Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
89 results · page 2 of 2
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in ThingsForRestaurants Quick Restaurant Reservations plugin <= 1.5.4 versions.CVE-2022-44739 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in ThingsForRestaurants Quick Restaurant Reservations plugin <= 1.5.4 versions.
- Fixed in
- 1.5.5
- What to do
- Update the plugin to 1.5.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 29, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin CVE-2022-38077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 6, 2023YourChannel: Everything you want in a YouTube: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- YourChannel: Everything you want in a YouTube
- Fixed in
- 1.2.3
- What to do
- Update YourChannel: Everything you want in a YouTube to 1.2.3 or newer.
Aug 8, 2022Thinkific Uploader: Does not sanitise and escape its settingsCVE-2022-2426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.
- Product
- Thinkific Uploader
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Thinkific Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 25, 2022Popup Anything: Does not sanitise and escape a parameter before outputting it back in a frontend pageCVE-2022-2115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting
- Product
- Popup Anything
- Fixed in
- 2.1.7
- What to do
- Update Popup Anything to 2.1.7 or newer.
Jun 13, 2022Enqueue Anything: Does not have authorisation and CSRF checks in the remove_asset AJAX actionCVE-2021-25116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
- Product
- Enqueue Anything
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Enqueue Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022Slide Anything: Does not sanitize and escape sliders' descriptionCVE-2022-1303 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Slide Anything
- Fixed in
- 2.3.44
- What to do
- Update Slide Anything to 2.3.44 or newer.
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
- Product
- Buffer Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
- Product
- Translation Exchange
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.CVE-2021-25055 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.
- Product
- FeedWordPress
- Fixed in
- 2022.0123
- What to do
- Update FeedWordPress to 2022.0123 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 10, 2022WP Coder: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25053 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- Product
- WP Coder
- Fixed in
- 2.5.2
- What to do
- Update WP Coder to 2.5.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 10, 2022Button Generator: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25052 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- Product
- Button Generator
- Fixed in
- 2.3.3
- What to do
- Update Button Generator to 2.3.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 10, 2022Modal Window: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25051 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
- Product
- Modal Window
- Fixed in
- 5.2.2
- What to do
- Update Modal Window to 5.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 13, 2021Auto Featured Image (Auto Post Thumbnail): Does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS blockCVE-2021-24932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue.
- Product
- Auto Featured Image (Auto Post Thumbnail)
- Fixed in
- 3.9.3
- What to do
- Update Auto Featured Image (Auto Post Thumbnail) to 3.9.3 or newer.
Nov 29, 2021Popup Anything: Does not escape the Link Text and Button Text fields of PopupCVE-2021-24883 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Popup Anything
- Fixed in
- 2.0.4
- What to do
- Update Popup Anything to 2.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021WP Reactions Lite: Does not properly sanitize inputs within wp-admin pagesCVE-2021-24723 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages.
- Product
- WP Reactions Lite
- Fixed in
- 1.3.6
- What to do
- Update WP Reactions Lite to 1.3.6 or newer.
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.22.3
- What to do
- Update Modern Events Calendar Lite to 5.22.3 or newer.
Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
- Product
- LearnPress
- Fixed in
- 4.1.3.1
- What to do
- Update LearnPress to 4.1.3.1 or newer.
Sep 20, 2021ThinkTwit: Did not sanitise or escape its "Consumer key" setting before outputting it its settings pageCVE-2021-24582 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it its settings page, leading to a Stored Cross-Site Scripting issue.
- Product
- ThinkTwit
- Fixed in
- 1.7.1
- What to do
- Update ThinkTwit to 1.7.1 or newer.
Sep 6, 2021Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization optionsCVE-2021-24590 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.
- Product
- Cookie Notice & Consent Banner for GDPR & CCPA Compliance
- Fixed in
- 1.7.2
- What to do
- Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to 1.7.2 or newer.
Jul 19, 2021W3 Total Cache: Was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboardCVE-2021-24452 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
- Product
- W3 Total Cache
- Fixed in
- 2.1.5
- What to do
- Update W3 Total Cache to 2.1.5 or newer.
Jul 19, 2021W3 Total Cache: Was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboardCVE-2021-24436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
- Product
- W3 Total Cache
- Fixed in
- 2.1.4
- What to do
- Update W3 Total Cache to 2.1.4 or newer.
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameterCVE-2021-24339 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameterCVE-2021-24338 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
May 24, 2021Hana Flv Player: Is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' fieldCVE-2021-24302 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field.
- Product
- Hana Flv Player
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Hana Flv Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerabCVE-2021-24180 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting (XSS) vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious URL.
- Fixed in
- 2.0.4
- What to do
- Update the plugin to 2.0.4 or newer.
Mar 18, 2021Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable toCVE-2021-24130 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user (admin+).
- Product
- WP Google Map
- Fixed in
- 4.1.5
- What to do
- Update WP Google Map to 4.1.5 or newer.
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via tCVE-2020-14207 · WordPress plugins & themes · reported by MITREMedium 5.3
The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via the divelog.php filter_diver parameter.
- Affected
- 1.1.4 to 1.1.4
- What to do
- Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orghooperlabs.xyz
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).CVE-2020-14206 · WordPress plugins & themes · reported by MITREMedium 6.1
The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
- Affected
- 1.1.4 to 1.1.4
- What to do
- Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orghooperlabs.xyz
Apr 30, 2020In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor.CVE-2020-11030 · WordPress plugins & themes · reported by GitHubMedium 6.4
In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comwordpress.org
Dec 26, 2019WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the CVE-2019-16780 · WordPress plugins & themes · reported by GitHubMedium 5.8
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.
- What to do
- Update the plugin to the newest version.
Oct 22, 2019The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.CVE-2015-9499 · WordPress plugins & themes · reported by MITRECritical 9.8
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.
- Product
- Showbiz Pro
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Showbiz Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwpvulndb.com
Aug 22, 2019The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.CVE-2017-18571 · WordPress plugins & themes · reported by MITRECritical 9.8
The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.
- Product
- search-everything
- Fixed in
- 8.1.7
- What to do
- Update search-everything to 8.1.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.CVE-2016-10917 · WordPress plugins & themes · reported by MITRECritical 9.8
The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
- Product
- search-everything
- Fixed in
- 8.1.6
- What to do
- Update search-everything to 8.1.6 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
May 1, 2019HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fakCVE-2019-11633 · WordPress plugins & themes · reported by MITREHigh 7.5
HoneyPress through 2016-09-27 can be fingerprinted by attackers because of the ingrained unique www.atxsec.com and ayylmao.wpengine.com hostnames within the fake WordPress templates. This allows attackers to discover and avoid this honeypot system.
- Affected
- up to 2016-09-27
- What to do
- Affects up to 2016-09-27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 17, 2017Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin canCVE-2017-1000227 · WordPress plugins & themes · reported by MITREMedium 5.4
Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can
- Affected
- 3.0.15 to 3.0.15
- What to do
- Affects 3.0.15 to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurity.dxw.comwpvulndb.com
Nov 16, 2017CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the pluginCVE-2017-1000224 · WordPress plugins & themes · reported by MITREMedium 6.5
CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin
- Affected
- up to 11.8.1
- What to do
- Affects up to 11.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurity.dxw.comsecurity.dxw.com
May 22, 2014Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication CVE-2014-3843 · WordPress plugins & themes · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
- Product
- Cross-site request forgery (CSRF) vulnerability in the Search Everything
- Fixed in
- 8.1.1
- What to do
- Update Cross-site request forgery (CSRF) vulnerability in the Search Everything to 8.1.1 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Mar 9, 2014SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL comCVE-2014-2316 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in se_search_default in the Search Everything plugin before 7.0.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the s parameter to index.php. NOTE: some of these details are obtained from third party information.
- Product
- SQL injection vulnerability in se_search_default in the Search Everything
- Fixed in
- 7.0.3
- What to do
- Update SQL injection vulnerability in se_search_default in the Search Everything to 7.0.3 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.