Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

38added in the last 30 days

589new WordPress flaws this week

398,319entries in the database

19,547 results · page 155 of 391

Dec 27, 2021WP RSS Aggregator: Does not sanitise and escape data before outputting it in the System Info admin dashboardCVE-2021-24988 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.
Product
WP RSS Aggregator
Fixed in
4.19.3
What to do
Update WP RSS Aggregator to 4.19.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021WPFront User Role Editor: Does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboardCVE-2021-24984 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
Product
WPFront User Role Editor
Fixed in
3.2.1.11184
What to do
Update WPFront User Role Editor to 3.2.1.11184 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Gwolle Guestbook: Does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attributeCVE-2021-24980 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page
Product
Gwolle Guestbook
Fixed in
4.2.0
What to do
Update Gwolle Guestbook to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Paid Memberships Pro: Does not escape the s parameter before outputting it back in an attribute in an admin pageCVE-2021-24979 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Paid Memberships Pro
Fixed in
2.6.6
What to do
Update Paid Memberships Pro to 2.6.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 27, 2021WordPress Download Manager: Does not sanitise and escape Template data before outputting it in various pages (suchCVE-2021-24969 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
Product
WordPress Download Manager
Fixed in
3.2.22
What to do
Update WordPress Download Manager to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Contact Form & Lead Form Elementor Builder: Does not sanitise and escape some lead valuesCVE-2021-24967 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
Product
Contact Form & Lead Form Elementor Builder
Fixed in
1.6.4
What to do
Update Contact Form & Lead Form Elementor Builder to 1.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Typebot | Build beautiful conversational forms: Does not sanitise and escape the Publish ID settingCVE-2021-24902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Typebot | Build beautiful conversational forms
Fixed in
1.4.3
What to do
Update Typebot | Build beautiful conversational forms to 1.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
Product
Tickera
Fixed in
3.4.8.3
What to do
Update Tickera to 3.4.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Rich Reviews by Starfish: Does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statementCVE-2021-24753 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
Product
Rich Reviews by Starfish
Fixed in
1.9.6
What to do
Update Rich Reviews by Starfish to 1.9.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 24, 2021In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.CVE-2021-45487 · Other software · Netbsd · reported by MITREHigh 7.5
In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.
Product
Netbsd
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ftp.netbsd.org arxiv.org
Dec 23, 2021NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users onCVE-2021-23175 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.2
NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information disclosure, data tampering, and denial of service, affecting other resources beyond the intended security authority of GameStream.
Product
NVIDIA GeForce Experience Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Dec 22, 2021Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.CVE-2021-44030 · Other software · Quest · reported by MITREMedium 6.1
Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.
Product
Kace Desktop Authority
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.quest.com support.quest.com
Dec 21, 2021Blog2Social: Social Media Auto Post & Scheduler: Does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin pageCVE-2021-24956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
Blog2Social: Social Media Auto Post & Scheduler
Fixed in
6.8.7
What to do
Update Blog2Social: Social Media Auto Post & Scheduler to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021Popups, Welcome Bar, Optins and Lead Generation: Does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attributeCVE-2021-24941 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue
Product
Popups, Welcome Bar, Optins and Lead Generation
Fixed in
2.0.5
What to do
Update Popups, Welcome Bar, Optins and Lead Generation to 2.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021Contact Form, Drag and Drop Form Builder for: Does not escape the status parameter before outputting it back in an attributeCVE-2021-24907 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
Contact Form, Drag and Drop Form Builder for
Fixed in
1.8.0
What to do
Update Contact Form, Drag and Drop Form Builder for to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not propeCVE-2021-24849 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
Product
WCFM Marketplace
Fixed in
3.4.12
What to do
Update WCFM Marketplace to 3.4.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021WP Visitor Statistics (Real Time Traffic): Does not properly sanitise and escape the refUrl in the refDetails AJAX actionCVE-2021-24750 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
4.8
What to do
Update WP Visitor Statistics (Real Time Traffic) to 4.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Dec 21, 2021Logo Carousel: Does not validate and escape the "Logo Margin" carousel optionCVE-2021-24738 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
Logo Carousel
Fixed in
3.4.2
What to do
Update Logo Carousel to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021SportsPress: Does not sanitise and escape its match_day parameter before outputting back in the Events backend pageCVE-2021-24578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue
Product
SportsPress
Fixed in
2.7.9
What to do
Update SportsPress to 2.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 17, 2021TCMAN GIM does not perform an authorization check when trying to access determined resources.CVE-2021-40853 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 7.2
TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL that require privileges without having them. The exploitation of this vulnerability might allow a remote attacker to obtain sensible information.
Product
GIM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Dec 15, 2021Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.CVE-2021-41844 · Other software · Crocoblock · reported by MITRECritical 9.8
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.
Product
Jetengine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record crocoblock.com crocoblock.com
Dec 14, 2021SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead tCVE-2021-44233 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges.
Product
SAP GRC Access Control
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 14, 2021SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-SitCVE-2021-42061 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.
Product
SAP BusinessObjects Business Intelligence Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Dec 13, 2021The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data.CVE-2020-16155 · Other software · Cpan\ · reported by MITREMedium 6.5
The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data.
Product
\
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.hackeriet.no metacpan.org
Dec 13, 2021Pixel Cat: Does not escape some of its settingsCVE-2021-24972 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Pixel Cat
Fixed in
2.6.3
What to do
Update Pixel Cat to 2.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021All-in-One Video Gallery: Does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboardCVE-2021-24970 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue
Product
All-in-One Video Gallery
Fixed in
2.5.0
What to do
Update All-in-One Video Gallery to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021LearnPress: Does not sanitiseCVE-2021-24951 · WordPress plugins & themes · reported by WPScanCritical 9.8
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues
Product
LearnPress
Fixed in
4.1.4
What to do
Update LearnPress to 4.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX actionCVE-2021-24946 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
Product
Modern Events Calendar Lite
Fixed in
6.1.5
What to do
Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Dec 13, 2021Like Button Rating ♥ LikeBtn: Does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX actionCVE-2021-24945 · WordPress plugins & themes · reported by WPScanHigh 8
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.
Product
Like Button Rating ♥ LikeBtn
Fixed in
2.6.38
What to do
Update Like Button Rating ♥ LikeBtn to 2.6.38 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Auto Featured Image (Auto Post Thumbnail): Does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS blockCVE-2021-24932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue.
Product
Auto Featured Image (Auto Post Thumbnail)
Fixed in
3.9.3
What to do
Update Auto Featured Image (Auto Post Thumbnail) to 3.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
Modern Events Calendar Lite
Fixed in
6.1.5
What to do
Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Pixel Cat: Does not have CSRF checkCVE-2021-24922 · WordPress plugins & themes · reported by WPScanCritical 9
The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks
Product
Pixel Cat
Fixed in
2.6.2
What to do
Update Pixel Cat to 2.6.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Caldera Forms: Does not sanitise and escape the Form Name before outputting it in attributesCVE-2021-24896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Caldera Forms
Fixed in
1.9.5
What to do
Update Caldera Forms to 1.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Get Custom Field Values: Does not escape custom fields before outputting them in the pageCVE-2021-24871 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
Get Custom Field Values
Fixed in
4.0.1
What to do
Update Get Custom Field Values to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots: Does not sanitise and escape the User Agent before using it in a SQL statement to save itCVE-2021-24863 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before 6.67 does not sanitise and escape the User Agent before using it in a SQL statement to save it, leading to a SQL injection
Product
WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots
Fixed in
6.67
What to do
Update WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots to 6.67 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Quotes Collection: Does not validate and escape the bulkcheck parameter before using it in a SQL statementCVE-2021-24861 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement, leading to a SQL injection
Product
Quotes Collection
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Quotes Collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categorCVE-2021-24848 · WordPress plugins & themes · reported by WPScanHigh 8.8
The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection
Product
Mediamatic
Fixed in
2.8.1
What to do
Update Mediamatic to 2.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Temporary Login Without Password: Does not have authorisation and CSRF checksCVE-2021-24836 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
Product
Temporary Login Without Password
Fixed in
1.7.1
What to do
Update Temporary Login Without Password to 1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Page/Post Content Shortcode: Does not have proper authorisation in placeCVE-2021-24819 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors.
Product
Page/Post Content Shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update Page/Post Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021WP Limits: Does not have CSRF checkCVE-2021-24818 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values
Product
WP Limits
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Limits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Ultimate NoFollow: Does not sanitise and escape the href attribute of its shortcodesCVE-2021-24817 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
Ultimate NoFollow
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Ultimate NoFollow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Shiny Buttons: Does not have any authorisation and CSRF in placeCVE-2021-24792 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.
Product
Shiny Buttons
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Shiny Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Contact Form Advanced Database: Does not have any authorisationCVE-2021-24790 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.
Product
Contact Form Advanced Database
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Contact Form Advanced Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021WP Admin Logo Changer: Does not have CSRF checkCVE-2021-24784 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack.
Product
WP Admin Logo Changer
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Admin Logo Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Flex Local Fonts: Does not escape the Class Name fieldCVE-2021-24782 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Flex Local Fonts
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Flex Local Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Single Post Exporter: Does not have CSRF checksCVE-2021-24780 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page (such as private and password protected) via a direct URL
Product
Single Post Exporter
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Single Post Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Inspirational Quote Rotator: Does not sanitize and escape some of its quote fieldsCVE-2021-24771 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when the unfiltered_html capability is disallowed
Product
Inspirational Quote Rotator
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Inspirational Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021WP System Log: Does not sanitiseCVE-2021-24756 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs.
Product
WP System Log
Fixed in
1.0.21
What to do
Update WP System Log to 1.0.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.