Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

1,031 results · page 21 of 21

Sep 27, 2021WP Map Block: Does not escape some attributes of the WP Map BlockCVE-2021-24643 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Product
WP Map Block
Fixed in
1.2.3
What to do
Update WP Map Block to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not properly sanitise or escape some of the properties of the Recipe Card Block (suchCVE-2021-24634 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
Product
Recipe Card Blocks by WPZOOM
Fixed in
2.8.3
What to do
Update Recipe Card Blocks by WPZOOM to 2.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021Countdown Block: Does not have authorisation in the eb_write_block_css AJAX actionCVE-2021-24633 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.
Product
Countdown Block
Fixed in
1.1.2
What to do
Update Countdown Block to 1.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not escape the message parameter before outputting it back in the admin dashboardCVE-2021-24632 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Recipe Card Blocks by WPZOOM
Fixed in
2.8.1
What to do
Update Recipe Card Blocks by WPZOOM to 2.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2021WordPress iQ Block Country: Authenticated Persistent Cross-Site Scripting (XSS)CVE-2021-36873 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable parameter: &blockcountry_blockmessage.
Product
WordPress iQ Block Country
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update WordPress iQ Block Country to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 20, 2021The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as lCVE-2021-24640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
WordPress Slider Block Gutenslider
Fixed in
5.2.0
What to do
Update WordPress Slider Block Gutenslider to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Google Fonts Typography: Does not escape and sanitise some of its block settingsCVE-2021-24637 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
Product
Google Fonts Typography
Fixed in
3.0.3
What to do
Update Google Fonts Typography to 3.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2021.18
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2021.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below).CVE-2021-24667 · WordPress plugins & themes · reported by WPScanMedium 5.4
A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below). The vulnerability exists in the Lightbox functionality where a user with low privileges is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of image parameters in meta data.
Fixed in
2.2.1
What to do
Update the plugin to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com fortiguard.com
Aug 12, 2021Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.CVE-2021-28121 · WordPress plugins & themes · reported by MITRECritical 9.8
Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.
Fixed in
1.10
What to do
Update the plugin to 1.10 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 9, 2021Newsmag: Does not sanitise the td_block_id parameter in its td_ajax_block AJAX actionCVE-2021-24304 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsmag WordPress theme before 5.0 does not sanitise the td_block_id parameter in its td_ajax_block AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
Product
Newsmag
Fixed in
5.0
What to do
Update Newsmag to 5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021get_reports() function in the Secure Copy Content Protection and Content Locking: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24484 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_reports() function in the Secure Copy Content Protection and Content Locking
Fixed in
2.6.7
What to do
Update get_reports() function in the Secure Copy Content Protection and Content Locking to 2.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 26, 2021woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks.CVE-2021-32789 · WordPress plugins & themes · reported by GitHubHigh 7.5
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript blockCVE-2021-24373 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
Product
WP Hardening – Fix Your WordPress Security
Fixed in
1.2.2
What to do
Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 5, 2021Elementor – Header, Footer & Blocks Template: Has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24256 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor – Header, Footer & Blocks Template
Fixed in
1.5.8
What to do
Update Elementor – Header, Footer & Blocks Template to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021WooCommerce Upload Files: Ran a single sanitization pass to remove blocked extensions suchCVE-2021-24171 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter.
Product
WooCommerce Upload Files
Fixed in
59.4
What to do
Update WooCommerce Upload Files to 59.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jan 6, 2021The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conducCVE-2012-10001 · WordPress plugins & themes · reported by MITRECritical 9.8
The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts.
Product
Limit Login Attempts
Fixed in
1.7.1
What to do
Update Limit Login Attempts to 1.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jun 12, 2020In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML CVE-2020-4046 · WordPress plugins & themes · reported by GitHubMedium 5.4
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Apr 30, 2020In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor.CVE-2020-11030 · WordPress plugins & themes · reported by GitHubMedium 6.4
In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com wordpress.org
Dec 27, 2019WordPress Xorbin Digital Flash Clock 1.0 has XSSCVE-2013-4693 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress Xorbin Digital Flash Clock 1.0 has XSS
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 26, 2019In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed withiCVE-2019-16781 · WordPress plugins & themes · reported by GitHubMedium 5.8
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
Fixed in
5.3.1
What to do
Update the plugin to 5.3.1 or newer.
Full record and what to do →NVD record github.com hackerone.com
Dec 26, 2019WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the CVE-2019-16780 · WordPress plugins & themes · reported by GitHubMedium 5.8
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Dec 4, 2019The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.CVE-2019-19589 · WordPress plugins & themes · reported by MITRECritical 9.8
The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerability reported in PDF Embedder Plugin is not valid as the plugin itself doesn't control or manage the file upload process. It only serves the uploaded PDF files and the responsibility of uploading PDF file remains with the Site owner of Wordpress installation, the upload of PDF file is managed by Wordpress core and not by PDF Embedder Plugin. Control & block of polyglot file is required to be taken care at the time of upload, not on showing the file. Moreover, the reference mentions retrieving the files from the browser cache and manually renaming it to jar for executing the file. That refers to a two step non-connected steps which has nothing to do with PDF Embedder.
Affected
4.4 to 4.4
What to do
Affects 4.4 to 4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record sejalivre.org wordpress.org
Sep 25, 2019The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallockeCVE-2015-9425 · WordPress plugins & themes · reported by MITREMedium 5.4
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.
Product
social-locker
Fixed in
4.2.5
What to do
Update social-locker to 4.2.5 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org
Aug 30, 2019The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.CVE-2019-15829 · WordPress plugins & themes · reported by MITREMedium 4.8
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.
Product
photoblocks-grid-gallery
Fixed in
1.1.33
What to do
Update photoblocks-grid-gallery to 1.1.33 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 29, 2019The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.CVE-2018-21007 · WordPress plugins & themes · reported by MITRECritical 9.8
The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.
Product
woo-confirmation-email
Fixed in
3.2.0
What to do
Update woo-confirmation-email to 3.2.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 13, 2019The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.CVE-2015-9293 · WordPress plugins & themes · reported by MITREMedium 6.1
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Product
all-in-one-wp-security-and-firewall
Fixed in
3.9.8
What to do
Update all-in-one-wp-security-and-firewall to 3.9.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Dec 19, 2017The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php.CVE-2017-17780 · WordPress plugins & themes · reported by MITREMedium 6.1
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Dec 1, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Server-side request forgery (SSRF)CVE-2014-8749 · WordPress plugins & themes · reported by MITREMedium 5
Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
Affected
up to .51
What to do
Affects up to .51. Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org wordpress.org
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: SQL injectionCVE-2014-7959 · WordPress plugins & themes · reported by MITREMedium 6.5
SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
What to do
Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 6, 2014admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for: Cross-site scripting (XSS)CVE-2014-7958 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost parameter.
Product
admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for
What to do
Update admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for to the newest version.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.