Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

1,207 results · page 21 of 25

Mar 21, 2022Simple Link Directory: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0760 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Product
Simple Link Directory
Fixed in
7.7.2
What to do
Update Simple Link Directory to 7.7.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022Infographic Maker: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0747 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Product
Infographic Maker
Fixed in
4.3.8
What to do
Update Infographic Maker to 4.3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022Advanced Booking Calendar: Does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated useCVE-2022-0694 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Product
Advanced Booking Calendar
Fixed in
1.7.0
What to do
Update Advanced Booking Calendar to 1.7.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022FormCraft: Does not validate the URL parameter in the formcraft3_get AJAX actionCVE-2022-0591 · WordPress plugins & themes · reported by WPScanCritical 9.1
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
Product
FormCraft
Fixed in
3.8.28
What to do
Update FormCraft to 3.8.28 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022WordPress Multisite Content Copier/Updater: Does not sanitise and escape the s parameter before outputting it back in an attributeCVE-2022-0503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in the network dashboard
Product
WordPress Multisite Content Copier/Updater
Fixed in
2.1.2
What to do
Update WordPress Multisite Content Copier/Updater to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Event Manager and Tickets Selling for WooCommerce: Does not validate and escape the post_author_gutenberg parameter before using it in a SQL statementCVE-2022-0478 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacks
Product
Event Manager and Tickets Selling for WooCommerce
Fixed in
3.5.8
What to do
Update Event Manager and Tickets Selling for WooCommerce to 3.5.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Product
Photo Gallery by 10Web
Fixed in
1.6.0
What to do
Update Photo Gallery by 10Web to 1.6.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX actCVE-2022-0165 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
Product
Page Builder KingComposer
Affected
up to 2.9.6
What to do
Affects up to 2.9.6. Update Page Builder KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022MOLIE: Does not validate and escape a post parameter before using in a SQL statementCVE-2021-25007 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection
Product
MOLIE
Affected
up to 0.5
What to do
Affects up to 0.5. Update MOLIE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Error Log Viewer: Does not validate the path of the log file to clearCVE-2021-24966 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder
Product
Error Log Viewer
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Error Log Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022MasterStudy LMS: Does to validate some parameters givenCVE-2022-0441 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin
Product
MasterStudy LMS
Fixed in
2.7.6
What to do
Update MasterStudy LMS to 2.7.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022Catch Themes Demo Import: Does not validate one of the file to be importedCVE-2022-0440 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)
Product
Catch Themes Demo Import
Fixed in
2.1.1
What to do
Update Catch Themes Demo Import to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022White Label CMS: Does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewingCVE-2022-0422 · WordPress plugins & themes · reported by WPScanMedium 6.1
The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue
Product
White Label CMS
Fixed in
2.2.9
What to do
Update White Label CMS to 2.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022WordPress Multisite Content Copier/Updater: Does not sanitise and escape the wmcc_content_typeCVE-2021-25039 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
WordPress Multisite Content Copier/Updater
Fixed in
2.1.0
What to do
Update WordPress Multisite Content Copier/Updater to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022Custom Content Shortcode: Does not validate the data passed to its load shortcodeCVE-2021-24825 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to display arbitrary files from the filesystem (such as logs, .htaccess etc), as well as perform Local File Inclusion attacks as PHP files will be executed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when either the unfiltered_html or file_edit is disallowed)
Product
Custom Content Shortcode
Fixed in
4.0.2
What to do
Update Custom Content Shortcode to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022All-in-One WP Migration: Does not validate uploaded files' extensionCVE-2021-24216 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations.
Product
All-in-One WP Migration
Fixed in
7.41
What to do
Update All-in-One WP Migration to 7.41 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Testimonial: Does not validate and escape the id parameter before using it in a SQL statementCVE-2022-23911 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection
Product
Testimonial
Fixed in
1.4.7
What to do
Update Testimonial to 1.4.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022WP Visitor Statistics (Real Time Traffic): Does not have authorisation and CSRF checks in the updateIpAddress AJAX actionCVE-2021-25042 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
5.5
What to do
Update WP Visitor Statistics (Real Time Traffic) to 5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WP Responsive Menu: Does not have capability and CSRF checks in the wpr_live_update AJAX actionCVE-2021-24971 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin's settings and perform Cross-Site Scripting attacks against all visitor and users on the frontend
Product
WP Responsive Menu
Fixed in
3.1.7.1
What to do
Update WP Responsive Menu to 3.1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (veCVE-2022-23983 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).
Affected
up to 3.4.4
What to do
Affects up to 3.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Product
Popup Builder
Fixed in
4.0.7
What to do
Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Popup Builder: Does not validate and sanitise the sgpb_type parameter before using it in a require statementCVE-2021-25082 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
Product
Popup Builder
Fixed in
4.0.7
What to do
Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 17, 2022The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nCVE-2022-0633 · WordPress plugins & themes · reported by WPScanMedium 6.5
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
Fixed in
1.22.3
What to do
Update the plugin to 1.22.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com jetpack.com
Feb 14, 2022WordPress Newsletter: Does not validate the to parameter before redirecting the user to its given valueCVE-2021-25033 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
Product
WordPress Newsletter
Fixed in
1.6.5
What to do
Update WordPress Newsletter to 1.6.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022SupportCandy: Does not validate and escape the page attribute of its shortcodeCVE-2021-24880 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Essential Addons for Elementor: Does not validate and sanitise some template data before it them in include statementsCVE-2022-0320 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.
Product
Essential Addons for Elementor
Fixed in
5.0.5
What to do
Update Essential Addons for Elementor to 5.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Perfect Survey: Does not validate and escape the X-Forwarded-For header value before outputting it in the statistic pageCVE-2021-24765 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue
Product
Perfect Survey
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Perfect Survey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Perfect Survey: Does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX actionCVE-2021-24762 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
Product
Perfect Survey
Fixed in
1.5.2
What to do
Update Perfect Survey to 1.5.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jan 24, 2022Contact Form Entries: Does not validateCVE-2021-25080 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry
Product
Contact Form Entries
Fixed in
1.1.7
What to do
Update Contact Form Entries to 1.1.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Affiliates Manager: Does not validateCVE-2021-25078 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
Product
Affiliates Manager
Fixed in
2.9.0
What to do
Update Affiliates Manager to 2.9.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022WP User Frontend: Does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboardCVE-2021-25076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
Product
WP User Frontend
Fixed in
3.5.26
What to do
Update WP User Frontend to 3.5.26 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jan 24, 2022Asgaros Forum: Does not validate or escape the forum_id parameter before using it in a SQL statementCVE-2021-25045 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in a SQL statement when editing a forum, leading to an SQL injection issue
Product
Asgaros Forum
Fixed in
1.15.15
What to do
Update Asgaros Forum to 1.15.15 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 24, 2022Event Tickets: Does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given valueCVE-2021-25028 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue
Product
Event Tickets
Fixed in
5.2.2
What to do
Update Event Tickets to 5.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the sib-statistics-date parameter before outputting it back in an attributeCVE-2021-24923 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Fixed in
3.1.25
What to do
Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Advanced Custom Fields: Extended: Does not validate the order and orderby parameters before using them in a SQL statementCVE-2021-24865 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
Product
Advanced Custom Fields: Extended
Fixed in
0.8.8.7
What to do
Update Advanced Custom Fields: Extended to 0.8.8.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 10, 2022Plus Addons for Elementor - Pro: Does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX actionCVE-2021-24948 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts
Product
Plus Addons for Elementor - Pro
Fixed in
5.0.7
What to do
Update Plus Addons for Elementor - Pro to 5.0.7 or newer.
Full record and what to do →NVD record roadmap.theplusaddons.com wpscan.com
Jan 3, 2022OMGF | Host Google Fonts Locally: Does not validate the cache directory settingCVE-2021-25021 · WordPress plugins & themes · reported by WPScanMedium 4.9
The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
Product
OMGF | Host Google Fonts Locally
Fixed in
4.5.12
What to do
Update OMGF | Host Google Fonts Locally to 4.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022CAOS | Host Google Analytics Locally: Does not validate the cache directory settingCVE-2021-25020 · WordPress plugins & themes · reported by WPScanMedium 4.9
The CAOS | Host Google Analytics Locally WordPress plugin before 4.1.9 does not validate the cache directory setting, allowing high privilege users to use a path traversal vector and delete arbitrary folders when uninstalling the plugin
Product
CAOS | Host Google Analytics Locally
Fixed in
4.1.9
What to do
Update CAOS | Host Google Analytics Locally to 4.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Stars Rating: Does not validate the submitted ratingCVE-2021-24893 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated.
Product
Stars Rating
Fixed in
3.5.1
What to do
Update Stars Rating to 3.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Download Monitor: Does not properly validate and escape the "orderby" GET parameter before using it in a SQL statementCVE-2021-24786 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
Product
Download Monitor
Fixed in
4.4.5
What to do
Update Download Monitor to 4.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Rich Reviews by Starfish: Does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statementCVE-2021-24753 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
Product
Rich Reviews by Starfish
Fixed in
1.9.6
What to do
Update Rich Reviews by Starfish to 1.9.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 21, 2021Blog2Social: Social Media Auto Post & Scheduler: Does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin pageCVE-2021-24956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
Blog2Social: Social Media Auto Post & Scheduler
Fixed in
6.8.7
What to do
Update Blog2Social: Social Media Auto Post & Scheduler to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021Logo Carousel: Does not validate and escape the "Logo Margin" carousel optionCVE-2021-24738 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
Logo Carousel
Fixed in
3.4.2
What to do
Update Logo Carousel to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2021Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPreCVE-2021-36888 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
Affected
up to 9.6.1
What to do
Affects up to 9.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 13, 2021All-in-One Video Gallery: Does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboardCVE-2021-24970 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue
Product
All-in-One Video Gallery
Fixed in
2.5.0
What to do
Update All-in-One Video Gallery to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Quotes Collection: Does not validate and escape the bulkcheck parameter before using it in a SQL statementCVE-2021-24861 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement, leading to a SQL injection
Product
Quotes Collection
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Quotes Collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WOOCS: Does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24938 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue
Product
WOOCS
Fixed in
1.3.7.1
What to do
Update WOOCS to 1.3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WP Data Access: Does not properly sanitise and escape the backup_date parameter before using it a SQL statementCVE-2021-24866 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion
Product
WP Data Access
Fixed in
5.0.0
What to do
Update WP Data Access to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021BSK PDF Manager: Does not validate and escape the orderby and order parameters before using them in a SQL statementCVE-2021-24860 · WordPress plugins & themes · reported by WPScanHigh 7.2
The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue
Product
BSK PDF Manager
Fixed in
3.1.2
What to do
Update BSK PDF Manager to 3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Bulk Datetime Change: Does not enforce capability checksCVE-2021-24842 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.
Product
Bulk Datetime Change
Fixed in
1.12
What to do
Update Bulk Datetime Change to 1.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.