Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
699 results · page 13 of 14
Mar 23, 2023MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6: Auth. (admin+) Stored Cross-site Scripting (XSS)CVE-2023-28422 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.
- Product
- MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6
- Fixed in
- 3.8.7
- What to do
- Update MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6 to 3.8.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023Widgets for WooCommerce Products on Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4661 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Widgets for WooCommerce Products on Elementor
- Fixed in
- 1.0.8
- What to do
- Update Widgets for WooCommerce Products on Elementor to 1.0.8 or newer.
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions.CVE-2022-47440 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions.
- Affected
- up to 1.9.10
- What to do
- Affects up to 1.9.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 21, 2023Video Sidebar Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4785 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video Sidebar Widgets
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Video Sidebar Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023JetWidgets For Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0034 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- JetWidgets For Elementor
- Fixed in
- 1.0.14
- What to do
- Update JetWidgets For Elementor to 1.0.14 or newer.
Feb 13, 2023Widgets on Pages: Does not validate and escape its shortcode attributes before outputting them back in the pageCVE-2022-4488 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Widgets on Pages
- Fixed in
- 1.8.0
- What to do
- Update Widgets on Pages to 1.8.0 or newer.
Feb 6, 2023Event Manager and Tickets Selling Plugin for WooCommerce: Does not validate and escape some of its post meta before outputting them back in a page/postCVE-2023-0144 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Event Manager and Tickets Selling Plugin for WooCommerce
- Fixed in
- 3.8.0
- What to do
- Update Event Manager and Tickets Selling Plugin for WooCommerce to 3.8.0 or newer.
Feb 6, 2023WP Blog and Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4824 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Blog and Widgets
- Fixed in
- 2.3.1
- What to do
- Update WP Blog and Widgets to 2.3.1 or newer.
Jan 30, 2023Widgets for Google Reviews: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4470 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Widgets for Google Reviews
- Fixed in
- 9.8
- What to do
- Update Widgets for Google Reviews to 9.8 or newer.
Jan 16, 2023Sidebar Widgets by CodeLights: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4460 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- Sidebar Widgets by CodeLights
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 5, 2023JetWidgets for Elementor: Cross-Site Request ForgeryCVE-2023-0086 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be used to enable SVG uploads that could make Cross-Site Scripting possible.
- Product
- JetWidgets for Elementor
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update JetWidgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4357 · WordPress plugins & themes · reported by WPScanCritical 9.8
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4356 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4355 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Cryptocurrency Widgets Pack: Does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4059 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Cryptocurrency Widgets Pack
- Fixed in
- 2.0
- What to do
- Update Cryptocurrency Widgets Pack to 2.0 or newer.
Dec 20, 2022Sidebar Widgets by CodeLights: Stored Cross-Site ScriptingCVE-2022-4619 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Sidebar Widgets by CodeLights
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 28, 2022Awesome Support: Does not ensure that the exported tickets archive to be downloaded belongs to the user making the requestCVE-2022-3511 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
- Product
- Awesome Support
- Fixed in
- 6.1.2
- What to do
- Update Awesome Support to 6.1.2 or newer.
Sep 26, 2022Simple Bitcoin Faucets: Does not have any authorisation and CSRF in an AJAX actionCVE-2022-3024 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- Simple Bitcoin Faucets
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Simple Bitcoin Faucets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 15, 2022VR Calendar: Lets any user execute arbitrary PHP functions on the siteCVE-2022-2314 · WordPress plugins & themes · reported by WPScanCritical 9.8
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.
- Product
- VR Calendar
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update VR Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022CAPTCHA 4WP: Lets user input reach a sensitive require_once call in one of its admin-side templatesCVE-2022-2184 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.
- Product
- CAPTCHA 4WP
- Fixed in
- 7.1.0
- What to do
- Update CAPTCHA 4WP to 7.1.0 or newer.
Jun 13, 2022Latest Tweets Widget: Does not have CSRF check in placeCVE-2022-1624 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Latest Tweets Widget
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Latest Tweets Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 18, 2022Code Snippets plugin <= 2.14.3 at: Reflected Cross-Site Scripting (XSS)CVE-2022-25617 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter.
- Product
- Code Snippets plugin <= 2.14.3 at
- Affected
- up to 2.14.3
- What to do
- Affects up to 2.14.3. Update Code Snippets plugin <= 2.14.3 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 17, 2022Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on: Persistent Cross-Site Scripting (XSS)CVE-2022-29436 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery (vulnerable parameters &title, &snippet_code).
- Product
- Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 17, 2022Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on: Cross-Site Request Forgery (CSRF)CVE-2022-29435 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress allows an attacker to delete or to turn on/off snippets.
- Product
- Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 17, 2022Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.CVE-2022-29429 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 21, 2022Advanced Booking Calendar: Does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated useCVE-2022-0694 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.0
- What to do
- Update Advanced Booking Calendar to 1.7.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Event Manager and Tickets Selling for WooCommerce: Does not validate and escape the post_author_gutenberg parameter before using it in a SQL statementCVE-2022-0478 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacks
- Product
- Event Manager and Tickets Selling for WooCommerce
- Fixed in
- 3.5.8
- What to do
- Update Event Manager and Tickets Selling for WooCommerce to 3.5.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Post Snippets: Does not have CSRF checkCVE-2021-25010 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues
- Product
- Post Snippets
- Fixed in
- 3.1.4
- What to do
- Update Post Snippets to 3.1.4 or newer.
Feb 28, 2022Dynamic Widgets: Does not escape the prefix parameter before outputting it back in an attributeCVE-2021-24933 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting issue
- Product
- Dynamic Widgets
- Affected
- up to 1.5.16
- What to do
- Affects up to 1.5.16. Update Dynamic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts.CVE-2022-24665 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to editCVE-2022-24664 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated userCVE-2022-24663 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated user.
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Feb 7, 2022SupportCandy: Does not have CSRF check in the wpsc_tickets AJAX actionCVE-2021-24879 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.
- Product
- SupportCandy
- Fixed in
- 2.2.7
- What to do
- Update SupportCandy to 2.2.7 or newer.
Feb 7, 2022SupportCandy: Does not have CRSF check in its wpsc_tickets AJAX actionCVE-2021-24843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.
- Product
- SupportCandy
- Fixed in
- 2.2.7
- What to do
- Update SupportCandy to 2.2.7 or newer.
Feb 7, 2022SupportCandy: Does not have authorisation and CSRF checks in its wpsc_tickets AJAX actionCVE-2021-24839 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
- Product
- SupportCandy
- Fixed in
- 2.2.5
- What to do
- Update SupportCandy to 2.2.5 or newer.
Jan 24, 2022Event Tickets: Does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given valueCVE-2021-25028 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
- Product
- Event Tickets
- Fixed in
- 5.2.2
- What to do
- Update Event Tickets to 5.2.2 or newer.
Jan 24, 2022Code Snippets: Does not escape the snippets-safe-mode parameter before outputting it back in attributesCVE-2021-25008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Code Snippets WordPress plugin before 2.14.3 does not escape the snippets-safe-mode parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issue
- Product
- Code Snippets
- Fixed in
- 2.14.3
- What to do
- Update Code Snippets to 2.14.3 or newer.
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-SiCVE-2021-42549 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
- Product
- search functionality of
- Fixed in
- 1.15.3
- What to do
- Update search functionality of to 1.15.3 or newer.
Full record and what to do →NVD recordwpcloudplugins.comwpcloudplugins.com
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
- Product
- My Tickets
- Fixed in
- 1.8.31
- What to do
- Update My Tickets to 1.8.31 or newer.
Oct 18, 2021Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users,CVE-2021-24752 · WordPress plugins & themes · reported by WPScanMedium 5.7
Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.
- Product
- ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets
- Fixed in
- 1.9
- What to do
- Update ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets to 1.9 or newer.
Sep 10, 2021WP Scrippets: Reflected Cross-Site ScriptingCVE-2021-38333 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp-scrippets.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.1.
- Product
- WP Scrippets
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update WP Scrippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 12, 2021Sign-up Sheets: Does not not sanitise or validate the Sheet titleCVE-2021-24441 · WordPress plugins & themes · reported by WPScanHigh 8
The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue
- Product
- Sign-up Sheets
- Fixed in
- 1.0.14
- What to do
- Update Sign-up Sheets to 1.0.14 or newer.
Jul 12, 2021Sign-up Sheets: Did not sanitise or escape some of its fieldsCVE-2021-24440 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in the admin dashboard
- Product
- Sign-up Sheets
- Fixed in
- 1.0.14
- What to do
- Update Sign-up Sheets to 1.0.14 or newer.
Jul 7, 2021Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outsiCVE-2020-24144 · WordPress plugins & themes · reported by MITREHigh 8.6
Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items[] parameter in a move operation.
- Product
- Media File Organizer (aka media-file-organizer)
- Affected
- 1.0.1 to 1.0.1
- What to do
- Affects 1.0.1 to 1.0.1. Update Media File Organizer (aka media-file-organizer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comru.wordpress.org
Jul 7, 2021Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outCVE-2020-24143 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter.
- Product
- Video Downloader for TikTok (aka downloader-tiktok)
- Affected
- 1.3 to 1.3
- What to do
- Affects 1.3 to 1.3. Update Video Downloader for TikTok (aka downloader-tiktok) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2021Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the CVE-2020-24142 · WordPress plugins & themes · reported by MITRECritical 9.8
Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services
- Product
- Video Downloader for TikTok (aka downloader-tiktok)
- Affected
- 1.3 to 1.3
- What to do
- Affects 1.3 to 1.3. Update Video Downloader for TikTok (aka downloader-tiktok) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2021Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerablCVE-2020-24141 · WordPress plugins & themes · reported by MITREMedium 5.3
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
- Product
- WP-DownloadManager
- Affected
- 1.68.4 to 1.68.4
- What to do
- Affects 1.68.4 to 1.68.4. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2021A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extCVE-2021-34627 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
- Product
- WP Upload Restriction
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
May 17, 2021Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor: Have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.
- Product
- Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor
- Fixed in
- 2.24.0
- What to do
- Update Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor to 2.24.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021Clever Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- Clever Addons for Elementor
- Fixed in
- 2.1.0
- What to do
- Update Clever Addons for Elementor to 2.1.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.