Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
145 results · page 2 of 3
Jul 27, 2026Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.CVE-2026-59537 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.
- Affected
- up to 2.10.22
- What to do
- Affects up to 2.10.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 27, 2026WPBot: Does not validate administrator-configured field identifiers before using them in a SQL queryCVE-2026-14189 · WordPress plugins & themes · reported by WPScanLow 3.8
The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search.
- Product
- WPBot
- Fixed in
- 8.5.2
- What to do
- Update WPBot to 8.5.2 or newer.
Jul 23, 2026Administrator PHP Object Injection in Complianz <= 7.5.0 versions.CVE-2026-65497 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Administrator PHP Object Injection in Complianz <= 7.5.0 versions.
- Affected
- up to 7.5.0
- What to do
- Affects up to 7.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.CVE-2026-65462 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.
- Affected
- up to 7.3.2
- What to do
- Affects up to 7.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.CVE-2026-65461 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.CVE-2026-65455 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
- Affected
- up to 8.14.0
- What to do
- Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.CVE-2026-24628 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
- Affected
- up to 1.16.3
- What to do
- Affects up to 1.16.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.CVE-2025-68081 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.
- Affected
- up to 2.77.3
- What to do
- Affects up to 2.77.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 21, 2026Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to triCVE-2026-65049 · WordPress plugins & themes · reported by VulnCheckHigh 8.4
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jul 21, 2026Easy Form Builder by WhiteStudio: Unauthenticated Privilege Escalation to AdministratorCVE-2026-13439 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.
- Product
- Easy Form Builder by WhiteStudio
- Affected
- up to 4.0.11
- What to do
- Affects up to 4.0.11. Update Easy Form Builder by WhiteStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2026miniOrange OTP Login, Verification and SMS Notifications: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-14245 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed, and relying solely on a public `form_nonce` nonce that the plugin itself emits to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled `username_b` parameter to target any WordPress user without role restriction or any binding to a previously validated OTP session. This makes it possible for unauthenticated attackers to obtain a freshly generated password-reset URL for an arbitrary Administrator account — returned in a 302 `Location` header — and use it to take full control of that account. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset.
- Product
- miniOrange OTP Login, Verification and SMS Notifications
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update miniOrange OTP Login, Verification and SMS Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 1, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege Escalation to AdministratorCVE-2026-13228 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function of OsOrdersController, which allows an authenticated Agent to supply an arbitrary order[customer_id] and overwrite any LatePoint customer's email field (including one linked to a WordPress Administrator's account) through the public-scope customer set_data() call, combined with a missing role verification in OsAuthHelper::authorize_customer() which logs in the linked WordPress user without checking its role. This makes it possible for authenticated attackers, with custom (Agent)-level access and above, to elevate their privileges to Administrator.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.6.3
- What to do
- Affects up to 5.6.3. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.CVE-2026-57658 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Administrator SQL Injection in Popup box <= 6.0.1 versions.CVE-2026-57631 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in Popup box <= 6.0.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Administrator SQL Injection in WP All Import <= 4.0.1 versions.CVE-2026-57628 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Administrator SQL Injection in WP All Import <= 4.0.1 versions.
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 24, 2026Site Kit by Google: Does not properly restrict a REST API write endpoint to administratorsCVE-2026-10753 · WordPress plugins & themes · reported by WPScanLow 2.7
The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users who have been granted dashboard sharing access (such as Editors) to modify a site-wide Site Kit by Google WordPress plugin before 1.176.0 setting that should only be modifiable by administrators.
- Product
- Site Kit by Google
- Fixed in
- 1.176.0
- What to do
- Update Site Kit by Google to 1.176.0 or newer.
Jun 16, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege Escalation to AdministratorCVE-2026-8176 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.CVE-2025-60175 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2026Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.CVE-2025-15658 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.
- Affected
- up to 0.3.4
- What to do
- Affects up to 0.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2026Hippoo Mobile App for WooCommerce: Authentication Bypass leading to Administrator Account TakeoverCVE-2026-10580 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/<id> with a {"password":"<new_password>"} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.
- Product
- Hippoo Mobile App for WooCommerce
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update Hippoo Mobile App for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 10, 2026WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submittiCVE-2021-47932 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX handler. Attackers can send POST requests to the tcp_register_and_login_ajax action with tcp_role set to administrator to gain full administrative access without authentication.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgexploit-db.com
Mar 21, 2026Lobot Slider Administrator: Cross-Site Request ForgeryCVE-2026-3331 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Lobot Slider Administrator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.0. This is due to missing or incorrect nonce validation on the fourty_slider_options_page function. This makes it possible for unauthenticated attackers to modify plugin slider-page configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Lobot Slider Administrator
- Affected
- up to 0.6.0
- What to do
- Affects up to 0.6.0. Update Lobot Slider Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 13, 2026wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin optCVE-2026-22203 · WordPress plugins & themes · reported by VulnCheckMedium 6.9
wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON. Attackers can obtain exported files containing plaintext API secrets like fbAppSecret, googleClientSecret, twitterAppSecret, and other social login credentials from support tickets, backups, or version control repositories.
- Fixed in
- 7.6.47
- What to do
- Update the plugin to 7.6.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Feb 28, 2026wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fieldsCVE-2026-28561 · WordPress plugins & themes · reported by VulnCheckMedium 4.8
wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum description containing HTML event handlers that execute when any user views the forum listing.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
May 15, 2025The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.CVE-2024-6584 · WordPress plugins & themes · reported by WPScanCritical 9.1
The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
- Fixed in
- 3.4.7
- What to do
- Update the plugin to 3.4.7 or newer.
Apr 16, 2025Administrator Z: Path Traversal: '.../...//'CVE-2025-39598 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Path Traversal: '.../...//' vulnerability in Quý Lê 91 Administrator Z administrator-z allows Path Traversal.This issue affects Administrator Z: from n/a through <= 2025.03.28.
- Product
- Administrator Z
- Affected
- up to 2025.03.28
- What to do
- Affects up to 2025.03.28. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Administrator Z: Missing AuthorizationCVE-2025-26959 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in Quý Lê 91 Administrator Z administrator-z allows Privilege Escalation.This issue affects Administrator Z: from n/a through <= 2025.03.24.
- Product
- Administrator Z
- Affected
- up to 2025.03.24
- What to do
- Affects up to 2025.03.24. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Administrator Z: Cross-Site Request Forgery (CSRF)CVE-2025-32276 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Quý Lê 91 Administrator Z administrator-z allows Cross Site Request Forgery.This issue affects Administrator Z: from n/a through <= 2026.03.02.
- Product
- Administrator Z
- Affected
- up to 2026.03.02
- What to do
- Affects up to 2026.03.02. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Administrator Z: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32187 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quý Lê 91 Administrator Z administrator-z allows DOM-Based XSS.This issue affects Administrator Z: from n/a through <= 2026.03.02.
- Product
- Administrator Z
- Affected
- up to 2026.03.02
- What to do
- Affects up to 2026.03.02. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025Administrator Z: Unauthorized modification of data that can lead to privilege escalationCVE-2025-2815 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminz_import_backup() function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. CVE-2025-26959 is a duplicate of this issue.
- Product
- Administrator Z
- Affected
- up to 2025.03.24
- What to do
- Affects up to 2025.03.24. Update Administrator Z to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 9, 2024Administrator Z: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-50524 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Quý Lê 91 Administrator Z administrator-z allows Blind SQL Injection.This issue affects Administrator Z: from n/a through < 2024.10.21.
- Product
- Administrator Z
- What to do
- Update Administrator Z to the newest version.
Jul 30, 2024Business Card: Does not prevent high privilege users like administrators from uploading malicious PHP filesCVE-2024-5807 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.
- Product
- Business Card
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Business Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 31, 2024WP STAGING WordPress Backup: Does not prevent users with the administrator role from pinging conducting SSRF attacksCVE-2024-4469 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
- Product
- WP STAGING WordPress Backup
- Fixed in
- 3.5.0
- What to do
- Update WP STAGING WordPress Backup to 3.5.0 or newer.
May 14, 2024Administrator Cross Site Scripting (XSS) in Archives Calendar Widget <= 1.0.15 versions.CVE-2024-33950 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in Archives Calendar Widget <= 1.0.15 versions.
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024Import WP: Does not prevent users with the administrator role from pinging conducting SSRF attacksCVE-2023-7253 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
- Product
- Import WP
- Fixed in
- 2.13.1
- What to do
- Update Import WP to 2.13.1 or newer.
Jan 29, 2024Page Builder: Pagelayer: Doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5124 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.0
- What to do
- Update Page Builder: Pagelayer to 1.8.0 or newer.
Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- WordPress Database Administrator
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2023Asgaros Forum: Allows forum administratorsCVE-2023-5604 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.
- Product
- Asgaros Forum
- Fixed in
- 2.7.1
- What to do
- Update Asgaros Forum to 2.7.1 or newer.
Aug 30, 2023All Users Messenger: Does not prevent non-administrator users from deleting messages from the all-users messengerCVE-2023-4023 · WordPress plugins & themes · reported by WPScanMedium 4.3
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.
- Product
- All Users Messenger
- Affected
- up to 1.24
- What to do
- Affects up to 1.24. Update All Users Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022Syncee: Leaks the administrator token that can be used to take over the administrator's accountCVE-2022-3694 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account.
- Product
- Syncee
- Fixed in
- 1.0.10
- What to do
- Update Syncee to 1.0.10 or newer.
Oct 25, 2022WP All Export Pro: Does not limit some functionality during exports only to users with the Administrator roleCVE-2022-3394 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
- Product
- WP All Export Pro
- Fixed in
- 1.7.9
- What to do
- Update WP All Export Pro to 1.7.9 or newer.
Aug 15, 2022WP-DBManager: Does not prevent administrators from running arbitrary commands on the server in multisite installationsCVE-2022-2354 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.
- Product
- WP-DBManager
- Fixed in
- 2.80.8
- What to do
- Update WP-DBManager to 2.80.8 or newer.
Aug 8, 2022Directorist: Allows administrators to download other plugins from the same vendor directly to the siteCVE-2022-2046 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.
- Product
- Directorist
- Fixed in
- 7.2.3
- What to do
- Update Directorist to 7.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jul 6, 2022custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.CVE-2015-3173 · WordPress plugins & themes · reported by Red HatHigh 7.2
custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.
- Fixed in
- 0.9.8.6
- What to do
- Update the plugin to 0.9.8.6 or newer.
Full record and what to do →NVD recordblog.nettitude.comgithub.com
Jun 27, 2022ARMember: Is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated usersCVE-2022-1903 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
- Product
- ARMember
- Fixed in
- 3.4.8
- What to do
- Update ARMember to 3.4.8 or newer.
May 20, 2022Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.CVE-2022-29447 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 onCVE-2022-29432 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters.
- Affected
- up to 2.1.27
- What to do
- Affects up to 2.1.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 19, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.CVE-2022-29446 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 18, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.CVE-2022-29445 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 25, 2022Page Restriction WordPress (WP): Allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator uCVE-2022-1027 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator users.
- Product
- Page Restriction WordPress (WP)
- Fixed in
- 1.2.7
- What to do
- Update Page Restriction WordPress (WP) to 1.2.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.