Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,155 results · page 12 of 24
May 16, 2022Advanced Image Sitemap: Does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin pageCVE-2022-1216 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
- Product
- Advanced Image Sitemap
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Advanced Image Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 10, 2022The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the uCVE-2022-1567 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 9, 2022Admin Menu Editor: Does not sanitize and escape a parameter before outputting it back in an admin pageCVE-2022-0625 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Admin Menu Editor
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Admin Menu Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2022Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock plugin <= 2.3.2 at WordPress via &ycd-coCVE-2022-29422 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock plugin <= 2.3.2 at WordPress via &ycd-countdown-width, &ycd-progress-height, &ycd-progress-width, &ycd-button-margin-top, &ycd-button-margin-right, &ycd-button-margin-bottom, &ycd-button-margin-left, &ycd-circle-countdown-before-countdown, &ycd-circle-countdown-after-countdown vulnerable parameters.
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 2, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin <= 1.2.12 on WordPress.CVE-2021-36844 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin <= 1.2.12 on WordPress.
- Affected
- up to 1.2.12
- What to do
- Affects up to 1.2.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 2, 2022Fast Flow: Does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboardCVE-2022-1269 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Fast Flow
- Fixed in
- 1.2.12
- What to do
- Update Fast Flow to 1.2.12 or newer.
May 2, 2022Content Egg: Does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboardCVE-2022-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Content Egg
- Fixed in
- 5.3.0
- What to do
- Update Content Egg to 5.3.0 or newer.
May 2, 2022Advanced Page Visit Counter: Does not sanitise and escape some input before outputting it in an admin dashboard pageCVE-2021-25086 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it
- Product
- Advanced Page Visit Counter
- Fixed in
- 6.1.2
- What to do
- Update Advanced Page Visit Counter to 6.1.2 or newer.
Apr 25, 2022Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on WordPress via vulnerable parameters: &ntmodeCVE-2022-29418 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) in Mark Daniels Night Mode plugin <= 1.0.0 on WordPress via vulnerable parameters: &ntmode_page_setting[enable-me], &ntmode_page_setting[bg-color], &ntmode_page_setting[txt-color], &ntmode_page_setting[anc_color].
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 25, 2022Admin Word Count Column: Does not validate the path parameter given to readfile()CVE-2022-1390 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique
- Product
- Admin Word Count Column
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Admin Word Count Column to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 25, 2022Page Restriction WordPress (WP): Allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator uCVE-2022-1027 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator users.
- Product
- Page Restriction WordPress (WP)
- Fixed in
- 1.2.7
- What to do
- Update Page Restriction WordPress (WP) to 1.2.7 or newer.
Apr 25, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the QUERY_STRING before outputting it back in an admin pageCVE-2022-0953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
- Product
- Anti-Malware Security and Brute-Force Firewall
- Fixed in
- 4.20.96
- What to do
- Update Anti-Malware Security and Brute-Force Firewall to 4.20.96 or newer.
Apr 25, 2022Pricing Table by Supsystic: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46782 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table by Supsystic WordPress plugin before 1.9.5 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Pricing Table by Supsystic
- Fixed in
- 1.9.5
- What to do
- Update Pricing Table by Supsystic to 1.9.5 or newer.
Apr 25, 2022Coming Soon by Supsystic: Does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46781 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Coming Soon by Supsystic
- Fixed in
- 1.7.6
- What to do
- Update Coming Soon by Supsystic to 1.7.6 or newer.
Apr 25, 2022Easy Google Maps: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Easy Google Maps
- Fixed in
- 1.9.32
- What to do
- Update Easy Google Maps to 1.9.32 or newer.
Apr 25, 2022English WordPress Admin: Does not validate the admin_custom_language_return_url before redirecting users o itCVE-2021-25111 · WordPress plugins & themes · reported by WPScanMedium 6.1
The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue
- Product
- English WordPress Admin
- Fixed in
- 1.5.2
- What to do
- Update English WordPress Admin to 1.5.2 or newer.
Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0993 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
- Product
- SiteGround Security
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0992 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
- Product
- SiteGround Security
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 18, 2022Product Table for WooCommerce (wooproducttable): Does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
- Product
- Product Table for WooCommerce (wooproducttable)
- Fixed in
- 3.1.2
- What to do
- Update Product Table for WooCommerce (wooproducttable) to 3.1.2 or newer.
Apr 18, 2022Loco Translate: Does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panelCVE-2022-0765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
- Product
- Loco Translate
- Fixed in
- 2.6.1
- What to do
- Update Loco Translate to 2.6.1 or newer.
Apr 18, 2022A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts.CVE-2011-1762 · WordPress plugins & themes · reported by Red HatMedium 6.5
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Apr 15, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions.CVE-2021-36828 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions.
- Affected
- up to 6.0.7
- What to do
- Affects up to 6.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 14, 2022Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1CVE-2022-27848 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1
- Affected
- up to 6.5.1
- What to do
- Affects up to 6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2CVE-2022-27845 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.CVE-2021-36910 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.
- Affected
- up to 4.3.20
- What to do
- Affects up to 4.3.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Social Media Feather: Authenticated (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36848 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Feather (WordPress plugin) versions <= 2.0.4
- Product
- Social Media Feather
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Social Media Feather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Premio Chaty: Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS)CVE-2021-36846 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3
- Product
- Premio Chaty
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update Premio Chaty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the room parameter before outputting it back in an admin pageCVE-2022-1007 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.1
- What to do
- Update Advanced Booking Calendar to 1.7.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 11, 2022Favicon by RealFaviconGenerator: Does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboardCVE-2022-0471 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Favicon by RealFaviconGenerator
- Fixed in
- 1.3.23
- What to do
- Update Favicon by RealFaviconGenerator to 1.3.23 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 4, 2022wpDataTables: Authenticated (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-25618 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27
- Product
- wpDataTables
- Affected
- up to 2.1.27
- What to do
- Affects up to 2.1.27. Update wpDataTables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 4, 2022The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to aCVE-2022-0901 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
- Fixed in
- 2.7.12
- What to do
- Update the plugin to 2.7.12 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 4, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_interval parameter before outputting it back in an admin pageCVE-2022-0864 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
- Product
- UpdraftPlus WordPress Backup
- Fixed in
- 1.22.9
- What to do
- Update UpdraftPlus WordPress Backup to 1.22.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Mar 28, 2022Church Admin: Does not have authorisation and CSRF in some of its actionCVE-2022-0833 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin's DB data
- Product
- Church Admin
- Fixed in
- 3.4.135
- What to do
- Update Church Admin to 3.4.135 or newer.
Mar 28, 2022Bulk Creator: Does not sanitize and escape the post_type parameter before outputting it back in an admin pageCVE-2022-0647 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Bulk Creator
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Bulk Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Bank Mellat: Does not sanitize and escape the orderId parameter before outputting it back in an admin pageCVE-2022-0643 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Bank Mellat
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Bank Mellat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Popup Like box: Does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin pageCVE-2022-0641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Popup Like box
- Fixed in
- 3.6.1
- What to do
- Update Popup Like box to 3.6.1 or newer.
Mar 28, 2022dTabs: Does not sanitize and escape the tab parameter before outputting it back in an admin pageCVE-2022-0621 · WordPress plugins & themes · reported by WPScanMedium 6.1
The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- dTabs
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update dTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Delete Old Orders: Does not sanitize and escape the date parameter before outputting it back in an admin pageCVE-2022-0620 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Delete Old Orders
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Delete Old Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Database Peek: Does not sanitize and escape the match parameter before outputting it back in an admin pageCVE-2022-0619 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Database Peek
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Database Peek to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Conference Scheduler: Does not sanitize and escape the tab parameter before outputting back in an admin pageCVE-2022-0600 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Conference Scheduler
- Fixed in
- 2.4.3
- What to do
- Update Conference Scheduler to 2.4.3 or newer.
Mar 28, 2022Mapping Multiple URLs Redirect Same Page: Does not sanitize and escape the mmursp_id parameter before outputting it back in an admin pageCVE-2022-0599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Mapping Multiple URLs Redirect Same Page
- Affected
- up to 5.8
- What to do
- Affects up to 5.8. Update Mapping Multiple URLs Redirect Same Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Popup Builder: Does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboardCVE-2022-0479 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
- Product
- Popup Builder
- Fixed in
- 4.1.1
- What to do
- Update Popup Builder to 4.1.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 28, 2022The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected CroCVE-2021-25071 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- WordPress
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Pz-LinkCard: Does not sanitise and escape multiple parameters before outputting them back in admin dashboard pagesCVE-2021-25012 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
- Product
- Pz-LinkCard
- Affected
- up to 2.4.4.4
- What to do
- Affects up to 2.4.4.4. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25606 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.
- Affected
- up to 1.68.6
- What to do
- Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 21, 2022Pricing Table Builder: Does not sanitize and escape the postid parameter before outputting it back in an admin pageCVE-2022-0640 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Pricing Table Builder
- Fixed in
- 1.1.5
- What to do
- Update Pricing Table Builder to 1.1.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Mega Menu: Does not sanitize and escape the _wpnonce parameter before outputting it back in an admin pageCVE-2022-0628 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Mega Menu
- Fixed in
- 3.0.8
- What to do
- Update Mega Menu to 3.0.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Amelia: Does not sanitize and escape the code parameter before outputting it back in an admin pageCVE-2022-0627 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Amelia
- Fixed in
- 1.0.47
- What to do
- Update Amelia to 1.0.47 or newer.
Mar 21, 2022SEO Plugin by Squirrly SEO: Does not escape the type parameter before outputting it back in an attribute in an admin pageCVE-2021-25019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- SEO Plugin by Squirrly SEO
- Fixed in
- 11.1.12
- What to do
- Update SEO Plugin by Squirrly SEO to 11.1.12 or newer.
Mar 18, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25605 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.
- Affected
- up to 1.68.6
- What to do
- Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.