Updated 55 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

984 results · page 14 of 20

Oct 21, 2021LearnPress: Stored Cross-Site ScriptingCVE-2021-39348 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Please note that this is seperate from CVE-2021-24702.
Product
LearnPress
Affected
up to 4.1.3.1
What to do
Affects up to 4.1.3.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 18, 2021PDF Flipbook, 3D Flipbook WordPress – DearFlip: Does not escape the class attribute of its shortcode before outputting it back in an attributeCVE-2021-24732 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
PDF Flipbook, 3D Flipbook WordPress – DearFlip
Fixed in
1.7.10
What to do
Update PDF Flipbook, 3D Flipbook WordPress – DearFlip to 1.7.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
Product
LearnPress
Fixed in
4.1.3.1
What to do
Update LearnPress to 4.1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 10, 2021Advance Search: Reflected Cross-Site ScriptingCVE-2021-38348 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.2.
Product
Advance Search
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Advance Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2021LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for: Was affected by an IDOR issueCVE-2021-24562 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades
Product
LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for
Fixed in
4.21.2
What to do
Update LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for to 4.21.2 or newer.
Full record and what to do →NVD record make.lifterlms.com wpscan.com
Aug 2, 2021slider import search feature and tab parameter of the Post Grid: Settings are not properly sanitised before being output back in the pagesCVE-2021-24488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues
Product
slider import search feature and tab parameter of the Post Grid
Fixed in
2.1.8
What to do
Update slider import search feature and tab parameter of the Post Grid to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.9.2
What to do
Update Tutor LMS – eLearning and online course solution to 1.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2021The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher CVE-2020-11511 · WordPress plugins & themes · reported by MITREHigh 8.1
The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.
Product
LearnPress
Fixed in
3.2.6.9
What to do
Update LearnPress to 3.2.6.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com cwe.mitre.org
Jul 12, 2021WP JobSearch: Did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the pageCVE-2021-24421 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue
Product
WP JobSearch
Fixed in
1.7.4
What to do
Update WP JobSearch to 1.7.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jul 7, 2021WPCS - WordPress Currency Switcher 1.1.6 and earlier: Cross-site request forgery (CSRF)CVE-2021-20780 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WPCS - WordPress Currency Switcher 1.1.6 and earlier
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update WPCS - WordPress Currency Switcher 1.1.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp pluginus.net
Jul 6, 2021Jannah: Did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX actionCVE-2021-24407 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability.
Product
Jannah
Fixed in
5.4.5
What to do
Update Jannah to 5.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 6, 2021WP Pro Real Estate 7: Did not properly sanitise the ct_community parameter in its search listing page before outputting it back in itCVE-2021-24387 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Pro Real Estate 7 WordPress theme before 3.1.1 did not properly sanitise the ct_community parameter in its search listing page before outputting it back in it, leading to a reflected Cross-Site Scripting which can be triggered in both unauthenticated or authenticated user context
Product
WP Pro Real Estate 7
Fixed in
3.1.1
What to do
Update WP Pro Real Estate 7 to 3.1.1 or newer.
Full record and what to do →NVD record contempothemes.com wpscan.com
Jun 27, 2021WordPress Popular Posts 5.3.2 and earlier: Cross-site scriptingCVE-2021-20746 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Product
WordPress Popular Posts 5.3.2 and earlier
Affected
up to 5.3.2
What to do
Affects up to 5.3.2. Update WordPress Popular Posts 5.3.2 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cabrerahector.com cabrerahector.com
Jun 14, 2021Stock in & out: Has a search functionalityCVE-2021-24346 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. The srch POST parameter is not validated, sanitised or escaped before using it in the echo statement, leading to a reflected XSS issue
Product
Stock in & out
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Stock in & out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 14, 2021When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitisedCVE-2021-24341 · WordPress plugins & themes · reported by WPScanHigh 8.8
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
Product
Xllentech English Islamic Calendar
Fixed in
2.6.8
What to do
Update Xllentech English Islamic Calendar to 2.6.8 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 1, 2021Car Repair Services & Auto Mechanic: Did not properly sanitise its serviceestimatekey search parameter before outputting it back in the pageCVE-2021-24335 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
Product
Car Repair Services & Auto Mechanic
Fixed in
4.0
What to do
Update Car Repair Services & Auto Mechanic to 4.0 or newer.
Full record and what to do →NVD record m0ze.ru themeforest.net
Jun 1, 2021Listeo: Did not properly sanitise some parameters in its SearchCVE-2021-24317 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Listeo WordPress theme before 1.6.11 did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues
Product
Listeo
Fixed in
1.6.11
What to do
Update Listeo to 1.6.11 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021search feature of the Mediumish: Does not properly sanitise it's 's' GET parameter before output it back the pageCVE-2021-24316 · WordPress plugins & themes · reported by WPScanMedium 6.1
The search feature of the Mediumish WordPress theme through 1.0.47 does not properly sanitise it's 's' GET parameter before output it back the page, leading to the Cross-SIte Scripting issue.
Product
search feature of the Mediumish
Affected
up to 1.0.47
What to do
Affects up to 1.0.47. Update search feature of the Mediumish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
Fixed in
4.21.1
What to do
Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
May 24, 2021slider import search feature of the PickPlugins Product Slider for WooCommerce: Did not properly sanitised the keyword GET parameterCVE-2021-24300 · WordPress plugins & themes · reported by WPScanMedium 6.1
The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue
Product
slider import search feature of the PickPlugins Product Slider for WooCommerce
Fixed in
1.13.22
What to do
Update slider import search feature of the PickPlugins Product Slider for WooCommerce to 1.13.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · WordPress plugins & themes · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.8.8
What to do
Update Tutor LMS – eLearning and online course solution to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 22, 2021The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius.CVE-2021-24237 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not properly sanitise the keyword_search, search_radius. _bedrooms and _bathrooms GET parameters before outputting them in its properties page, leading to an unauthenticated reflected Cross-Site Scripting issue.
Product
Realteo
Fixed in
1.2.4
What to do
Update Realteo to 1.2.4 or newer.
Full record and what to do →NVD record m0ze.ru m0ze.ru
Apr 22, 2021The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reCVE-2021-24234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.
Fixed in
4.6.1
What to do
Update the plugin to 4.6.1 or newer.
Full record and what to do →NVD record wpscan.com getastra.com
Apr 5, 2021tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24186 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24185 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Product
tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify coursCVE-2021-24184 · WordPress plugins & themes · reported by WPScanHigh 8.8
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24183 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24182 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to blind and time based SQL injections that could be exploited by studentsCVE-2021-24181 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Product
tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.7.7
What to do
Update tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Feb 5, 2021Name Directory 1.17.4 and earlier: Cross-site request forgery (CSRF)CVE-2021-20652 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Name Directory 1.17.4 and earlier
Affected
up to 1.17.4
What to do
Affects up to 1.17.4. Update Name Directory 1.17.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Jan 15, 2021Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows reCVE-2020-35749 · WordPress plugins & themes · reported by MITREHigh 7.7
Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php.
Product
Simple Board Job
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Simple Board Job to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jan 6, 2021The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conducCVE-2012-10001 · WordPress plugins & themes · reported by MITRECritical 9.8
The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts.
Product
Limit Login Attempts
Fixed in
1.7.1
What to do
Update Limit Login Attempts to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Nov 30, 2020The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.CVE-2020-29395 · WordPress plugins & themes · reported by MITREMedium 6.1
The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.
Product
EventON
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Oct 27, 2020search functionality of the Greenmart theme 2.4.2: XSSCVE-2020-16140 · WordPress plugins & themes · reported by MITREMedium 6.1
The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.
Product
search functionality of the Greenmart theme 2.4.2
Affected
2.4.2 to 2.4.2
What to do
Affects 2.4.2 to 2.4.2. Update search functionality of the Greenmart theme 2.4.2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com cybersecurityworks.com
Oct 21, 2020Simple Download Monitor 3.8.8 and earlier: SQL injectionCVE-2020-5651 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL.
Product
Simple Download Monitor 3.8.8 and earlier
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update Simple Download Monitor 3.8.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Oct 21, 2020Simple Download Monitor 3.8.8 and earlier: Cross-site scriptingCVE-2020-5650 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
Product
Simple Download Monitor 3.8.8 and earlier
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update Simple Download Monitor 3.8.8 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp wordpress.org
Oct 14, 2020Live Chat - Live support version 3.1.0 and earlier: Cross-site request forgery (CSRF)CVE-2020-5642 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Live Chat - Live support version 3.1.0 and earlier
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Live Chat - Live support version 3.1.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Sep 16, 2020A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions.CVE-2020-20406 · WordPress plugins & themes · reported by MITREMedium 5.4
A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2 and earlier versions. It is caused by inadequate filtering on the link custom attributes.
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 31, 2020Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.CVE-2020-20625 · WordPress plugins & themes · reported by MITREHigh 7.5
Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Aug 14, 2020A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary weCVE-2019-6112 · WordPress plugins & themes · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).
Product
Sell Media
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Sell Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com metamorfosec.com
Aug 12, 2020search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.CVE-2020-17362 · WordPress plugins & themes · reported by MITREMedium 6.1
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.
Product
search.php in the Nova Lite
Fixed in
1.3.9
What to do
Update search.php in the Nova Lite to 1.3.9 or newer.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.CVE-2020-15364 · WordPress plugins & themes · reported by MITREMedium 6.1
The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.
Product
Nexos
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.CVE-2020-15363 · WordPress plugins & themes · reported by MITRECritical 9.8
The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.
Product
Nexos
Affected
up to 1.7
What to do
Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jun 18, 2020A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order paCVE-2020-13640 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)
Product
gVectors wpDiscuz
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update gVectors wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record openwall.com plugins.trac.wordpress.org
May 5, 2020Import feature in the wp-advanced-search plugin 3.3.6: Authenticated SQL injectionCVE-2020-12104 · WordPress plugins & themes · reported by MITREHigh 8.8
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
Product
Import feature in the wp-advanced-search plugin 3.3.6
Fixed in
3.3.7
What to do
Update Import feature in the wp-advanced-search plugin 3.3.6 to 3.3.7 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Apr 30, 2020In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor.CVE-2020-11030 · WordPress plugins & themes · reported by GitHubMedium 6.4
In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com wordpress.org
Apr 30, 2020LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL InjectionCVE-2020-6010 · WordPress plugins & themes · reported by cve@checkpoint.comHigh 8.8
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
Affected
up to 3.2.6.7
What to do
Affects up to 3.2.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Apr 24, 2020The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request viaCVE-2020-12070 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.
Product
Advanced Woo Search
Affected
up to 1.99
What to do
Affects up to 1.99. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 23, 2020The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query).CVE-2020-12054 · WordPress plugins & themes · reported by MITREMedium 6.1
The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.
Product
Catch Breadcrumb
Fixed in
1.5.4
What to do
Update Catch Breadcrumb to 1.5.4 or newer.
Full record and what to do →NVD record cxsecurity.com wpvulndb.com
Apr 4, 2020The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula.CVE-2020-11548 · WordPress plugins & themes · reported by MITRECritical 9.8
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
Product
Search Meter
Affected
up to 2.13.2
What to do
Affects up to 2.13.2. Update Search Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org exploit-db.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.