Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
702 results · page 13 of 15
Aug 29, 2022Stop Spam Comments: Does not properly generate the Javascript access token for preventing abuse of comment sectionCVE-2022-1663 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
- Product
- Stop Spam Comments
- Affected
- up to 0.2.1.2
- What to do
- Affects up to 0.2.1.2. Update Stop Spam Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2022Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.CVE-2022-35242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 28, 2022WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnCVE-2016-0796 · WordPress plugins & themes · reported by Red HatHigh 7.5
WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacker may leverage these issues to hide attacks directed at a target site from behind vulnerable website or to perform otherwise restricted actions and subsequently download files with the extension mp3, mp4a, wav and ogg from anywhere the web server application has read access to the system. WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files version 1.7.6 is vulnerable; prior versions may also be affected.
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comacunetix.com
Jun 27, 2022The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to maliCVE-2022-1028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- WordPress Security Firewall, Malware Scanner, Secure Login and Backup
- Fixed in
- 4.2.1
- What to do
- Update WordPress Security Firewall, Malware Scanner, Secure Login and Backup to 4.2.1 or newer.
Jun 13, 2022HC Custom WP-Admin URL: Leaks the secret login URLCVE-2022-1595 · WordPress plugins & themes · reported by WPScanMedium 5.3
The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
- Product
- HC Custom WP-Admin URL
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HC Custom WP-Admin URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 20, 2022Spiffy Plugins Spiffy Calendar <= 4.9.0 at: Insecure Direct Object References (IDOR)CVE-2022-29434 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.
- Product
- Spiffy Plugins Spiffy Calendar <= 4.9.0 at
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update Spiffy Plugins Spiffy Calendar <= 4.9.0 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 16, 2022ULeak Security & Monitoring: Does not have authorisation and CSRF checksCVE-2022-1557 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings
- Product
- ULeak Security & Monitoring
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update ULeak Security & Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022BulletProof Security: Does not sanitize and escape some of its CAPTCHA settingsCVE-2022-1265 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- BulletProof Security
- Fixed in
- 6.1
- What to do
- Update BulletProof Security to 6.1 or newer.
May 2, 2022All In One WP Security & Firewall: Does not validateCVE-2021-25102 · WordPress plugins & themes · reported by WPScanMedium 4.7
The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk
- Product
- All In One WP Security & Firewall
- Fixed in
- 4.4.11
- What to do
- Update All In One WP Security & Firewall to 4.4.11 or newer.
Apr 25, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the QUERY_STRING before outputting it back in an admin pageCVE-2022-0953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
- Product
- Anti-Malware Security and Brute-Force Firewall
- Fixed in
- 4.20.96
- What to do
- Update Anti-Malware Security and Brute-Force Firewall to 4.20.96 or newer.
Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0993 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
- Product
- SiteGround Security
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0992 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
- Product
- SiteGround Security
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 18, 2022Page Security & Membership: Does not sanitise and escape some of its settingsCVE-2022-1088 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Page Security & Membership
- Affected
- up to 1.5.15
- What to do
- Affects up to 1.5.15. Update Page Security & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2022Podcast Importer SecondLine: Does not sanitise and properly escape some imported dataCVE-2022-1023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
- Product
- Podcast Importer SecondLine
- Fixed in
- 1.3.8
- What to do
- Update Podcast Importer SecondLine to 1.3.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022BulletProof Security: Does not sanitise and escape some of its settingsCVE-2022-0590 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- BulletProof Security
- Fixed in
- 5.8
- What to do
- Update BulletProof Security to 5.8 or newer.
Mar 7, 2022WP Cerber Security, Anti-spam & Malware Scan: Does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboardCVE-2022-0429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 8.9.6
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 8.9.6 or newer.
Feb 28, 2022StatCounter: Does not sanitise and escape the Project ID and Secure Code settingsCVE-2021-24920 · WordPress plugins & themes · reported by WPScanMedium 4.8
The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- StatCounter
- Fixed in
- 2.0.7
- What to do
- Update StatCounter to 2.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Security Audit: Does not sanitise and escape the Data Id settingCVE-2021-24901 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Security Audit
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Security Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Shield Security: Does not sanitise and escape admin notesCVE-2022-0211 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Shield Security
- Fixed in
- 13.0.6
- What to do
- Update Shield Security to 13.0.6 or newer.
Feb 21, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the POST data before outputting it back in attributes of an admin pageCVE-2021-25101 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
- Product
- Anti-Malware Security and Brute-Force Firewall
- Fixed in
- 4.20.94
- What to do
- Update Anti-Malware Security and Brute-Force Firewall to 4.20.94 or newer.
Jan 3, 2022WooCommerce PDF Invoices & Packing Slips: Does not escape the tab and section parameters before outputting it back in an attributeCVE-2021-24991 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard
- Product
- WooCommerce PDF Invoices & Packing Slips
- Fixed in
- 2.10.5
- What to do
- Update WooCommerce PDF Invoices & Packing Slips to 2.10.5 or newer.
Dec 6, 2021Secure Copy Content Protection and Content Locking: Does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SCVE-2021-24931 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.
- Product
- Secure Copy Content Protection and Content Locking
- Fixed in
- 2.8.2
- What to do
- Update Secure Copy Content Protection and Content Locking to 2.8.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Nov 23, 2021Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's emCVE-2021-24892 · WordPress plugins & themes · reported by WPScanHigh 8.8
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
- Fixed in
- 1.6.9
- What to do
- Update the plugin to 1.6.9 or newer.
Sep 27, 2021WordPress uListing: Authenticated Insecure Direct Object References (IDOR)CVE-2021-36874 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).
- Product
- WordPress uListing
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update WordPress uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 17, 2021BulletProof Security: Sensitive information disclosureCVE-2021-39327 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.
- Product
- BulletProof Security
- Affected
- up to 5.1
- What to do
- Affects up to 5.1. Update BulletProof Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Sep 13, 2021The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any securityCVE-2021-24493 · WordPress plugins & themes · reported by WPScanCritical 9.8
The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE
- Product
- Shopp
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Shopp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2021.18
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2021.18 or newer.
Aug 11, 2021Securimage-WP-Fixed: Reflected Cross-Site ScriptingCVE-2021-34640 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4.
- Product
- Securimage-WP-Fixed
- Affected
- up to 3.5.4
- What to do
- Affects up to 3.5.4. Update Securimage-WP-Fixed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 9, 2021Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that CVE-2021-24500 · WordPress plugins & themes · reported by WPScanHigh 8.1
Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site.
- Product
- Workreap
- Fixed in
- 2.2.2
- What to do
- Update Workreap to 2.2.2 or newer.
Aug 2, 2021get_reports() function in the Secure Copy Content Protection and Content Locking: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24484 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_reports() function in the Secure Copy Content Protection and Content Locking
- Fixed in
- 2.6.7
- What to do
- Update get_reports() function in the Secure Copy Content Protection and Content Locking to 2.6.7 or newer.
Jul 19, 2021W3 Total Cache: Was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboardCVE-2021-24436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
- Product
- W3 Total Cache
- Fixed in
- 2.1.4
- What to do
- Update W3 Total Cache to 2.1.4 or newer.
Jul 7, 2021Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter inCVE-2020-24149 · WordPress plugins & themes · reported by MITREHigh 7.5
Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.
- Product
- Podcast Importer SecondLine (podcast-importer-secondline)
- Affected
- 1.1.4 to 1.1.4
- What to do
- Affects 1.1.4 to 1.1.4. Update Podcast Importer SecondLine (podcast-importer-secondline) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript blockCVE-2021-24373 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
- Product
- WP Hardening – Fix Your WordPress Security
- Fixed in
- 1.2.2
- What to do
- Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attributeCVE-2021-24372 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the $_SERVER['REQUEST_URI'] before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue.
- Product
- WP Hardening – Fix Your WordPress Security
- Fixed in
- 1.2.2
- What to do
- Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameterCVE-2021-24339 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameterCVE-2021-24338 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 1, 2021WP Login Security and History: Did not have CSRF checkCVE-2021-24328 · WordPress plugins & themes · reported by WPScanMedium 6.2
The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well
- Product
- WP Login Security and History
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Login Security and History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 12, 2021The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in pCVE-2021-24224 · WordPress plugins & themes · reported by WPScanHigh 8.8
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
- Product
- Easy Form Builder
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 10, 2021Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-secuCVE-2020-29171 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) plugin before 4.4.6 for WordPress.
- Fixed in
- 4.4.6
- What to do
- Update the plugin to 4.4.6 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Jan 6, 2021The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until tCVE-2020-36176 · WordPress plugins & themes · reported by MITREHigh 7.5
The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.
- Product
- iThemes Security (formerly Better WP Security)
- Fixed in
- 7.7.0
- What to do
- Update iThemes Security (formerly Better WP Security) to 7.7.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Dec 31, 2020Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers)CVE-2020-35932 · WordPress plugins & themes · reported by MITREHigh 7.5
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.
- Product
- Insecure Deserialization in the Newsletter
- Fixed in
- 6.8.2
- What to do
- Update Insecure Deserialization in the Newsletter to 6.8.2 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 13, 2020vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control.CVE-2020-35235 · WordPress plugins & themes · reported by MITREHigh 8.8
vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- vendor/elfinder/php/connector.minimal.php in the secure-file-manager
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update vendor/elfinder/php/connector.minimal.php in the secure-file-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
May 26, 2020The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=foCVE-2020-13487 · WordPress plugins & themes · reported by MITREMedium 4.8
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
- Product
- bbPress
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbbpress.orgcodex.bbpress.org
Apr 30, 2020In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file.CVE-2020-11026 · WordPress plugins & themes · reported by GitHubHigh 8.7
In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comlists.debian.org
Apr 30, 2020the navigation section of Customizer: In affected versions of WordPress, a cross-site scripting (XSS)CVE-2020-11025 · WordPress plugins & themes · reported by GitHubMedium 5.8
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
- Product
- the navigation section of Customizer
- What to do
- Update the navigation section of Customizer to the newest version.
Full record and what to do →NVD recordgithub.comwordpress.org
Feb 18, 2020WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass VulnerabilitiesCVE-2013-4454 · WordPress plugins & themes · reported by Red HatCritical 9.1
WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities
- Affected
- 1.4.1 to 1.4.1
- What to do
- Affects 1.4.1 to 1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comopenwall.com
Feb 14, 2020The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninjCVE-2020-8594 · WordPress plugins & themes · reported by MITREMedium 5.4
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].
- Affected
- 3.4.22 to 3.4.22
- What to do
- Affects 3.4.22 to 3.4.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordspider-security.co.ukwordpress.org
Feb 13, 2020Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow CVE-2013-1401 · WordPress plugins & themes · reported by MITRECritical 9.8
Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll.
- Product
- editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll
- Affected
- 34.05 to 34.05
- What to do
- Affects 34.05 to 34.05. Update editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Jan 13, 2020The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-adCVE-2019-20209 · WordPress plugins & themes · reported by MITREHigh 7.5
The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.
- Fixed in
- 2.3.4
- What to do
- Update the plugin to 2.3.4 or newer.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Jan 13, 2020Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remotCVE-2020-6859 · WordPress plugins & themes · reported by MITREMedium 5.3
Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.
- Product
- Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.