Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
596 results · page 11 of 12
May 16, 2022WPCargo Track & Trace: Does not sanitize and escapes some of its settingsCVE-2022-1435 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
May 16, 2022Social Stickers: Does not have CSRF checks in placeCVE-2022-1418 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does not escape some of these fields, which could allow attackers to make a logged-in admin change them and lead to Stored Cross-Site Scripting issues.
- Product
- Social Stickers
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Social Stickers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not have CSRF check in placeCVE-2022-1407 · WordPress plugins & themes · reported by WPScanMedium 6.5
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 2, 2022Tipsacarrier: Does not have any authorisation check in place some functionsCVE-2021-25002 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL
- Product
- Tipsacarrier
- Fixed in
- 1.5.0.5
- What to do
- Update Tipsacarrier to 1.5.0.5 or newer.
Apr 25, 2022LayerSlider: Does not sanitise and escape Project's slug before outputting it back in various placeCVE-2022-1153 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- LayerSlider
- Fixed in
- 7.1.2
- What to do
- Update LayerSlider to 7.1.2 or newer.
Apr 25, 2022myCred: Does not have any authorisation in place in its mycred-tools-select-user AJAX actionCVE-2022-0287 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog
- Product
- myCred
- Fixed in
- 2.4.4.1
- What to do
- Update myCred to 2.4.4.1 or newer.
Apr 18, 2022Autolinks: Does not have CSRF check in placeCVE-2022-1112 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as escape them, which could allow attackers to perform Stored Cross-Site scripting against a logged in admin via a CSRF attack
- Product
- Autolinks
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Autolinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Easy Digital Downloads: Does not have CSRF check in placeCVE-2022-0707 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack
- Product
- Easy Digital Downloads
- Fixed in
- 2.11.6
- What to do
- Update Easy Digital Downloads to 2.11.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 11, 2022Export All URLs: Does not have CSRF in placeCVE-2022-0914 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
- Product
- Export All URLs
- Fixed in
- 4.3
- What to do
- Update Export All URLs to 4.3 or newer.
Apr 4, 2022FormBuilder: Does not have CSRF checks in placeCVE-2022-0830 · WordPress plugins & themes · reported by WPScanMedium 6.5
The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in them.
- Product
- FormBuilder
- Affected
- up to 1.08
- What to do
- Affects up to 1.08. Update FormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Sermon Browser: Does not have CSRF checks in placeCVE-2022-0499 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.
- Product
- Sermon Browser
- Affected
- up to 0.45.22
- What to do
- Affects up to 0.45.22. Update Sermon Browser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 21, 2022Simple Membership: Does not have CSRF check in placeCVE-2022-0681 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack
- Product
- Simple Membership
- Fixed in
- 4.1.0
- What to do
- Update Simple Membership to 4.1.0 or newer.
Mar 21, 2022Amelia: Does not have CSRF check in placeCVE-2022-0616 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack
- Product
- Amelia
- Fixed in
- 1.0.47
- What to do
- Update Amelia to 1.0.47 or newer.
Mar 14, 2022WPCargo Track & Trace: Contains a fileCVE-2021-25003 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.0
- What to do
- Update WPCargo Track & Trace to 6.9.0 or newer.
Mar 7, 2022WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent: Does not have CSRF checks in placeCVE-2022-0445 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack
- Product
- WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent
- Fixed in
- 2.14.2
- What to do
- Update WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent to 2.14.2 or newer.
Feb 21, 2022Float menu: Does not have CSRF check in placeCVE-2022-0313 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Float menu
- Fixed in
- 4.3.1
- What to do
- Update Float menu to 4.3.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022AnyComment: Is affected by a race conditionCVE-2022-0279 · WordPress plugins & themes · reported by WPScanLow 3.1
The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Feb 14, 2022Remove Footer Credit: Does not have CSRF check in placeCVE-2021-24446 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
- Product
- Remove Footer Credit
- Fixed in
- 1.0.6
- What to do
- Update Remove Footer Credit to 1.0.6 or newer.
Feb 1, 2022LabTools: Does not have proper authorisation and CSRF check in placeCVE-2021-25097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
- Product
- LabTools
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update LabTools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2022Link Library: Does not have authorisation in placeCVE-2021-25093 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary links via a crafted request
- Product
- Link Library
- Fixed in
- 7.2.8
- What to do
- Update Link Library to 7.2.8 or newer.
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not have CSRF check in placeCVE-2021-25072 · WordPress plugins & themes · reported by WPScanMedium 6.5
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.25
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.25 or newer.
Jan 24, 2022Accept Donations with PayPal: Does not have CSRF check in place and does not ensure that the post to be deleted belongs to the pluginCVE-2021-24989 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.4
- What to do
- Update Accept Donations with PayPal to 1.3.4 or newer.
Jan 17, 2022Smash Balloon Social Post Feed: Was affected by a reflected XSS in custom-facebook-feed in cff-top admin pageCVE-2021-25065 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 4.1.1
- What to do
- Update Smash Balloon Social Post Feed to 4.1.1 or newer.
Dec 21, 2021The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not propeCVE-2021-24849 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
- Product
- WCFM Marketplace
- Fixed in
- 3.4.12
- What to do
- Update WCFM Marketplace to 3.4.12 or newer.
Dec 13, 2021Page/Post Content Shortcode: Does not have proper authorisation in placeCVE-2021-24819 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors.
- Product
- Page/Post Content Shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Page/Post Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Shiny Buttons: Does not have any authorisation and CSRF in placeCVE-2021-24792 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.
- Product
- Shiny Buttons
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Shiny Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021NEX-Forms: Does not have CSRF checks in placeCVE-2021-24705 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them
- Product
- NEX-Forms
- Fixed in
- 8.4.3
- What to do
- Update NEX-Forms to 8.4.3 or newer.
Nov 29, 2021URL Shortify: Does not have CSRF check in placeCVE-2021-24749 · WordPress plugins & themes · reported by WPScanMedium 4.3
The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.
- Product
- URL Shortify
- Fixed in
- 1.5.1
- What to do
- Update URL Shortify to 1.5.1 or newer.
Nov 23, 2021Images to WebP: Does not have CSRF checks in placeCVE-2021-24641 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion
- Product
- Images to WebP
- Fixed in
- 1.9
- What to do
- Update Images to WebP to 1.9 or newer.
Nov 17, 2021MouseWheel Smooth Scroll: Does not have CSRF check in place on its settings pageCVE-2021-24852 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- MouseWheel Smooth Scroll
- Fixed in
- 5.7
- What to do
- Update MouseWheel Smooth Scroll to 5.7 or newer.
Nov 15, 2021plugins/wordpress_sso/pages/index.php: ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site ScriptingCVE-2021-41951 · WordPress plugins & themes · reported by MITREMedium 6.1
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- plugins/wordpress_sso/pages/index.php
- Fixed in
- 9.6
- What to do
- Update plugins/wordpress_sso/pages/index.php to 9.6 or newer.
Full record and what to do →NVD recordhorizon3.aihorizon3.ai
Nov 8, 2021WP SEO Redirect 301: Does not have CSRF in placeCVE-2021-24832 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- WP SEO Redirect 301
- Fixed in
- 2.3.2
- What to do
- Update WP SEO Redirect 301 to 2.3.2 or newer.
Nov 8, 2021WP Survey Plus: Does not have any authorisation and CSRF checks in place in its AJAX actionsCVE-2021-24801 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues
- Product
- WP Survey Plus
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Survey Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2021Post Expirator: Does not have proper capability checks in placeCVE-2021-24783 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.
- Product
- Post Expirator
- Fixed in
- 2.6.0
- What to do
- Update Post Expirator to 2.6.0 or newer.
Nov 8, 2021404 to 301 – Redirect, Log and Notify 404 Errors: Does not have CSRF check in placeCVE-2021-24766 · WordPress plugins & themes · reported by WPScanMedium 6.5
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack
- Product
- 404 to 301 – Redirect, Log and Notify 404 Errors
- Fixed in
- 3.0.9
- What to do
- Update 404 to 301 – Redirect, Log and Notify 404 Errors to 3.0.9 or newer.
Nov 8, 2021Genie WP Favicon: Does not have CSRF in placeCVE-2021-24674 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Genie WP Favicon WordPress plugin through 0.5.2 does not have CSRF in place when updating the favicon, which could allow attackers to make a logged in admin change it via a CSRF attack
- Product
- Genie WP Favicon
- Affected
- up to 0.5.2
- What to do
- Affects up to 0.5.2. Update Genie WP Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2021WP-Pro-Quiz: Does not have CSRF check in placeCVE-2020-36504 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog
- Product
- WP-Pro-Quiz
- Affected
- up to 0.37
- What to do
- Affects up to 0.37. Update WP-Pro-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021St-Daily-Tip: Does not have any CSRF check in placeCVE-2021-24487 · WordPress plugins & themes · reported by WPScanHigh 8.8
The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue
- Product
- St-Daily-Tip
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update St-Daily-Tip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Scroll Baner: Does not have CSRF check in placeCVE-2021-24642 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS
- Product
- Scroll Baner
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Scroll Baner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2021Weather Effect: Does not have any CSRF checks in placeCVE-2021-24683 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.
- Product
- Weather Effect
- Fixed in
- 1.3.4
- What to do
- Update Weather Effect to 1.3.4 or newer.
Oct 4, 2021Better Find and Replace: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24676 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
- Product
- Better Find and Replace
- Fixed in
- 1.2.9
- What to do
- Update Better Find and Replace to 1.2.9 or newer.
Sep 13, 2021Fileviewer: Does not have CSRF checks in placeCVE-2021-24491 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack
- Product
- Fileviewer
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Fileviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Language Bar Flags: Does not have any CSRF in placeCVE-2021-24431 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users
- Product
- Language Bar Flags
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Language Bar Flags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2021WP Design Maps & Places: Reflected Cross-Site ScriptingCVE-2021-38334 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
- Product
- WP Design Maps & Places
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP Design Maps & Places to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 23, 2021Contact Form 7 Captcha: Does not have any CSRF check in placeCVE-2021-24565 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.
- Product
- Contact Form 7 Captcha
- Fixed in
- 0.0.9
- What to do
- Update Contact Form 7 Captcha to 0.0.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 23, 2021AceIDE: Does not sanitise or validate the user inputCVE-2021-24549 · WordPress plugins & themes · reported by WPScanMedium 4.9
The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server outside of the blog directory via a path traversal attack.
- Product
- AceIDE
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update AceIDE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 16, 2021Custom Login Redirect: Does not have CSRF check in placeCVE-2021-24536 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue
- Product
- Custom Login Redirect
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021Verse-O-Matic: Does not have any CSRF checks in placeCVE-2021-24466 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this could also lead to Stored Cross-Site Scripting issues
- Product
- Verse-O-Matic
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Verse-O-Matic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021Social Tape: Does not have CSRF checks in placeCVE-2021-24411 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack
- Product
- Social Tape
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Social Tape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2021WP-CLI is the command-line interface for WordPress.CVE-2021-29504 · WordPress plugins & themes · reported by GitHubCritical 9.1
WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundl
- Fixed in
- 2.5.0
- What to do
- Update the plugin to 2.5.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.