Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
64 results · page 2 of 2
Apr 11, 2022Portfolio Gallery, Product Catalog: Does not have authorisation and CSRF checks in various functions related to AJAX actionsCVE-2021-25090 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
- Product
- Portfolio Gallery, Product Catalog
- Fixed in
- 2.1.0
- What to do
- Update Portfolio Gallery, Product Catalog to 2.1.0 or newer.
Apr 4, 2022Insights from Google PageSpeed: Does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboardCVE-2022-0431 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
- Product
- Insights from Google PageSpeed
- Fixed in
- 4.0.4
- What to do
- Update Insights from Google PageSpeed to 4.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Simple Quotation: Does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user dataCVE-2022-22735 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks
- Product
- Simple Quotation
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Simple Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Flexi: Does not sanitise and escape various parameters before outputting them back in some pages suchCVE-2022-0449 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Flexi
- Fixed in
- 4.20
- What to do
- Update Flexi to 4.20 or newer.
Jan 24, 2022Contact Form Entries: Does not sanitise and escape various parametersCVE-2021-25079 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
- Product
- Contact Form Entries
- Fixed in
- 1.2.4
- What to do
- Update Contact Form Entries to 1.2.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022WP125: Does not have CSRF checks in various actionCVE-2021-25073 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack
- Product
- WP125
- Fixed in
- 1.5.5
- What to do
- Update WP125 to 1.5.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Mobile Events Manager: Does not sanitise and escape various of its settingsCVE-2021-25049 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mobile Events Manager WordPress plugin before 1.4.4 does not sanitise and escape various of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Mobile Events Manager
- Fixed in
- 1.4.4
- What to do
- Update Mobile Events Manager to 1.4.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 27, 2021WordPress Download Manager: Does not sanitise and escape Template data before outputting it in various pages (suchCVE-2021-24969 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
- Product
- WordPress Download Manager
- Fixed in
- 3.2.22
- What to do
- Update WordPress Download Manager to 3.2.22 or newer.
Nov 8, 2021Schreikasten: Does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actionsCVE-2021-24630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
- Product
- Schreikasten
- Affected
- up to 0.14.18
- What to do
- Affects up to 0.14.18. Update Schreikasten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 8, 2021Translate WordPress – Google Language Translator: Does not sanitise and escape some of its settings before outputting it in various pagesCVE-2021-24594 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Translate WordPress – Google Language Translator
- Fixed in
- 6.0.12
- What to do
- Update Translate WordPress – Google Language Translator to 6.0.12 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
- Product
- LearnPress
- Fixed in
- 4.1.3.1
- What to do
- Update LearnPress to 4.1.3.1 or newer.
May 14, 2021In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the pluCVE-2021-24282 · WordPress plugins & themes · reported by WPScanMedium 6.3
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more.
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.3.4
- What to do
- Update Redirection for Contact Form 7 to 2.3.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Aug 10, 2011Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."CVE-2011-3125 · WordPress plugins & themes · reported by MITREHigh 10
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."
- Fixed in
- 3.1.3
- What to do
- Update the plugin to 3.1.3 or newer.
Full record and what to do →NVD recordsecunia.comwordpress.org
Jul 6, 2006WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-contentCVE-2006-3390 · WordPress plugins & themes · reported by MITREMedium 5
WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordsecunia.comsecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.