Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

317new WordPress flaws this week

393,460entries in the database

10,174 results · page 177 of 204

Jun 6, 2023PWA for WP & AMP: Authorization bypassCVE-2021-4366 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_features_options function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to change the otherwise restricted settings within the plugin.
Product
PWA for WP & AMP
Affected
up to 1.7.32
What to do
Affects up to 1.7.32. Update PWA for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023Frontend File Manager: Unauthenticated Stored Cross-Site ScriptingCVE-2021-4365 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023JobSearch WP Job Board: Authorization bypassCVE-2021-4364 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedule_call() function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls.
Product
JobSearch WP Job Board
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023Kiwi Social Share: Authorization bypassCVE-2021-4362 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() function called via the kiwi_social_share_get_option AJAX action in version 2.1.0. This makes it possible for unauthenticated attackers to read and modify arbitrary options on a WordPress site that can be used for complete site takeover. This was a previously fixed vulnerability that was reintroduced in this version.
Product
Kiwi Social Share
Affected
2.1.0 to 2.1.0
What to do
Affects 2.1.0 to 2.1.0. Update Kiwi Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023JobSearch WP Job Board: Authorization bypassCVE-2021-4361 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on the site.
Product
JobSearch WP Job Board
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023Frontend File Manager: Unauthenticated Arbitrary Post DeletionCVE-2021-4359 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2. This is due to lacking authentication protections and lacking a security nonce on the wpfm_delete_file AJAX action. This makes it possible for unauthenticated attackers to delete any posts and pages on the site.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023uListing: Authorization bypassCVE-2021-4357 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::save_role_api function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to arbitrarily delete site posts and pages.
Product
uListing
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2.CVE-2021-4356 · WordPress plugins & themes · reported by WordfenceCritical 9
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to download arbitrary files on the site, potentially leading to site takeover.
Affected
up to 18.2
What to do
Affects up to 18.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Welcart e-Commerce: Authorization bypassCVE-2021-4355 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the download_orderdetail_list(), change_orderlist(), and download_member_list() functions called via admin_init hooks in versions up to, and including, 2.2.7. This makes it possible for unauthenticated attackers to download lists of members, products and orders.
Product
Welcart e-Commerce
Affected
up to 2.2.7
What to do
Affects up to 2.2.7. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023JobSearch WP Job Board: Authorization bypassCVE-2021-4352 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in versions up to, and including, 1.8.1. This makes it possible for unauthenticated attackers to change the settings of the plugin.
Product
JobSearch WP Job Board
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023Frontend File Manager: Unauthenticated Post Meta ChangeCVE-2021-4351 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to change the meta data of certain posts and pages.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Frontend File Manager: Unauthenticated HTML InjectionCVE-2021-4350 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfm_send_file_in_email AJAX action. This makes it possible for unauthenticated attackers to send emails using the site with a custom subject, recipient email, and body with unsanitized HTML content. This effectively lets the attacker use the site as a spam relay.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Ultimate GDPR & CCPA: Unauthenticated settings import and exportCVE-2021-4348 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks such as redirecting visitors to malicious sites.
Product
Ultimate GDPR & CCPA
Affected
up to 2.4
What to do
Affects up to 2.4. Update Ultimate GDPR & CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticCVE-2021-4347 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.
Affected
up to 3.2.6
What to do
Affects up to 3.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023uListing: Unauthenticated Arbitrary Account ChangesCVE-2021-4346 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing login checks on the stm_listing_profile_edit AJAX action. This makes it possible for unauthenticated attackers to edit any account on the blog, such as changing the admin account's email address.
Product
uListing
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023uListing: Authorization bypassCVE-2021-4345 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole::save_role_api method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to remove or add roles, and add capabilities.
Product
uListing
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Unauthenticated Account Creation: Unauthenticated Account CreationCVE-2021-4343 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is due to the stm_listing_register AJAX action function being accessible and taking roles unprotected. This makes it possible for unauthenticated attackers to create accounts, even those with administrator privileges.
Product
Unauthenticated Account Creation
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Unauthenticated Account Creation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023uListing: Authorization bypassCVE-2021-4341 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stm_update_email_data AJAX action in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database.
Product
uListing
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023uListing: Authorization bypassCVE-2021-4339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to retrieve the list of all users and their email address in the database.
Product
uListing
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023404 to 301: Authorization bypassCVE-2021-4338 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in versions up to, and including, 3.0.7. This makes it possible for authenticated attackers to view, create and edit redirections.
Product
404 to 301
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update 404 to 301 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Flexible Checkout Fields for WooCommerce: Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site ScriptingCVE-2020-36731 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.
Product
Flexible Checkout Fields for WooCommerce
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update Flexible Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023CMP: Authorization bypassCVE-2020-36730 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.
Product
CMP
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update CMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 20232J-SlideShow: Authorization bypassCVE-2020-36729 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' function called via the wp_ajax_twoj_slideshow_setup AJAX action in versions up to, and including, 1.3.31. This makes it possible for authenticated attackers (Subscriber, or above level access) to allow attackers to perform otherwise restricted actions and subsequently deactivate any plugins on the blog.
Product
2J-SlideShow
Affected
up to 1.3.31
What to do
Affects up to 1.3.31. Update 2J-SlideShow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Wordable: Authentication bypassCVE-2020-36724 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hash_hmac() function and the use of a loose comparison on the hash which allows an attacker to trick the function into thinking it has a valid hash. This makes it possible for unauthenticated attackers to gain administrator privileges.
Product
Wordable
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Wordable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Kali Forms: Authenticated Options ChangeCVE-2020-36720 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings.
Product
Kali Forms
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023WP Activity Log: Authorization bypassCVE-2020-36716 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.
Product
WP Activity Log
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Login/Signup Popup: Authorization bypassCVE-2020-36715 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arbitrary web scripts into the plugin settings that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Login/Signup Popup
Affected
up to 1.4
What to do
Affects up to 1.4. Update Login/Signup Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023MStore API: Authentication bypassCVE-2020-36713 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account.
Product
MStore API
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com acunetix.com
Jun 6, 2023Kali Forms: Unauthenticated Arbitrary Post DeletionCVE-2020-36712 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliforms_form_delete_uploaded_file function lacking any privilege or user protections. This makes it possible for unauthenticated attackers to delete any site post or page with the id parameter.
Product
Kali Forms
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023WPS Hide Login: Login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sitesCVE-2020-36710 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.
Product
WPS Hide Login
Affected
up to 1.5.4.2
What to do
Affects up to 1.5.4.2. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Ultimate Addons for Gutenberg: Authenticated Settings ChangeCVE-2020-36702 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14.7. This is due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber+ roles to update the plugin's settings.
Product
Ultimate Addons for Gutenberg
Affected
up to 1.14.7
What to do
Affects up to 1.14.7. Update Ultimate Addons for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Page Builder: KingComposer: Authorization bypassCVE-2020-36700 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress options, delete arbitrary files/folders, and inject arbitrary content.
Product
Page Builder: KingComposer
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Page Builder: KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Quick Page/Post Redirect: Authorization bypassCVE-2020-36699 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax and qppr_delete_quick_redirect functions in versions up to, and including, 5.1.9. This makes it possible for low-privileged attackers to interact with the plugin settings and to create a redirect link that would forward all traffic to an external malicious website.
Product
Quick Page/Post Redirect
Affected
up to 5.1.9
What to do
Affects up to 5.1.9. Update Quick Page/Post Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023WP GDPR: Authorization bypassCVE-2020-36697 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings.
Product
WP GDPR
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update WP GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com acunetix.com
Jun 6, 2023Product Input Fields for WooCommerce: Authorization bypassCVE-2020-36696 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.
Product
Product Input Fields for WooCommerce
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Funnel Builder: Authorization bypassCVE-2019-25151 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service.
Product
Funnel Builder
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Funnel Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023GDPR Cookie Compliance: Authorization bypassCVE-2019-25143 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_settings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings.
Product
GDPR Cookie Compliance
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update GDPR Cookie Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (CVE-2019-25142 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.nintechnet.com themes.trac.wordpress.org
Jun 6, 2023Easy WP SMTP: Authorization bypassCVE-2019-25141 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.
Product
Easy WP SMTP
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Easy WP SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Coming Soon Page & Maintenance Mode: Unauthenticated settings resetCVE-2019-25139 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php file which makes it possible for unauthenticated attackers to trigger a plugin settings reset.
Product
Coming Soon Page & Maintenance Mode
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Coming Soon Page & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 5, 2023WP User Switch: Authentication bypassCVE-2023-2546 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpus_allow_user_to_admin_bar_menu' function with the 'wpus_who_switch' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the username.
Product
WP User Switch
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP User Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Jun 3, 2023Auth.CVE-2023-32582 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kyle Maurer Don8 plugin <= 0.4 versions.
Affected
up to 0.4
What to do
Affects up to 0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 3, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2023-2415 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia connected account which would cause a denial of service on the appointment scheduler.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.2.10
What to do
Affects up to 4.2.10. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 3, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized medication of dataCVE-2023-2299 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugin's settings.
Product
Online Booking & Scheduling Calendar for WordPress by vcita
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 2, 2023VK Blocks: Improper authorizationCVE-2023-0584 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_font_awesome_version' option to an arbitrary value.
Product
VK Blocks
Affected
up to 1.57.0.5
What to do
Affects up to 1.57.0.5. Update VK Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2023VK Blocks: Improper authorizationCVE-2023-0583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons.
Product
VK Blocks
Affected
up to 1.57.0.5
What to do
Affects up to 1.57.0.5. Update VK Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2023Page Builder by AZEXO: Unauthorized modification of dataCVE-2023-3053 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and post status.
Product
Page Builder by AZEXO
Affected
up to 1.27.133
What to do
Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2023User Email Verification for WooCommerce: Authentication bypassCVE-2023-2781 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The User Email Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass via authenticate_user_by_email in versions up to, and including, 3.5.0. This is due to a random token generation weakness in the resend_verification_email function. This allows unauthenticated attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Allow Automatic Login After Successful Verification setting to be enabled, which it is not by default.
Product
User Email Verification for WooCommerce
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update User Email Verification for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 31, 2023Nested Pages: Unauthorized loss of dataCVE-2023-2434 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with editor-level permissions and above, to reset plugin settings.
Product
Nested Pages
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2023Wordapp: Authorization bypassCVE-2023-2987 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation.
Product
Wordapp
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update Wordapp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.report plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.