Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,287 results · page 124 of 126
Jul 28, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.CVE-2022-35882 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 25, 2022Professional Social Sharing Buttons, Icons & Related Posts: Does not have proper authorisation check in one of the AJAX actionCVE-2022-0594 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
- Product
- Professional Social Sharing Buttons, Icons & Related Posts
- Fixed in
- 9.7.6
- What to do
- Update Professional Social Sharing Buttons, Icons & Related Posts to 9.7.6 or newer.
Jul 18, 2022plugin Wbcom Designs – BuddyPress Group Reviews: Unauthorized settings changes and review modificationCVE-2022-2108 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.
- Product
- plugin Wbcom Designs – BuddyPress Group Reviews
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update plugin Wbcom Designs – BuddyPress Group Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 11, 2022Shortcut Macros: Does not have authorisation and CSRF checks in placeCVE-2022-1956 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them.
- Product
- Shortcut Macros
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Shortcut Macros to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022ARMember: Is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated usersCVE-2022-1903 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
- Product
- ARMember
- Fixed in
- 3.4.8
- What to do
- Update ARMember to 3.4.8 or newer.
Jun 27, 2022HTML2WP: Does not have authorisation and CSRF checksCVE-2022-1574 · WordPress plugins & themes · reported by WPScanCritical 9.8
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022HTML2WP: Does not have authorisation and CSRF checks in an AJAX actionCVE-2022-1572 · WordPress plugins & themes · reported by WPScanHigh 8.1
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Backup, Restore and Migrate WordPress Sites With the XCloner: Does not have authorisation and CSRF checksCVE-2022-0444 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.
- Product
- Backup, Restore and Migrate WordPress Sites With the XCloner
- Fixed in
- 4.3.6
- What to do
- Update Backup, Restore and Migrate WordPress Sites With the XCloner to 4.3.6 or newer.
Jun 15, 2022Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress.CVE-2022-29438 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress.
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 13, 2022Filr: Does not have authorisation check in two of its AJAX actionsCVE-2022-1777 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
- Product
- Filr
- Fixed in
- 1.2.2.1
- What to do
- Update Filr to 1.2.2.1 or newer.
Jun 13, 2022Member Hero: Lacks authorization checksCVE-2022-0885 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
- Product
- Member Hero
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Member Hero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Enqueue Anything: Does not have authorisation and CSRF checks in the remove_asset AJAX actionCVE-2021-25116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
- Product
- Enqueue Anything
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Enqueue Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Files Download Delay: Does not have authorisation and CSRF checksCVE-2022-1570 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.
- Product
- Files Download Delay
- Fixed in
- 1.0.7
- What to do
- Update Files Download Delay to 1.0.7 or newer.
Jun 2, 2022Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at WordPress.CVE-2021-36866 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at WordPress.
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 30, 2022Content Mask: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2022-1203 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
- Product
- Content Mask
- Fixed in
- 1.8.4.1
- What to do
- Update Content Mask to 1.8.4.1 or newer.
May 16, 2022ULeak Security & Monitoring: Does not have authorisation and CSRF checksCVE-2022-1557 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings
- Product
- ULeak Security & Monitoring
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update ULeak Security & Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022External Media without Import: Does not have any authorisation and does to ensure that medias added via URLs are external mediasCVE-2022-1398 · WordPress plugins & themes · reported by WPScanMedium 6.5
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks
- Product
- External Media without Import
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update External Media without Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022Popup by Supsystic: Does not have any authentication and authorisation in an AJAX actionCVE-2022-0424 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
- Product
- Popup by Supsystic
- Fixed in
- 1.10.9
- What to do
- Update Popup by Supsystic to 1.10.9 or newer.
May 2, 2022Sitemap by click5: Does not have authorisation and CSRF checksCVE-2022-0952 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.
- Product
- Sitemap by click5
- Fixed in
- 1.0.36
- What to do
- Update Sitemap by click5 to 1.0.36 or newer.
May 2, 2022Tipsacarrier: Does not have any authorisation check in place some functionsCVE-2021-25002 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL
- Product
- Tipsacarrier
- Fixed in
- 1.5.0.5
- What to do
- Update Tipsacarrier to 1.5.0.5 or newer.
Apr 25, 2022myCred: Does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX actionCVE-2022-1092 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog
- Product
- myCred
- Fixed in
- 2.4.3.1
- What to do
- Update myCred to 2.4.3.1 or newer.
Apr 25, 2022ThirstyAffiliates: Lacks authorization checks in the ta_insert_external_image actionCVE-2022-0634 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request.
- Product
- ThirstyAffiliates
- Fixed in
- 3.10.5
- What to do
- Update ThirstyAffiliates to 3.10.5 or newer.
Apr 25, 2022ThirstyAffiliates Affiliate Link Manager: Does not have authorisation and CSRF checksCVE-2022-0398 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website
- Product
- ThirstyAffiliates Affiliate Link Manager
- Fixed in
- 3.10.5
- What to do
- Update ThirstyAffiliates Affiliate Link Manager to 3.10.5 or newer.
Apr 25, 2022myCred: Does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX actionCVE-2022-0363 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
- Product
- myCred
- Fixed in
- 2.4.3.1
- What to do
- Update myCred to 2.4.3.1 or newer.
Apr 25, 2022myCred: Does not have any authorisation in place in its mycred-tools-select-user AJAX actionCVE-2022-0287 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog
- Product
- myCred
- Fixed in
- 2.4.4.1
- What to do
- Update myCred to 2.4.4.1 or newer.
Apr 19, 2022MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6: Cross-site request forgery (CSRF)CVE-2022-27629 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 allows a remote unauthenticated attacker to hijack the authentication of an administrator and perform unintended operation via unspecified vectors.
- Product
- MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6
- Fixed in
- 1.9.6
- What to do
- Update MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 to 1.9.6 or newer.
Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org
Apr 19, 2022Elementor Website Builder: Unauthorized execution of several AJAX actionsCVE-2022-1329 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
- Product
- Elementor Website Builder
- Affected
- 3.6.0 to 3.6.2
- What to do
- Affects 3.6.0 to 3.6.2. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Apr 18, 2022RSVP and Event Management: Does not have any authorisation checksCVE-2022-1054 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
- Product
- RSVP and Event Management
- Fixed in
- 2.7.8
- What to do
- Update RSVP and Event Management to 2.7.8 or newer.
Apr 18, 2022Product Table for WooCommerce (wooproducttable): Does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
- Product
- Product Table for WooCommerce (wooproducttable)
- Fixed in
- 3.1.2
- What to do
- Update Product Table for WooCommerce (wooproducttable) to 3.1.2 or newer.
Apr 18, 2022Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9CVE-2022-27853 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9
- Affected
- up to 13.1.0.9
- What to do
- Affects up to 13.1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Pricing Table: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS)CVE-2021-36896 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2
- Product
- Pricing Table
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022Responsive Tabs: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS)CVE-2021-36893 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress plugin) <= 4.0.5
- Product
- Responsive Tabs
- Affected
- up to 4.0.5
- What to do
- Affects up to 4.0.5. Update Responsive Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 11, 2022The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to aCVE-2022-0920 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data
- Fixed in
- 7.6.3
- What to do
- Update the plugin to 7.6.3 or newer.
Apr 11, 2022The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated userCVE-2022-0919 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.
- Fixed in
- 7.6.3
- What to do
- Update the plugin to 7.6.3 or newer.
Apr 11, 2022Portfolio Gallery, Product Catalog: Does not have authorisation and CSRF checks in various functions related to AJAX actionsCVE-2021-25090 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
- Product
- Portfolio Gallery, Product Catalog
- Fixed in
- 2.1.0
- What to do
- Update Portfolio Gallery, Product Catalog to 2.1.0 or newer.
Apr 4, 2022Amelia: Does not have proper authorisationCVE-2022-0837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerability to drain out the account balance by keep sending SMS notification.
- Product
- Amelia
- Fixed in
- 1.0.48
- What to do
- Update Amelia to 1.0.48 or newer.
Apr 4, 2022Amelia: Does not have proper authorisationCVE-2022-0825 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
- Product
- Amelia
- Fixed in
- 1.0.49
- What to do
- Update Amelia to 1.0.49 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 4, 2022Material Design for Contact Form 7: Does not check authorization or that the option mentioned in the notice param belongs to the pluginCVE-2022-0404 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.
- Product
- Material Design for Contact Form 7
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Material Design for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2022Dropdown Menu Widget: Does not have authorisation and CSRF checksCVE-2021-25113 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- Dropdown Menu Widget
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update Dropdown Menu Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2022KingComposer: Does not have authorisationCVE-2021-25048 · WordPress plugins & themes · reported by WPScanMedium 5.4
The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them
- Product
- KingComposer
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2022Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1: Missing authorizationCVE-2022-23183 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
- Product
- Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1
- What to do
- Update Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 to the newest version.
Mar 28, 2022Church Admin: Does not have authorisation and CSRF in some of its actionCVE-2022-0833 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin's DB data
- Product
- Church Admin
- Fixed in
- 3.4.135
- What to do
- Update Church Admin to 3.4.135 or newer.
Mar 28, 2022WooCommerce Affiliate: Does not have authorization and CSRF checks on a specific action handlerCVE-2022-0818 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.
- Product
- WooCommerce Affiliate
- Fixed in
- 4.16.4.5
- What to do
- Update WooCommerce Affiliate to 4.16.4.5 or newer.
Mar 28, 2022Amelia: Does not have proper authorisationCVE-2022-0720 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
- Product
- Amelia
- Fixed in
- 1.0.47
- What to do
- Update Amelia to 1.0.47 or newer.
Mar 28, 2022Menu Image, Icons made easy: Does not have authorisation and CSRF checksCVE-2022-0450 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and does not validate, sanitise and escape them. As a result, any authenticate users, such as subscriber can update the settings or arbitrary menu and put Cross-Site Scripting payloads in them which will be triggered in the related menu in the frontend
- Product
- Menu Image, Icons made easy
- Fixed in
- 3.0.6
- What to do
- Update Menu Image, Icons made easy to 3.0.6 or newer.
Mar 25, 2022Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higherCVE-2022-25612 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact].
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 21, 20223D FlipBook: Does not have authorisation and CSRF checksCVE-2022-0423 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook.
- Product
- 3D FlipBook
- Fixed in
- 1.12.1
- What to do
- Update 3D FlipBook to 1.12.1 or newer.
Mar 21, 2022miniOrange's Google Authenticator: Does not have proper authorisation and CSRF checksCVE-2022-0229 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
- Product
- miniOrange's Google Authenticator
- Fixed in
- 5.5
- What to do
- Update miniOrange's Google Authenticator to 5.5 or newer.
Mar 21, 2022Advanced Contact form 7 DB: Does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX actionCVE-2021-24905 · WordPress plugins & themes · reported by WPScanHigh 8
The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.
- Product
- Advanced Contact form 7 DB
- Fixed in
- 1.8.7
- What to do
- Update Advanced Contact form 7 DB to 1.8.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.