Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
62 results · page 2 of 2
Apr 18, 2022Thank Me Later: Does not sanitise and escape the Message Subject field before outputting it in the Messages listCVE-2022-1063 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Thank Me Later
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Thank Me Later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2021BP Better Messages: Does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chatCVE-2021-24809 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions
- Product
- BP Better Messages
- Fixed in
- 1.9.9.41
- What to do
- Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021BP Better Messages: Sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attributeCVE-2021-24808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- BP Better Messages
- Fixed in
- 1.9.9.41
- What to do
- Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 11, 2021Comments – wpDiscuz: Does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the pageCVE-2021-24737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Comments – wpDiscuz
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021Light Messages: Is lacking CSRF checkCVE-2021-24535 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin's settings), or both frontend and backend.
- Product
- Light Messages
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Light Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2021A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in thCVE-2020-26153 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
- Fixed in
- 4.10.7.p
- What to do
- Update the plugin to 4.10.7.p or newer.
Full record and what to do →NVD recordgithub.comlabs.nettitude.com
May 6, 2021The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX aCVE-2021-24246 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscout_send_message_chat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues
- Product
- Workscout Core
- Fixed in
- 1.3.4
- What to do
- Update Workscout Core to 1.3.4 or newer.
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.CVE-2015-9317 · WordPress plugins & themes · reported by MITREMedium 6.1
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
- Product
- awesome-support
- Fixed in
- 3.1.7
- What to do
- Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Feb 17, 2019The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.CVE-2018-20782 · WordPress plugins & themes · reported by MITREHigh 7.5
The GloBee plugin before 1.1.2 for WooCommerce mishandles IPN messages.
- Product
- GloBee
- Fixed in
- 1.1.2
- What to do
- Update GloBee to 1.1.2 or newer.
Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allCVE-2014-4583 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) order_direction, (3) limit_start, (4) id, or (5) order parameter.
- Product
- WP-Contact (wp-contact-sidebar-widget)
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP-Contact (wp-contact-sidebar-widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameteCVE-2011-4898 · WordPress plugins & themes · reported by MITREMedium 5
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com
Jan 8, 2007wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive informaCVE-2007-0109 · WordPress plugins & themes · reported by MITREMedium 5
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.