Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

97 results · page 2 of 2

Dec 11, 2024Schema App Structured Data: Reflected Cross-Site ScriptingCVE-2024-11279 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Schema App Structured Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Schema App Structured Data
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 10, 2024The Active Products Tables for WooCommerce. Use constructor to create tables: Arbitrary shortcode executionCVE-2024-10959 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to arbitrary shortcode execution via woot_get_smth AJAX action in all versions up to, and including, 1.0.6.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Product
The Active Products Tables for WooCommerce. Use constructor to create tables
Affected
up to 1.0.6.5
What to do
Affects up to 1.0.6.5. Update The Active Products Tables for WooCommerce. Use constructor to create tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 18, 2024ReConstruction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52417 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes ReConstruction reconstruction allows Reflected XSS.This issue affects ReConstruction: from n/a through <= 1.4.7.
Product
ReConstruction
Affected
up to 1.4.7
What to do
Affects up to 1.4.7. Update ReConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 6, 2024Active Products Tables for WooCommerce. Use constructor to create tables: Stored Cross-Site ScriptingCVE-2024-10168 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woot_button shortcode in all versions up to, and including, 1.0.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Active Products Tables for WooCommerce. Use constructor to create tables
Affected
up to 1.0.6.4
What to do
Affects up to 1.0.6.4. Update Active Products Tables for WooCommerce. Use constructor to create tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 24, 2024Schema & Structured Data for WP & AMP: Missing AuthorizationCVE-2024-49683 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magazine3 Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Schema & Structured Data for WP & AMP: from n/a through <= 1.3.5.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.3.5
What to do
Affects up to 1.3.5. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 6, 2024Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47299 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Stored XSS.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.17.4.
Product
Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
Affected
up to 6.17.4
What to do
Affects up to 6.17.4. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 18, 2024Structured Content: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43307 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content allows Stored XSS.This issue affects Structured Content: from n/a through 1.6.2.
Product
Structured Content
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Structured Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 22, 2024MasterStudy LMS: Does not prevent students from creating instructor accountsCVE-2024-5973 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.
Product
MasterStudy LMS
Fixed in
3.3.24
What to do
Update MasterStudy LMS to 3.3.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-5582 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and including, 1.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.33
What to do
Affects up to 1.33. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 14, 2024Schema App Structured Data: Cross-Site Request ForgeryCVE-2024-0892 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schema App Structured Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the MarkUpdate function. This makes it possible for unauthenticated attackers to update and delete post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Schema App Structured Data
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 10, 2024Under Construction / Maintenance Mode from Acurax: Authentication Bypass by SpoofingCVE-2024-35749 · WordPress plugins & themes · reported by PatchstackLow 3.7
Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6.
Product
Under Construction / Maintenance Mode from Acurax
Affected
up to 2.6
What to do
Affects up to 2.6. Update Under Construction / Maintenance Mode from Acurax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 24, 2024Schema App Structured Data: Unauthorized modification of dataCVE-2024-0893 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schema App Structured Data plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the MarkupUpdate function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update or delete post metadata.
Product
Schema App Structured Data
Affected
up to 2.2.0
What to do
Affects up to 2.2.0. Update Schema App Structured Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 3, 2024Ultimate Under Construction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33943 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyKite Ultimate Under Construction allows Stored XSS.This issue affects Ultimate Under Construction: from n/a through 1.9.3.
Product
Ultimate Under Construction
Affected
up to 1.9.3
What to do
Affects up to 1.9.3. Update Ultimate Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 23, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-3491 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.29
What to do
Affects up to 1.29. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 15, 2024Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: Cross-Site Request Forgery (CSRF)CVE-2024-32088 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through 6.15.20.
Product
Coming Soon Page, Under Construction & Maintenance Mode by SeedProd
Affected
up to 6.15.20
What to do
Affects up to 6.15.20. Update Coming Soon Page, Under Construction & Maintenance Mode by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 31, 2024underConstruction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30548 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan underConstruction allows Stored XSS.This issue affects underConstruction: from n/a through 1.21.
Product
underConstruction
Affected
up to 1.21
What to do
Affects up to 1.21. Update underConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2024Coming Soon, Under Construction & Maintenance Mode By Dazzler: Maintenance mode bypassCVE-2024-1181 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Coming Soon, Under Construction & Maintenance Mode By Dazzler plugin for WordPress is vulnerable to maintenance mode bypass in all versions up to, and including, 2.1.2. This is due to the plugin relying on the REQUEST_URI to determine if the page being accesses is an admin area. This makes it possible for unauthenticated attackers to bypass maintenance mode and access the site which may be considered confidential when in maintenance mode.
Product
Coming Soon, Under Construction & Maintenance Mode By Dazzler
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Coming Soon, Under Construction & Maintenance Mode By Dazzler to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-1586 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default the required authentication level is admin, but administrators have the ability to assign role based access to users as low as subscriber.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.26
What to do
Affects up to 1.26. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2024Schema & Structured Data for WP & AMP: Unauthorized modification of dataCVE-2024-1288 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saswp_reviews_form_render' function in all versions up to, and including, 1.26. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's stored reCaptcha site and secret keys, potentially breaking the reCaptcha functionality.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.26
What to do
Affects up to 1.26. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024Under Construction / Maintenance Mode from Acurax: Sensitive Information ExposureCVE-2024-1476 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6 via the REST API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages when maintenance mode is active thus bypassing the protection provided by the plugin.
Product
Under Construction / Maintenance Mode from Acurax
Affected
up to 2.6
What to do
Affects up to 2.6. Update Under Construction / Maintenance Mode from Acurax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 28, 2024Under Construction / Maintenance Mode from Acurax: Sensitive Information ExposureCVE-2023-6922 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.6 via the 'acx_csma_subscribe_ajax' function. This can allow authenticated attackers to extract sensitive data such as names and email addresses of subscribed visitors.
Product
Under Construction / Maintenance Mode from Acurax
Affected
up to 2.6
What to do
Affects up to 2.6. Update Under Construction / Maintenance Mode from Acurax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Structured Content (JSON-LD) #wpsc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-24839 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc allows Stored XSS.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.6.1.
Product
Structured Content (JSON-LD) #wpsc
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Structured Content (JSON-LD) #wpsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Schema & Structured Data for WP & AMP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51677 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.23.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.23
What to do
Affects up to 1.23. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Schema & Structured Data for WP & AMP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22146 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.25.
Product
Schema & Structured Data for WP & AMP
Affected
up to 1.25
What to do
Affects up to 1.25. Update Schema & Structured Data for WP & AMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WordPress Review & Structure Data Schema Plugin – Review Schema: Unauthorized modification of dataCVE-2024-0836 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress Review & Structure Data Schema Plugin – Review Schema plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtrs_review_edit() function in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary reviews.
Product
WordPress Review & Structure Data Schema Plugin – Review Schema
Affected
up to 2.1.14
What to do
Affects up to 2.1.14. Update WordPress Review & Structure Data Schema Plugin – Review Schema to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 18, 2023Structured Content (JSON-LD) #wpsc: Deserialization of Untrusted DataCVE-2023-49819 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.
Product
Structured Content (JSON-LD) #wpsc
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Structured Content (JSON-LD) #wpsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Structured Content (JSON-LD) #wpsc: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49820 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc allows Stored XSS.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.
Product
Structured Content (JSON-LD) #wpsc
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update Structured Content (JSON-LD) #wpsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2023Metform Elementor Contact Form Builder: Unauthorized permalink structure updateCVE-2023-1843 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Under Construction: Cross-Site Request ForgeryCVE-2023-0832 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the install_weglot function called via the admin_action_install_weglot action. This makes it possible for unauthenticated attackers to perform an unauthorized install of the Weglot Translate plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Under Construction
Affected
up to 3.96
What to do
Affects up to 3.96. Update Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Under Construction: Cross-Site Request ForgeryCVE-2023-0831 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the dismiss_notice function called via the admin_action_ucp_dismiss_notice action. This makes it possible for unauthenticated attackers to dismiss plugin notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Under Construction
Affected
up to 3.96
What to do
Affects up to 3.96. Update Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 21, 2023Markup (JSON-LD) structured in schema.org: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4666 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Markup (JSON-LD) structured in schema.org
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update Markup (JSON-LD) structured in schema.org to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Structured Content: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4715 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Structured Content
Fixed in
1.5.1
What to do
Update Structured Content to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Coming Soon - Under Construction: Does not sanitize and escape some of its settingsCVE-2022-1322 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Coming Soon - Under Construction
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Coming Soon - Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022underConstruction: Does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting itCVE-2022-1896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.
Product
underConstruction
Fixed in
1.21
What to do
Update underConstruction to 1.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022underConstruction: Does not have CSRF check in placeCVE-2022-1895 · WordPress plugins & themes · reported by WPScanMedium 4.3
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Product
underConstruction
Fixed in
1.20
What to do
Update underConstruction to 1.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Product
BookingPress
Fixed in
1.0.11
What to do
Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022CommonsBooking: Does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queriesCVE-2022-0658 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
Product
CommonsBooking
Fixed in
2.6.8
What to do
Update CommonsBooking to 2.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Coming Soon, Under Construction & Maintenance Mode By Dazzler: Does not sanitise or escape its description settingCVE-2021-24539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
Coming Soon, Under Construction & Maintenance Mode By Dazzler
Fixed in
1.6.7
What to do
Update Coming Soon, Under Construction & Maintenance Mode By Dazzler to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 1, 2021The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file.CVE-2021-39320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Product
underConstruction
Affected
up to 1.18
What to do
Affects up to 1.18. Update underConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
Jul 30, 2021The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher CVE-2020-11511 · WordPress plugins & themes · reported by MITREHigh 8.1
The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.
Product
LearnPress
Fixed in
3.2.6.9
What to do
Update LearnPress to 3.2.6.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com cwe.mitre.org
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin befCVE-2021-24191 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
Product
WP Maintenance Mode & Site Under Construction
Fixed in
1.8.2
What to do
Update WP Maintenance Mode & Site Under Construction to 1.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · WordPress plugins & themes · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.8.8
What to do
Update Tutor LMS – eLearning and online course solution to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 4, 2020A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malCVE-2020-8615 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
Product
A CSRF vulnerability in the Tutor LMS
Fixed in
1.5.3
What to do
Update A CSRF vulnerability in the Tutor LMS to 1.5.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Aug 12, 2019The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.CVE-2019-14948 · WordPress plugins & themes · reported by MITREMedium 5.4
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
Product
woocommerce-product-addon
Fixed in
18.4
What to do
Update woocommerce-product-addon to 18.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Oct 19, 2017The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, reCVE-2015-6668 · WordPress plugins & themes · reported by MITREHigh 7.5
The Job Manager plugin before 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.
Product
Job Manager
Fixed in
0.7.25
What to do
Update Job Manager to 0.7.25 or newer.
Full record and what to do →NVD record vagmour.eu wpvulndb.com
Jul 10, 2014Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2014-4854 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuc_logo parameter in a save action to wp-admin/admin.php.
Product
WP Construction Mode
Affected
1.8 to 1.8
What to do
Affects 1.8 to 1.8. Update WP Construction Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Apr 10, 2014Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack the authentication oCVE-2013-2699 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the underConstruction plugin before 1.09 for WordPress allows remote attackers to hijack the authentication of administrators for requests that deactivate a plugin via unspecified vectors.
Product
Cross-site request forgery (CSRF) vulnerability in the underConstruction
Fixed in
1.09
What to do
Update Cross-site request forgery (CSRF) vulnerability in the underConstruction to 1.09 or newer.
Full record and what to do →NVD record osvdb.org secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.