Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
819 results · page 16 of 17
Apr 12, 2023An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated usCVE-2023-28121 · WordPress plugins & themes · reported by support@hackerone.comCritical 9.8
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddeveloper.woocommerce.comrcesecurity.com
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.CVE-2022-47145 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.
- Fixed in
- 3.5.8
- What to do
- Update the plugin to 3.5.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.CVE-2022-45068 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.
- Fixed in
- 6.4.0
- What to do
- Update the plugin to 6.4.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.CVE-2023-23865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.
- Fixed in
- 1.4.11
- What to do
- Update the plugin to 1.4.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 27, 2023Donation Block For PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0535 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Donation Block For PayPal
- Fixed in
- 2.1.0
- What to do
- Update Donation Block For PayPal to 2.1.0 or newer.
Feb 13, 2023Easy Accept Payments for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0275 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Accept Payments for PayPal
- Fixed in
- 4.9.10
- What to do
- Update Easy Accept Payments for PayPal to 4.9.10 or newer.
Feb 13, 2023Easy PayPal Buy Now Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4628 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Easy PayPal Buy Now Button
- Fixed in
- 1.7.4
- What to do
- Update Easy PayPal Buy Now Button to 1.7.4 or newer.
Jan 16, 2023Conditional Payment Methods for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4547 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin.
- Product
- Conditional Payment Methods for WooCommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Conditional Payment Methods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Paytium: Mollie payment forms & donations: Does not sanitise and escape some of its settingsCVE-2022-4042 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paytium: Mollie payment forms & donations
- Fixed in
- 4.3.7
- What to do
- Update Paytium: Mollie payment forms & donations to 4.3.7 or newer.
Dec 19, 2022Checkout for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3983 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Checkout for PayPal
- Fixed in
- 1.0.14
- What to do
- Update Checkout for PayPal to 1.0.14 or newer.
Nov 28, 2022Donations via PayPal: Does not sanitise and escape some of its settingsCVE-2022-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Donations via PayPal
- Fixed in
- 1.9.9
- What to do
- Update Donations via PayPal to 1.9.9 or newer.
Sep 5, 2022Simple Payment Donations & Subscriptions: Does not sanitise and escape user input given in its formsCVE-2022-2565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
- Product
- Simple Payment Donations & Subscriptions
- Fixed in
- 4.2.1
- What to do
- Update Simple Payment Donations & Subscriptions to 4.2.1 or newer.
Jul 22, 2022Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.CVE-2022-33901 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.
- Affected
- up to 4.13.1
- What to do
- Affects up to 4.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 17, 2022Accept Stripe Payments: Does not sanitize and escape some of its settingsCVE-2022-2194 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Accept Stripe Payments
- Fixed in
- 2.0.64
- What to do
- Update Accept Stripe Payments to 2.0.64 or newer.
Jul 17, 2022The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titlesCVE-2022-2099 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
- Product
- WooCommerce
- Fixed in
- 6.6.0
- What to do
- Update WooCommerce to 6.6.0 or newer.
May 2, 2022LifterLMS PayPal: Does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the pageCVE-2022-1250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue
- Product
- LifterLMS PayPal
- Fixed in
- 1.4.0
- What to do
- Update LifterLMS PayPal to 1.4.0 or newer.
Full record and what to do →NVD recordmake.lifterlms.comwpscan.com
Apr 19, 2022MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6: Cross-site request forgery (CSRF)CVE-2022-27629 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 allows a remote unauthenticated attacker to hijack the authentication of an administrator and perform unintended operation via unspecified vectors.
- Product
- MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6
- Fixed in
- 1.9.6
- What to do
- Update MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 to 1.9.6 or newer.
Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org
Mar 14, 2022The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leadingCVE-2021-24996 · WordPress plugins & themes · reported by WPScanMedium 6.1
The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting
- Product
- IDPay for Contact Form 7
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update IDPay for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloaCVE-2022-23988 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
- Fixed in
- 1.8.176
- What to do
- Update the plugin to 1.8.176 or newer.
Jan 24, 2022Accept Donations with PayPal: Does not have CSRF check in place and does not ensure that the post to be deleted belongs to the pluginCVE-2021-24989 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.4
- What to do
- Update Accept Donations with PayPal to 1.3.4 or newer.
Dec 14, 2021WooCommerce myghpay Payment Gateway WordPess: Reflected Cross-Site ScriptingCVE-2021-39308 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the ~/processresponse.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.0.
- Product
- WooCommerce myghpay Payment Gateway WordPess
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WooCommerce myghpay Payment Gateway WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 17, 2021Accept Donations with PayPal: Does not escape the Amount Menu Name field of created ButtonsCVE-2021-24815 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.2
- What to do
- Update Accept Donations with PayPal to 1.3.2 or newer.
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
- Product
- My Tickets
- Fixed in
- 1.8.31
- What to do
- Update My Tickets to 1.8.31 or newer.
Nov 8, 2021Support Board: Allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes fieldCVE-2021-24807 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
- Product
- Support Board
- Fixed in
- 3.3.5
- What to do
- Update Support Board to 3.3.5 or newer.
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpCVE-2021-24731 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
- Product
- Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
- Fixed in
- 3.7.1.6
- What to do
- Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.7.1.6 or newer.
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Has a flaw in the social login implementationCVE-2021-24647 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
- Product
- Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
- Fixed in
- 3.1.7.6
- What to do
- Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.1.7.6 or newer.
Nov 1, 2021Accept Donations with PayPal: Provides a function to create donation buttonsCVE-2021-24572 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.1
- What to do
- Update Accept Donations with PayPal to 1.3.1 or newer.
Nov 1, 2021Accept Donations with PayPal: Offers a function to create donation buttonsCVE-2021-24570 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.1
- What to do
- Update Accept Donations with PayPal to 1.3.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 21, 2021Leaky Paywall: Stored Cross-Site ScriptingCVE-2021-39357 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the ~/class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.16.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Leaky Paywall
- Affected
- up to 4.16.5
- What to do
- Affects up to 4.16.5. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 4, 2021Bitcoin / AltCoin Payment Gateway for WooCommerce: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
- Product
- Bitcoin / AltCoin Payment Gateway for WooCommerce
- Fixed in
- 1.6.1
- What to do
- Update Bitcoin / AltCoin Payment Gateway for WooCommerce to 1.6.1 or newer.
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
- Product
- WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2021WooCommerce Payment Gateway Per Category: Reflected Cross-Site ScriptingCVE-2021-38341 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10.
- Product
- WooCommerce Payment Gateway Per Category
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update WooCommerce Payment Gateway Per Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2021A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before insCVE-2021-24390 · WordPress plugins & themes · reported by WPScanHigh 7.2
A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.
- Product
- WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 23, 2021Paytm – Donation: Does not sanitiseCVE-2021-24554 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue
- Product
- Paytm – Donation
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Paytm – Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 2, 2021Bookshelf: Does not sanitise or escape its "Paypal email address" setting before outputting it in the pageCVE-2021-24478 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Bookshelf
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Bookshelf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2021In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fieCVE-2021-24369 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the GetPaid WordPress plugin before 2.3.4, users with the contributor role and above can create a new Payment Form, however the Label and Help Text input fields were not getting sanitized properly. So it was possible to inject malicious content such as img tags, leading to a Stored Cross-Site Scripting issue which is triggered when the form will be edited, for example when an admin reviews it and could lead to privilege escalation.
- Product
- GetPaid
- Fixed in
- 2.3.4
- What to do
- Update GetPaid to 2.3.4 or newer.
Apr 22, 2021Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments: Does not sanitise the invitaion_code GET parameterCVE-2021-24239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
- Product
- Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments
- Fixed in
- 3.7.0.1
- What to do
- Update Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments to 3.7.0.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 7, 2020The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wCVE-2020-26876 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).
- Product
- wp-courses
- Affected
- up to 2.0.27
- What to do
- Affects up to 2.0.27. Update wp-courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2020The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.CVE-2020-14092 · WordPress plugins & themes · reported by MITRECritical 9.8
The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.
- Product
- CodePeople Payment Form for PayPal Pro
- Fixed in
- 1.1.65
- What to do
- Update CodePeople Payment Form for PayPal Pro to 1.1.65 or newer.
Full record and what to do →NVD recordwordpress.dwbooster.comwordpress.org
Apr 30, 2020In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor.CVE-2020-11030 · WordPress plugins & themes · reported by GitHubMedium 6.4
In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comwordpress.org
Feb 24, 2020An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce.CVE-2020-8819 · WordPress plugins & themes · reported by MITREHigh 8.1
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
- Affected
- up to 3.1.15
- What to do
- Affects up to 3.1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 2, 2020The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.CVE-2019-20204 · WordPress plugins & themes · reported by MITREMedium 5.4
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
- Affected
- up to 1.9.40
- What to do
- Affects up to 1.9.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 26, 2019WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the CVE-2019-16780 · WordPress plugins & themes · reported by GitHubMedium 5.8
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.
- What to do
- Update the plugin to the newest version.
Oct 23, 2019The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.xCVE-2015-9525 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.CVE-2016-11010 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
- Product
- wp-invoice
- Fixed in
- 4.1.1
- What to do
- Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.CVE-2016-11009 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
- Product
- wp-invoice
- Fixed in
- 4.1.1
- What to do
- Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 20, 2019The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.CVE-2016-11008 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
- Product
- wp-invoice
- Fixed in
- 4.1.1
- What to do
- Update wp-invoice to 4.1.1 or newer.
Full record and what to do →NVD recordpritect.networdpress.org
Sep 12, 2019WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier: Cross-site request forgery (CSRF)CVE-2019-5992 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- Product
- WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2019cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such CVE-2019-14979 · WordPress plugins & themes · reported by MITREMedium 5.3
cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.17 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state
- Product
- WooCommerce PayPal Checkout Payment Gateway
- Affected
- 1.6.17 to 1.6.17
- What to do
- Affects 1.6.17 to 1.6.17. Update WooCommerce PayPal Checkout Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgkaim.comwordpress.org
Aug 29, 2019/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as dCVE-2019-14978 · WordPress plugins & themes · reported by MITREMedium 5.3
/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price.
- Product
- WooCommerce PayU India Payment Gateway
- Affected
- 2.1.1 to 2.1.1
- What to do
- Affects 2.1.1 to 2.1.1. Update WooCommerce PayU India Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.