Updated 32 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,156 results · page 13 of 24

Mar 18, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25605 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.
Affected
up to 1.68.6
What to do
Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress pluCVE-2021-23209 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated (admin user role) Persistent Cross-Site Scripting (XSS) vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress plugin (versions <= 1.0.77.32).
Affected
up to 1.0.77.32
What to do
Affects up to 1.0.77.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 18, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.CVE-2021-23150 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.
Affected
up to 1.0.77.31
What to do
Affects up to 1.0.77.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 14, 2022Team Circle Image Slider With Lightbox: Does not sanitize and escape the order_pos parameter before outputting it back in an admin pageCVE-2022-0648 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Team Circle Image Slider With Lightbox
Fixed in
1.0.16
What to do
Update Team Circle Image Slider With Lightbox to 1.0.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Countdown, Coming Soon, Maintenance: Does not sanitize and escape the post parameter before outputting it back in an admin pageCVE-2022-0601 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Countdown, Coming Soon, Maintenance
Fixed in
2.2.9
What to do
Update Countdown, Coming Soon, Maintenance to 2.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Product
WordPress Zero Spam
Fixed in
5.2.11
What to do
Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2022ARI Fancy Lightbox: Does not sanitise and escape the msg parameter before outputting it back in an admin pageCVE-2022-0161 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
ARI Fancy Lightbox
Fixed in
1.3.9
What to do
Update ARI Fancy Lightbox to 1.3.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Cookie Information | Free GDPR Consent Solution
Fixed in
2.0.8
What to do
Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022MOLIE: Does not escape the course_id parameter before outputting it back in the admin dashboardCVE-2021-25006 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
MOLIE
Affected
up to 0.5
What to do
Affects up to 0.5. Update MOLIE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Persian Woocommerce: Does not escape the s parameter before outputting it back in an attribute in the admin dashboardCVE-2021-24940 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue
Product
Persian Woocommerce
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update Persian Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022RegistrationMagic: Does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboardCVE-2022-0420 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
Product
RegistrationMagic
Fixed in
5.0.2.2
What to do
Update RegistrationMagic to 5.0.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022AdRotate: Does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to adminsCVE-2022-0267 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
Product
AdRotate
Fixed in
5.8.22
What to do
Update AdRotate to 5.8.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022Advanced iFrame: Does not sanitise and escape the ai_config_id parameter before outputting it back in an admin pageCVE-2021-24953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
Advanced iFrame
Fixed in
2022
What to do
Update Advanced iFrame to 2022 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WHMCS Bridge: Does not sanitise and escape the error parameter before outputting it back in admin dashboardCVE-2021-25112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
Product
WHMCS Bridge
Fixed in
6.4b
What to do
Update WHMCS Bridge to 6.4b or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022WP Cloudy, weather: Does not escape the post_id parameter before using it in a SQL statement in the admin dashboardCVE-2021-24864 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue
Product
WP Cloudy, weather
Fixed in
4.4.9
What to do
Update WP Cloudy, weather to 4.4.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unCVE-2021-24704 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
Product
Orange Form
Affected
up to 1.0
What to do
Affects up to 1.0. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
Product
Database Backup for
Fixed in
2.5.1
What to do
Update Database Backup for to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022GiveWP: Does not escape the json parameter before outputting it back in an attribute in the Import admin dashboardCVE-2022-0252 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
Product
GiveWP
Fixed in
2.17.3
What to do
Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Product
Popup Builder
Fixed in
4.0.7
What to do
Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Shield Security: Does not sanitise and escape admin notesCVE-2022-0211 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
Shield Security
Fixed in
13.0.6
What to do
Update Shield Security to 13.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the POST data before outputting it back in attributes of an admin pageCVE-2021-25101 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
Product
Anti-Malware Security and Brute-Force Firewall
Fixed in
4.20.94
What to do
Update Anti-Malware Security and Brute-Force Firewall to 4.20.94 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Complianz: Does not escape the s parameter before outputting it back in an attribute in an admin pageCVE-2022-0193 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Complianz
Fixed in
6.0.0
What to do
Update Complianz to 6.0.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022PowerPack Lite for Beaver Builder: Does not sanitise and escape the tab parameter before outputting it back in an admin pageCVE-2022-0176 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
PowerPack Lite for Beaver Builder
Fixed in
1.2.9.3
What to do
Update PowerPack Lite for Beaver Builder to 1.2.9.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022WooCommerce Stored Exporter: Was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin pageCVE-2022-0149 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
Product
WooCommerce Stored Exporter
Fixed in
2.7.1
What to do
Update WooCommerce Stored Exporter to 2.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs: Was vulnerable to reflected XSS on the my-sticky-elements-leads admin pageCVE-2022-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
Product
All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs
Fixed in
2.0.4
What to do
Update All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs to 2.0.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022Store Toolkit for WooCommerce: Does not sanitise and escape the tab parameter before outputting it back in an admin page in an error messageCVE-2021-25077 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting
Product
Store Toolkit for WooCommerce
Fixed in
2.3.2
What to do
Update Store Toolkit for WooCommerce to 2.3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 1, 2022Link Library: Does not sanitise and escape the settingscopy parameter before outputting it back in an admin pageCVE-2021-25091 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Link Library
Fixed in
7.2.9
What to do
Update Link Library to 7.2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022WOOF: Does not sanitise and escape the woof_redraw_elements before outputing back in an admin pageCVE-2021-25085 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting
Product
WOOF
Fixed in
1.2.6.3
What to do
Update WOOF to 1.2.6.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 1, 2022Skins for Contact Form 7: Does not sanitise and escape the tab parameter before outputting it back in an admin pageCVE-2021-25063 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Skins for Contact Form 7
Fixed in
2.5.1
What to do
Update Skins for Contact Form 7 to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Asset CleanUp: Page Speed Booster: Does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users)CVE-2021-24983 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issue
Product
Asset CleanUp: Page Speed Booster
Fixed in
1.3.8.5
What to do
Update Asset CleanUp: Page Speed Booster to 1.3.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not sanitise and escape logged requests before outputting them in the related admin dashboardCVE-2021-24975 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
Product
NextScripts: Social Networks Auto-Poster
Fixed in
4.3.24
What to do
Update NextScripts: Social Networks Auto-Poster to 4.3.24 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 1, 2022Asset CleanUp: Page Speed Booster: Does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin pageCVE-2021-24937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
Asset CleanUp: Page Speed Booster
Fixed in
1.3.8.5
What to do
Update Asset CleanUp: Page Speed Booster to 1.3.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Visual CSS Style Editor: Does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin pageCVE-2021-24934 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
Visual CSS Style Editor
Fixed in
7.5.4
What to do
Update Visual CSS Style Editor to 7.5.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 28, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).CVE-2022-23979 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
Affected
up to 3.0.15
What to do
Affects up to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jan 28, 2022Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6).CVE-2021-31567 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com patchstack.com
Jan 28, 2022Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameCVE-2021-23174 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].
Affected
up to 4.4.6
What to do
Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 24, 2022Orders Tracking for WooCommerce: Does not sanitise and escape the file_url before outputting it back in an admin pageCVE-2021-25062 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Orders Tracking for WooCommerce
Fixed in
1.1.10
What to do
Update Orders Tracking for WooCommerce to 1.1.10 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Backup and Staging by WP Time Capsule: Does not sanitise and escape the error parameter before outputting it back in an admin pageCVE-2021-25035 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Backup and Staging by WP Time Capsule
Fixed in
1.22.7
What to do
Update Backup and Staging by WP Time Capsule to 1.22.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier): Does not escape the effects parameter before outputting it back in an attribute in an admin pageCVE-2021-25031 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) WordPress plugin before 9.7.1 does not escape the effects parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier)
Fixed in
9.7.1
What to do
Update Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) to 9.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Tutor LMS: Does not escape the search parameter before outputting it back in an attribute in an admin pageCVE-2021-25017 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Tutor LMS
Fixed in
1.9.12
What to do
Update Tutor LMS to 1.9.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Protect WP Admin: Does not check for authorisation in the lib/pwa-deactivateCVE-2021-24906 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request
Product
Protect WP Admin
Fixed in
3.6.2
What to do
Update Protect WP Admin to 3.6.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022Landing Page Builder: Was affected by a reflected XSS in page-builder-add on the ulpb_post admin pageCVE-2021-25067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.
Product
Landing Page Builder
Fixed in
1.4.9.6
What to do
Update Landing Page Builder to 1.4.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022Smash Balloon Social Post Feed: Was affected by a reflected XSS in custom-facebook-feed in cff-top admin pageCVE-2021-25065 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
Product
Smash Balloon Social Post Feed
Fixed in
4.1.1
What to do
Update Smash Balloon Social Post Feed to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 17, 2022WP Booking System: Was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin pageCVE-2021-25061 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.
Product
WP Booking System
Fixed in
2.0.15
What to do
Update WP Booking System to 2.0.15 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 10, 2022WP Coder: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25053 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
Product
WP Coder
Fixed in
2.5.2
What to do
Update WP Coder to 2.5.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 10, 2022Button Generator: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25052 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
Product
Button Generator
Fixed in
2.3.3
What to do
Update Button Generator to 2.3.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 10, 2022Modal Window: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25051 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
Product
Modal Window
Fixed in
5.2.2
What to do
Update Modal Window to 5.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 10, 202210Web Social Photo Feed: Was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin pageCVE-2021-25047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users
Product
10Web Social Photo Feed
Fixed in
1.4.29
What to do
Update 10Web Social Photo Feed to 1.4.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Booking Calendar: Does not sanitise and escape the booking_type parameter before outputting it back in an admin pageCVE-2021-25040 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Booking Calendar
Fixed in
8.9.2
What to do
Update Booking Calendar to 8.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022PowerPack Addons for Elementor: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-25027 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
PowerPack Addons for Elementor
Fixed in
2.6.2
What to do
Update PowerPack Addons for Elementor to 2.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.