Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
688 results · page 11 of 14
Jul 18, 2022The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly cCVE-2022-2224 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly check for the existence of a nonce in the function gifeed_duplicate_feed. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected
- up to 1.0.0.27
- What to do
- Affects up to 1.0.0.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 18, 2022The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the CVE-2022-2223 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the existence of a nonce in the function ewic_duplicate_slider. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected
- up to 1.1.121
- What to do
- Affects up to 1.1.121. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 11, 2022Pricing Deals for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1057 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- Pricing Deals for WooCommerce
- Affected
- up to 2.0.2.02
- What to do
- Affects up to 2.0.2.02. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Allow svg files: Does not properly validate uploaded filesCVE-2022-1939 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to
- Product
- Allow svg files
- Fixed in
- 1.1
- What to do
- Update Allow svg files to 1.1 or newer.
Jun 20, 2022Events Made Easy: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1905 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Events Made Easy
- Fixed in
- 2.2.81
- What to do
- Update Events Made Easy to 2.2.81 or newer.
Jun 20, 2022Better Find and Replace: Does not properly sanitiseCVE-2022-1472 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
- Product
- Better Find and Replace
- Fixed in
- 1.3.6
- What to do
- Update Better Find and Replace to 1.3.6 or newer.
Jun 13, 2022Google Places Reviews: Does not properly escape its Google API key settingCVE-2022-1772 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.
- Product
- Google Places Reviews
- Fixed in
- 2.0.0
- What to do
- Update Google Places Reviews to 2.0.0 or newer.
Jun 13, 2022iQ Block Country: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-1762 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- iQ Block Country
- Fixed in
- 1.2.20
- What to do
- Update iQ Block Country to 1.2.20 or newer.
Jun 13, 2022Simple Membership: Does not properly sanitise and escape parameters before outputting them back in AJAX actionsCVE-2022-1724 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
- Product
- Simple Membership
- Fixed in
- 4.1.1
- What to do
- Update Simple Membership to 4.1.1 or newer.
Jun 13, 2022WP SVG Icons: Does not properly validate uploaded custom icon packsCVE-2022-0863 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
- Product
- WP SVG Icons
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update WP SVG Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter.CVE-2022-27231 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.
- Fixed in
- 13.2.0
- What to do
- Update the plugin to 13.2.0 or newer.
Jun 8, 2022Five Minute Webshop: Does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin pageCVE-2022-1685 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
- Product
- Five Minute Webshop
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Photo Gallery by 10Web: Does not properly validate and escape some of its settingsCVE-2022-1394 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.4
- What to do
- Update Photo Gallery by 10Web to 1.6.4 or newer.
Jun 8, 2022Ask me: Does not properly sanitise and escape several of the fields in the Edit Profile pageCVE-2022-1241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues
- Product
- Ask me
- Fixed in
- 6.8.2
- What to do
- Update Ask me to 6.8.2 or newer.
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 30, 2022External Links in New Window / New Tab: Does not properly escape URLs it concatenates to onclick event handlersCVE-2022-1582 · WordPress plugins & themes · reported by WPScanMedium 6.1
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
- Product
- External Links in New Window / New Tab
- Fixed in
- 1.43
- What to do
- Update External Links in New Window / New Tab to 1.43 or newer.
May 30, 2022StaffList: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-1556 · WordPress plugins & themes · reported by WPScanCritical 9.8
The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection
- Product
- StaffList
- Fixed in
- 3.1.5
- What to do
- Update StaffList to 3.1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
- Product
- JivoChat Live Chat
- Fixed in
- 1.3.5.4
- What to do
- Update JivoChat Live Chat to 1.3.5.4 or newer.
May 23, 2022Sliderby10Web: Does not properly sanitize and escape some of its settingsCVE-2022-1320 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Sliderby10Web
- Fixed in
- 1.2.52
- What to do
- Update Sliderby10Web to 1.2.52 or newer.
May 23, 2022WP Contacts Manager: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1014 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.
- Product
- WP Contacts Manager
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Contacts Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not properly validate imagesCVE-2022-1409 · WordPress plugins & themes · reported by WPScanHigh 7.2
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 16, 2022The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statemenCVE-2022-0867 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users
- Product
- Pricing Table
- Fixed in
- 3.6.1
- What to do
- Update Pricing Table to 3.6.1 or newer.
May 9, 2022Themify Post Type Builder Search Addon: Does not properly escape the current page URL before reusing it in a HTML attributeCVE-2022-1047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability.
- Product
- Themify Post Type Builder Search Addon
- Fixed in
- 1.4.0
- What to do
- Update Themify Post Type Builder Search Addon to 1.4.0 or newer.
May 9, 2022Personal Dictionary: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1013 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability.
- Product
- Personal Dictionary
- Fixed in
- 1.3.4
- What to do
- Update Personal Dictionary to 1.3.4 or newer.
May 9, 2022SEMA API: Does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX actionCVE-2022-0836 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users
- Product
- SEMA API
- Fixed in
- 4.02
- What to do
- Update SEMA API to 4.02 or newer.
May 9, 2022Ubigeo de Perú para Woocommerce: Does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actionsCVE-2022-0814 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
- Product
- Ubigeo de Perú para Woocommerce
- Fixed in
- 3.6.4
- What to do
- Update Ubigeo de Perú para Woocommerce to 3.6.4 or newer.
May 9, 2022WPGraphQL: Doesn't properly restrict access to information about other users' roles on the affected siteCVE-2019-25060 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
- Product
- WPGraphQL
- Fixed in
- 0.3.5
- What to do
- Update WPGraphQL to 0.3.5 or newer.
May 2, 2022Photo Gallery by 10Web: Does not properly sanitize the $_GET['image_url'] variableCVE-2022-1282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.3
- What to do
- Update Photo Gallery by 10Web to 1.6.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022Photo Gallery: Does not properly escape the $_POST['filter_tag'] parameterCVE-2022-1281 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
- Product
- Photo Gallery
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022Multiple Shipping Address Woocommerce: Does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated usersCVE-2022-0783 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
- Product
- Multiple Shipping Address Woocommerce
- Fixed in
- 2.0
- What to do
- Update Multiple Shipping Address Woocommerce to 2.0 or newer.
Apr 25, 2022Users Ultra: Fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and auCVE-2022-0769 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.
- Product
- Users Ultra
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Users Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 20225 Stars Rating Funnel WordPress Plugin | RRatingg: Does not properly sanitiseCVE-2022-0657 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections.
- Product
- 5 Stars Rating Funnel WordPress Plugin | RRatingg
- Fixed in
- 1.2.54
- What to do
- Update 5 Stars Rating Funnel WordPress Plugin | RRatingg to 1.2.54 or newer.
Apr 25, 2022DW Question & Answer Pro: Does not properly check for CSRF in some of its functionsCVE-2021-24805 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.
- Product
- DW Question & Answer Pro
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update DW Question & Answer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Loco Translate: Does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panelCVE-2022-0765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
- Product
- Loco Translate
- Fixed in
- 2.6.1
- What to do
- Update Loco Translate to 2.6.1 or newer.
Apr 18, 2022Ad Injection: Does not properly sanitize the body of the adverts injected into the pagesCVE-2022-0661 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
- Product
- Ad Injection
- Affected
- up to 1.2.0.19
- What to do
- Affects up to 1.2.0.19. Update Ad Injection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts.CVE-2011-1762 · WordPress plugins & themes · reported by Red HatMedium 6.5
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Apr 11, 2022Podcast Importer SecondLine: Does not sanitise and properly escape some imported dataCVE-2022-1023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
- Product
- Podcast Importer SecondLine
- Fixed in
- 1.3.8
- What to do
- Update Podcast Importer SecondLine to 1.3.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 11, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJACVE-2022-0949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 6.930
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 6.930 or newer.
Apr 11, 2022Easy Social Icons: Does not properly escape the image_file fieldCVE-2022-0840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
- Product
- Easy Social Icons
- Fixed in
- 3.2.1
- What to do
- Update Easy Social Icons to 3.2.1 or newer.
Apr 11, 2022Favicon by RealFaviconGenerator: Does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboardCVE-2022-0471 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Favicon by RealFaviconGenerator
- Fixed in
- 1.3.23
- What to do
- Update Favicon by RealFaviconGenerator to 1.3.23 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 28, 2022String locator: Does not properly validate the path of the files to be searchedCVE-2022-0493 · WordPress plugins & themes · reported by WPScanMedium 4.9
The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be provided, which will be used to output the relevant matches from the matching file, all content of the file can be disclosed.
- Product
- String locator
- Fixed in
- 2.5.0
- What to do
- Update String locator to 2.5.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 28, 2022Block Bad Bots: Does not properly sanitise and escape the User Agent before using it in a SQL statement to record logsCVE-2021-25070 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue
- Product
- Block Bad Bots
- Fixed in
- 6.88
- What to do
- Update Block Bad Bots to 6.88 or newer.
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- BookingPress
- Fixed in
- 1.0.11
- What to do
- Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
- Product
- WordPress Zero Spam
- Fixed in
- 5.2.11
- What to do
- Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 14, 2022HTML5 Responsive FAQ: Does not properly sanitise and escape some of its settingsCVE-2021-24995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- HTML5 Responsive FAQ
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update HTML5 Responsive FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
- Product
- Database Backup for
- Fixed in
- 2.5.1
- What to do
- Update Database Backup for to 2.5.1 or newer.
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
- Product
- Popup Builder
- Fixed in
- 4.0.7
- What to do
- Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 17, 2022The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nCVE-2022-0633 · WordPress plugins & themes · reported by WPScanMedium 6.5
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
- Fixed in
- 1.22.3
- What to do
- Update the plugin to 1.22.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comjetpack.com
Feb 14, 2022NewStatPress: Does not properly escape the whatX parameters before outputting them back in attributesCVE-2022-0206 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- NewStatPress
- Fixed in
- 1.3.6
- What to do
- Update NewStatPress to 1.3.6 or newer.
Feb 14, 2022Remove Footer Credit: Does properly sanitise its settingsCVE-2021-25050 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Remove Footer Credit
- Fixed in
- 1.0.11
- What to do
- Update Remove Footer Credit to 1.0.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.