Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
98 results · page 2 of 2
Oct 2, 2024BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript: Reflected Cross-Site ScriptingCVE-2024-9344 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2024Advanced File Manager: Local JavaScript File InclusionCVE-2024-8704 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced File Manager plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 5.2.8 via the 'fma_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Advanced File Manager
- Affected
- up to 5.2.8
- What to do
- Affects up to 5.2.8. Update Advanced File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 20, 2024Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder: Arbitrary JavaScript file uploadsCVE-2024-7775 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing input validation in the addCustomCode function in versions 2.0 to 2.13.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary JavaScript files to the affected site's server.
- Product
- Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
- Affected
- 2.0 to 2.13.9
- What to do
- Affects 2.0 to 2.13.9. Update Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 26, 2024Add Admin JavaScript: Full Path DisclosureCVE-2024-6548 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Add Admin JavaScript plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Add Admin JavaScript
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Add Admin JavaScript to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2024360 Javascript Viewer: Unauthorized modification of dataCVE-2024-1637 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access or higher, to update plugin settings.
- Product
- 360 Javascript Viewer
- Affected
- up to 1.7.12
- What to do
- Affects up to 1.7.12. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 29, 2024Page Builder: Pagelayer: Doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5124 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.0
- What to do
- Update Page Builder: Pagelayer to 1.8.0 or newer.
Jan 16, 2024Dokan: Allows vendors to inject arbitrary javascript in product reviewsCVE-2022-3194 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators.
- Product
- Dokan
- Fixed in
- 3.6.4
- What to do
- Update Dokan to 3.6.4 or newer.
Jan 5, 2024NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: Cross-Site Request Forgery (CSRF)CVE-2023-52121 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: from n/a through 1.10.2.
- Product
- NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023CSS & JavaScript Toolbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50823 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wipeout Media CSS & JavaScript Toolbox allows Stored XSS.This issue affects CSS & JavaScript Toolbox: from n/a through 11.7.
- Product
- CSS & JavaScript Toolbox
- Affected
- up to 11.7
- What to do
- Affects up to 11.7. Update CSS & JavaScript Toolbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 16, 2023Page Builder: Pagelayer: Doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5087 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code.
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.7.8
- What to do
- Update Page Builder: Pagelayer to 1.7.8 or newer.
Mar 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <= 2.4CVE-2022-47154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <= 2.4.49 versions.
- Affected
- up to 2.4.49
- What to do
- Affects up to 2.4.49. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 12, 2022WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3881 · WordPress plugins & themes · reported by WPScanMedium 5.7
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log
- Fixed in
- 3.43
- What to do
- Update WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log to 3.43 or newer.
Aug 29, 2022Stop Spam Comments: Does not properly generate the Javascript access token for preventing abuse of comment sectionCVE-2022-1663 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
- Product
- Stop Spam Comments
- Affected
- up to 0.2.1.2
- What to do
- Affects up to 0.2.1.2. Update Stop Spam Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript iCVE-2022-2391 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.
- Fixed in
- 7.2.3
- What to do
- Update the plugin to 7.2.3 or newer.
May 30, 2022VikBooking Hotel Booking Engine & PMS: Does not escape the current URL before putting it back in a JavaScript contextCVE-2022-1528 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.9
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.9 or newer.
Apr 25, 2022Page Restriction WordPress (WP): Allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator uCVE-2022-1027 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator users.
- Product
- Page Restriction WordPress (WP)
- Fixed in
- 1.2.7
- What to do
- Update Page Restriction WordPress (WP) to 1.2.7 or newer.
Aug 2, 2021Leaflet Map: Does not escape some shortcode attributes before they are used in JavaScript code or HTMLCVE-2021-24468 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues
- Product
- Leaflet Map
- Fixed in
- 3.0.0
- What to do
- Update Leaflet Map to 3.0.0 or newer.
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript blockCVE-2021-24373 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
- Product
- WP Hardening – Fix Your WordPress Security
- Fixed in
- 1.2.2
- What to do
- Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Apr 5, 2021Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a siCVE-2021-24159 · WordPress plugins & themes · reported by WPScanHigh 8.8
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.
- Affected
- up to 3.1.9
- What to do
- Affects up to 3.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML wiCVE-2021-24156 · WordPress plugins & themes · reported by WPScanMedium 5.4
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation
- Affected
- 3.0.3 to 3.0.3
- What to do
- Affects 3.0.3 to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2020Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing DetailCVE-2019-18834 · WordPress plugins & themes · reported by MITREMedium 6.1
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.
- Product
- Persistent XSS in the WooCommerce Subscriptions
- Fixed in
- 2.6.3
- What to do
- Update Persistent XSS in the WooCommerce Subscriptions to 2.6.3 or newer.
Full record and what to do →NVD recordwoocommerce.comprecursorsecurity.com
Jul 21, 2020A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to injecCVE-2020-14063 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.
- Product
- A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript
- Fixed in
- 1.2.2
- What to do
- Update A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript to 1.2.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jun 12, 2020In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-adCVE-2020-4049 · WordPress plugins & themes · reported by GitHubLow 2.4
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- What to do
- Update the plugin to the newest version.
Jun 12, 2020In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pageCVE-2020-4047 · WordPress plugins & themes · reported by GitHubMedium 6.8
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
- What to do
- Update the plugin to the newest version.
May 26, 2020The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=foCVE-2020-13487 · WordPress plugins & themes · reported by MITREMedium 4.8
The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.
- Product
- bbPress
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbbpress.orgcodex.bbpress.org
Apr 7, 2020An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript viCVE-2020-11509 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page).
- Product
- An XSS vulnerability in the WP Lead Plus X
- Affected
- up to 0.98
- What to do
- Affects up to 0.98. Update An XSS vulnerability in the WP Lead Plus X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Apr 7, 2020Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScrCVE-2020-11516 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
- Product
- Stored XSS in the Contact Form 7 Datepicker
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Stored XSS in the Contact Form 7 Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Mar 13, 2020An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an CVE-2020-10196 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several of the popup's fields by sending a request to wp-admin/admin-ajax.php with the POST action parameter of sgpb_autosave and including additional data in an allPopupData parameter, including the popup's ID (which is visible in the source of the page in which the popup is inserted) and arbitrary JavaScript which will then be executed in the browsers of visitors to that page. Because the plugin functionality automatically adds script tags to data entered into these fields, this injection will typically bypass most WAF applications.
- Product
- An XSS vulnerability in the popup-builder
- Fixed in
- 3.64.1
- What to do
- Update An XSS vulnerability in the popup-builder to 3.64.1 or newer.
Full record and what to do →NVD recordwpvulndb.comwordfence.com
Jan 21, 2020The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.CVE-2020-7239 · WordPress plugins & themes · reported by MITREMedium 6.1
The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.
- Product
- conversation-watson
- Fixed in
- 0.8.21
- What to do
- Update conversation-watson to 0.8.21 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Jan 2, 2020The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.CVE-2019-20204 · WordPress plugins & themes · reported by MITREMedium 5.4
The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.
- Affected
- up to 1.9.40
- What to do
- Affects up to 1.9.40. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 26, 2019In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed withiCVE-2019-16781 · WordPress plugins & themes · reported by GitHubMedium 5.8
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
- Fixed in
- 5.3.1
- What to do
- Update the plugin to 5.3.1 or newer.
Full record and what to do →NVD recordgithub.comhackerone.com
Dec 26, 2019WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the CVE-2019-16780 · WordPress plugins & themes · reported by GitHubMedium 5.8
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.
- What to do
- Update the plugin to the newest version.
Oct 17, 2019WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.CVE-2019-17672 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD recordblog.wpscan.orgseclists.org
Oct 3, 2019A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or otheCVE-2019-16931 · WordPress plugins & themes · reported by MITREMedium 6.1
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.
- Product
- Visualizer
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Visualizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordnathandavison.comwordpress.org
Aug 22, 2019The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.CVE-2014-10386 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
- Product
- wp-live-chat-support
- Fixed in
- 4.1.0
- What to do
- Update wp-live-chat-support to 4.1.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.CVE-2014-10394 · WordPress plugins & themes · reported by MITREMedium 6.1
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.
- Product
- rich-counter
- Fixed in
- 1.2.0
- What to do
- Update rich-counter to 1.2.0 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.CVE-2014-10391 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.
- Product
- wp-support-plus-responsive-ticket-system
- Fixed in
- 4.1
- What to do
- Update wp-support-plus-responsive-ticket-system to 4.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jul 28, 2019An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicCVE-2019-14364 · WordPress plugins & themes · reported by MITREMedium 6.1
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter.
- Product
- Email Subscribers & Newsletters
- Affected
- 4.1.6 to 4.1.6
- What to do
- Affects 4.1.6 to 4.1.6. Update Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Nov 15, 2018XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submisCVE-2018-19287 · WordPress plugins & themes · reported by MITREMedium 6.1
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.
- Product
- XSS in the Ninja Forms
- Fixed in
- 3.3.18
- What to do
- Update XSS in the Ninja Forms to 3.3.18 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 7, 2018The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-basedCVE-2015-9273 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
- Product
- wp-slimstat (aka Slimstat Analytics)
- Fixed in
- 4.1.6.1
- What to do
- Update wp-slimstat (aka Slimstat Analytics) to 4.1.6.1 or newer.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Mar 15, 2018Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript CVE-2018-8729 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.
- Product
- Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log
- Fixed in
- 2.4.1
- What to do
- Update Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log to 2.4.1 or newer.
Dec 3, 2017Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via craftCVE-2017-17096 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Content Cards plugin before 0.9.7 for WordPress allows remote attackers to inject arbitrary JavaScript via crafted OpenGraph data.
- Product
- Cross-site scripting (XSS) vulnerability in the Content Cards
- Fixed in
- 0.9.7
- What to do
- Update Cross-site scripting (XSS) vulnerability in the Content Cards to 0.9.7 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Sep 23, 2017Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.CVE-2017-14718 · WordPress plugins & themes · reported by MITREMedium 6.1
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 23, 2017DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.CVE-2017-13138 · WordPress plugins & themes · reported by MITREMedium 6.1
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.
- Product
- DOM based Cross-site scripting (XSS) vulnerability in the Bridge
- Fixed in
- 11.2
- What to do
- Update DOM based Cross-site scripting (XSS) vulnerability in the Bridge to 11.2 or newer.
Full record and what to do →NVD recordbridge.qodeinteractive.comimgur.com
Jul 17, 2017WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected siteCVE-2017-1000038 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site
- Affected
- 3.5.7.1 to 3.5.7.1
- What to do
- Affects 3.5.7.1 to 3.5.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurity.dxw.comsecurity.dxw.com
Jul 17, 2017Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in CVE-2017-1000033 · WordPress plugins & themes · reported by MITREMedium 6.1
Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 15, 2017Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScCVE-2017-9419 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter.
- Product
- Webhammer WP Custom Fields Search
- Affected
- 0.3.28 to 0.3.28
- What to do
- Affects 0.3.28 to 0.3.28. Update Webhammer WP Custom Fields Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comwpvulndb.com
Jun 5, 2017Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via theCVE-2017-9420 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.
- Product
- Cross site scripting (XSS) vulnerability in the Spiffy Calendar
- Fixed in
- 3.3.0
- What to do
- Update Cross site scripting (XSS) vulnerability in the Spiffy Calendar to 3.3.0 or newer.
Full record and what to do →NVD recordspiffycalendar.sunnythemes.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.