Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

133 results · page 2 of 3

Oct 29, 2024Subscribe to Comments: Reflected Cross-Site ScriptingCVE-2024-8792 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Subscribe to Comments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Subscribe to Comments
Affected
up to 2.3
What to do
Affects up to 2.3. Update Subscribe to Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2024Comments – wpDiscuz: Authentication bypassCVE-2024-9488 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
Product
Comments – wpDiscuz
Affected
up to 7.6.24
What to do
Affects up to 7.6.24. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2024Feed Comments Number: Unrestricted Upload of File with Dangerous TypeCVE-2024-49216 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in jclay06 Feed Comments Number feed-comments-number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through <= 0.2.1.
Product
Feed Comments Number
Affected
up to 0.2.1
What to do
Affects up to 0.2.1. Update Feed Comments Number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 11, 2024WordPress Comments Import & Export: To arbitrary file readCVE-2024-7514 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The issue was partially fixed in version 2.3.8 and fully fixed in 2.3.9
Product
WordPress Comments Import & Export
Affected
up to 2.3.7
Fixed in
2.3.8
What to do
Update WordPress Comments Import & Export to 2.3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2024Comments – wpDiscuz: HTML InjectionCVE-2024-6704 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled.
Product
Comments – wpDiscuz
Affected
up to 7.6.21
What to do
Affects up to 7.6.21. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 26, 2024One Click Close Comments: Full Path DisclosureCVE-2024-6546 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The One Click Close Comments plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.7.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
One Click Close Comments
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update One Click Close Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2024Comments Like Dislike: Authentication Bypass by SpoofingCVE-2024-25906 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authentication Bypass by Spoofing vulnerability in WP Happy Coders Comments Like Dislike allows Functionality Bypass.This issue affects Comments Like Dislike: from n/a through 1.2.2.
Product
Comments Like Dislike
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Comments Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024Comments Evolved for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-34420 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in talspotim Comments Evolved for WordPress allows Stored XSS.This issue affects Comments Evolved for WordPress: from n/a through 1.6.3.
Product
Comments Evolved for
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Comments Evolved for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 4, 2024Stop Spammers Security | Block Spam Users, Comments, Forms: Cross-Site Request ForgeryCVE-2023-7065 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfs_process AJAX action. This makes it possible for unauthenticated attackers to add arbitrary IPs to the plugin's allowlist and blocklist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Affected
up to 2024.4
What to do
Affects up to 2024.4. Update Stop Spammers Security | Block Spam Users, Comments, Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2404 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers to perform Stored Cross-Site Scripting attacks.
Product
Better Comments
Fixed in
1.5.6
What to do
Update Better Comments to 1.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2402 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Better Comments
Fixed in
1.5.6
What to do
Update Better Comments to 1.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2024WP Social Comments: Missing AuthorizationCVE-2024-32689 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GenialSouls WP Social Comments.This issue affects WP Social Comments: from n/a through 1.7.3.
Product
WP Social Comments
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update WP Social Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Disable Comments | WPZest: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-32135 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPZest Disable Comments | WPZest.This issue affects Disable Comments | WPZest: from n/a through 1.51.
Product
Disable Comments | WPZest
Affected
up to 1.51
What to do
Affects up to 1.51. Update Disable Comments | WPZest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024Social Share, Social Login and Social Comments: Does not sanitise and escape some of its settingsCVE-2024-2836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.64
What to do
Update Social Share, Social Login and Social Comments to 7.13.64 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2024WordPress Comments Import & Export: Cross-Site Request Forgery (CSRF)CVE-2024-31235 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.5.
Product
WordPress Comments Import & Export
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2024Subscribe To Comments Reloaded: Insertion of Sensitive Information into Log FileCVE-2024-31249 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725.
Product
Subscribe To Comments Reloaded
Affected
up to 220725
What to do
Affects up to 220725. Update Subscribe To Comments Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024Ultimate Social Comments – Email Notification & Lazy Load: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30555 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayan Datta Ultimate Social Comments – Email Notification & Lazy Load allows Stored XSS.This issue affects Ultimate Social Comments – Email Notification & Lazy Load: from n/a through 1.4.8.
Product
Ultimate Social Comments – Email Notification & Lazy Load
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Ultimate Social Comments – Email Notification & Lazy Load to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Fancy Comments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29804 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Heateor Fancy Comments WordPress allows Stored XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.14.
Product
Fancy Comments
Affected
up to 1.2.14
What to do
Affects up to 1.2.14. Update Fancy Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Comments Extra Fields For Post,Pages and CPT: Cross-Site Request ForgeryCVE-2024-0830 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. This is due to missing or incorrect nonce validation on several ajax actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. As a result, they may modify comment form fields and update plugin settings.
Product
Comments Extra Fields For Post,Pages and CPT
Affected
up to 5.0
What to do
Affects up to 5.0. Update Comments Extra Fields For Post,Pages and CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2024Comments Extra Fields For Post,Pages and CPT: Missing AuthorizationCVE-2024-0829 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0. This is due to missing or incorrect capability checks on several ajax actions. This makes it possible for authenticated attackers, with subscriber access or higher, to invoke those actions. As a result, they may modify comment form fields and update plugin settings.
Product
Comments Extra Fields For Post,Pages and CPT
Affected
up to 5.0
What to do
Affects up to 5.0. Update Comments Extra Fields For Post,Pages and CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 1, 2024Comments – wpDiscuz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51691 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This issue affects Comments – wpDiscuz: from n/a through 7.6.12.
Product
Comments – wpDiscuz
Affected
up to 7.6.12
What to do
Affects up to 7.6.12. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 16, 2024ark-commenteditor: Does not properly sanitise or encode the commentsCVE-2021-4227 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
Product
ark-commenteditor
Affected
up to 2.15.6
What to do
Affects up to 2.15.6. Update ark-commenteditor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 20, 2023Comments – wpDiscuz: Authorization Bypass Through User-Controlled KeyCVE-2023-46311 · WordPress plugins & themes · reported by PatchstackLow 2.7
Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3.
Product
Comments – wpDiscuz
Affected
up to 7.6.3
What to do
Affects up to 7.6.3. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023WooDiscuz – WooCommerce Comments: Cross-Site Request Forgery (CSRF)CVE-2023-49759 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.3.0.
Product
WooDiscuz – WooCommerce Comments
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update WooDiscuz – WooCommerce Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions.CVE-2023-47775 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions.
Fixed in
7.6.12
What to do
Update the plugin to 7.6.12 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
Product
WordPress Comments Import & Export
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Copy or Move Comments: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28748 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in biztechc Copy or Move Comments allows SQL Injection.This issue affects Copy or Move Comments: from n/a through 5.0.4.
Product
Copy or Move Comments
Affected
up to 5.0.4
What to do
Affects up to 5.0.4. Update Copy or Move Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.CVE-2023-45654 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 29, 2023Comments by Startbit: Stored Cross-Site ScriptingCVE-2023-5295 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Comments by Startbit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vivafbcomment' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Comments by Startbit
Affected
up to 1.4
What to do
Affects up to 1.4. Update Comments by Startbit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 17, 2023Comments Like Dislike: Unauthorized modification of dataCVE-2023-3244 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to reset the plugin's settings. NOTE: this issue is was only partially patched in version 1.2.0, as the nonce is still present to subscriber-level users.
Product
Comments Like Dislike
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Comments Like Dislike to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023Vuukle Comments, Reactions, Share Bar, Revenue: Cross-Site Request ForgeryCVE-2021-4427 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.31. This is due to missing or incorrect nonce validation in the /admin/partials/free-comments-for-wordpress-vuukle-admin-display.php file. This makes it possible for unauthenticated attackers to edit the plugins settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Vuukle Comments, Reactions, Share Bar, Revenue
Affected
up to 3.4.31
What to do
Affects up to 3.4.31. Update Vuukle Comments, Reactions, Share Bar, Revenue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions.CVE-2023-23704 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions.
Fixed in
1.1.7
What to do
Update the plugin to 1.1.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2023Social Share, Social Login and Social Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2779 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.52
What to do
Update Social Share, Social Login and Social Comments to 7.13.52 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 6, 2023Delete All Comments: Arbitrary file uploadsCVE-2016-15033 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
Delete All Comments
Affected
up to 2.0
What to do
Affects up to 2.0. Update Delete All Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2023
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2023
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 28, 2023WooDiscuz – WooCommerce Comments: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-33216 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9.
Product
WooDiscuz – WooCommerce Comments
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update WooDiscuz – WooCommerce Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 5, 2023A vulnerability, which was classified as problematic, was found in Subscribe to Comments Plugin up to 2.0.7 on WordPress.CVE-2006-10001 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Subscribe to Comments Plugin up to 2.0.7 on WordPress. This affects an unknown part of the file subscribe-to-comments.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The identifier of the patch is 9683bdf462fcac2f32b33be98f0b96497fbd1bb6. It is recommended to upgrade the affected component. The identifier VDB-222321 was assigned to this vulnerability.
Product
Subscribe to Comments
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Subscribe to Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 16, 2023Social Share, Social Login and Social Comments: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4484 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.44
What to do
Update Social Share, Social Login and Social Comments to 7.13.44 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Show All Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4295 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
Product
Show All Comments
Fixed in
7.0.1
What to do
Update Show All Comments to 7.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_copy_id POST parameter before concatenating it to an SQL query in cg-copy-commentsCVE-2022-4160 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST parameter before concatenating it to an SQL query in cg-copy-comments.php and cg-copy-rating.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Stop Spammers Security | Block Spam Users, Comments, Forms: Passes base64 encoded user input to the unserialize() PHP functionCVE-2022-4120 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2022.6
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2022.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022Add Comments: Does not sanitise and escape some of its settingsCVE-2022-3909 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Add Comments
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Add Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022Stop Spam Comments: Does not properly generate the Javascript access token for preventing abuse of comment sectionCVE-2022-1663 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
Product
Stop Spam Comments
Affected
up to 0.2.1.2
What to do
Affects up to 0.2.1.2. Update Stop Spam Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022WordPress Comments Fields: Does not escape Field Error MessageCVE-2022-2398 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
WordPress Comments Fields
Fixed in
4.1
What to do
Update WordPress Comments Fields to 4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Turn off all comments: Does not sanitise and escape the rows parameter before outputting it back in an admin pageCVE-2022-1192 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Turn off all comments
Affected
up to 1.0
What to do
Affects up to 1.0. Update Turn off all comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 29, 2022Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clCVE-2022-29414 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system info file, plugin system settings, plugin options settings, generate a new key, reset all options, change notifications settings, management page settings, comment form settings, manage subscriptions > mass update settings, manage subscriptions > add a new subscription, update subscription, delete Subscription.
Affected
up to 211130
What to do
Affects up to 211130. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022Social comments by WpDevArt: Does not sanitise and escape its settingsCVE-2022-0876 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Social comments by WpDevArt
Fixed in
2.5.0
What to do
Update Social comments by WpDevArt to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Good & Bad Comments: Does not sanitise and escape its settingsCVE-2022-1090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Good & Bad Comments
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Good & Bad Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Social Share, Social Login and Social Comments: Does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it CVE-2021-24987 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.30
What to do
Update Social Share, Social Login and Social Comments to 7.13.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.