Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
74 results · page 2 of 2
Aug 8, 2022Discy: Lacks authorization checks then processing ajax requests to the discy_update_options actionCVE-2022-1323 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.
- Product
- Discy
- Fixed in
- 5.0
- What to do
- Update Discy to 5.0 or newer.
Jul 17, 2022OAuth Single Sign On: Doesn't validate that OAuth access token requests are legitimateCVE-2022-2133 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.
- Product
- OAuth Single Sign On
- Fixed in
- 6.22.6
- What to do
- Update OAuth Single Sign On to 6.22.6 or newer.
Jun 13, 2022Useful Banner Manager: Does not perform CSRF checks on POST requests to its admin pageCVE-2022-1694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.
- Product
- Useful Banner Manager
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Useful Banner Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
- Product
- JivoChat Live Chat
- Fixed in
- 1.3.5.4
- What to do
- Update JivoChat Live Chat to 1.3.5.4 or newer.
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
- Product
- Contact Form Submissions
- Fixed in
- 1.7.3
- What to do
- Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not sanitise and escape logged requests before outputting them in the related admin dashboardCVE-2021-24975 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.24
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.24 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 3, 2022LiteSpeed Cache: Does not properly verify that requests are coming from QUICCVE-2021-24964 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
- Product
- LiteSpeed Cache
- Fixed in
- 4.4.4
- What to do
- Update LiteSpeed Cache to 4.4.4 or newer.
Sep 27, 2021PostX – Gutenberg Blocks for Post Grid: Performs incorrect checks before allowing any logged in user to perform some ajax based requestsCVE-2021-24652 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.
- Product
- PostX – Gutenberg Blocks for Post Grid
- Fixed in
- 2.4.10
- What to do
- Update PostX – Gutenberg Blocks for Post Grid to 2.4.10 or newer.
Jul 7, 2021Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the CVE-2020-24142 · WordPress plugins & themes · reported by MITRECritical 9.8
Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services
- Product
- Video Downloader for TikTok (aka downloader-tiktok)
- Affected
- 1.3 to 1.3
- What to do
- Affects 1.3 to 1.3. Update Video Downloader for TikTok (aka downloader-tiktok) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2021Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerablCVE-2020-24141 · WordPress plugins & themes · reported by MITREMedium 5.3
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
- Product
- WP-DownloadManager
- Affected
- 1.68.4 to 1.68.4
- What to do
- Affects 1.68.4 to 1.68.4. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 27, 2021Requests is a HTTP library written in PHP.CVE-2021-29476 · WordPress plugins & themes · reported by GitHubCritical 9.8
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
- Product
- Requests
- What to do
- Update Requests to the newest version.
Nov 2, 2020WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.CVE-2020-28032 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordgithub.comlists.debian.org
Apr 22, 2020The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.CVE-2020-12073 · WordPress plugins & themes · reported by MITREHigh 8.8
The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.
- Product
- responsive-add-ons
- Fixed in
- 2.2.7
- What to do
- Update responsive-add-ons to 2.2.7 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Mar 6, 2020A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator tCVE-2020-9454 · WordPress plugins & themes · reported by MITREHigh 8.8
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.
- Product
- A CSRF vulnerability in the RegistrationMagic
- Affected
- up to 4.6.0.3
- What to do
- Affects up to 4.6.0.3. Update A CSRF vulnerability in the RegistrationMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 17, 2019WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.CVE-2019-17673 · WordPress plugins & themes · reported by MITREHigh 7.5
WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD recordblog.wpscan.orgcore.trac.wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · WordPress plugins & themes · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
- Product
- ninja-forms
- Fixed in
- 3.3.9
- What to do
- Update ninja-forms to 3.3.9 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 20, 2019The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.CVE-2016-10893 · WordPress plugins & themes · reported by MITREMedium 6.1
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
- Product
- crayon-syntax-highlighter
- Fixed in
- 2.8.4
- What to do
- Update crayon-syntax-highlighter to 2.8.4 or newer.
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
- Product
- wp-all-import
- Fixed in
- 3.2.4
- What to do
- Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, whicCVE-2018-19488 · WordPress plugins & themes · reported by MITRECritical 9.8
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account.
- Product
- WP-jobhunt
- Fixed in
- 2.4
- What to do
- Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD recordgithub.comwpvulndb.com
Mar 21, 2019The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.phpCVE-2018-19487 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.
- Product
- WP-jobhunt
- Fixed in
- 2.4
- What to do
- Update WP-jobhunt to 2.4 or newer.
Full record and what to do →NVD recordgithub.comwpvulndb.com
Jul 8, 2013The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side RequeCVE-2013-2199 · WordPress plugins & themes · reported by Red HatMedium 4.3
The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.
- Fixed in
- 3.5.2
- What to do
- Update the plugin to 3.5.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgwordpress.org
Jul 8, 2013The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a cCVE-2013-0235 · WordPress plugins & themes · reported by Red HatMedium 6.4
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
- Fixed in
- 3.5.1
- What to do
- Update the plugin to 3.5.1 or newer.
Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameteCVE-2011-4898 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com
Dec 19, 2008wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remoteCVE-2008-5695 · WordPress plugins & themes · reported by MITREHigh 8.5
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.
- Affected
- up to 2.3.2
- Fixed in
- 1.3.2
- What to do
- Update the plugin to 1.3.2 or newer.
Full record and what to do →NVD recordmu.wordpress.orgsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.