to 1.0.9 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021All-in-One Addons for Elementor – WidgetKit: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24267 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
All-in-One Addons for Elementor – WidgetKit
Fixed in
2.3.10
What to do
Update All-in-One Addons for Elementor – WidgetKit to 2.3.10 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021The Plus Addons for Elementor Page Builder Lite: Has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24266 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
The Plus Addons for Elementor Page Builder Lite
Fixed in
2.0.6
What to do
Update The Plus Addons for Elementor Page Builder Lite to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Rife Elementor Extensions & Templates: Has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24265 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Rife Elementor Extensions & Templates
Fixed in
1.1.6
What to do
Update Rife Elementor Extensions & Templates to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.