Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

1,507 results · page 23 of 31

Dec 6, 2021LoginWP (Formerly Peter's Login Redirect): Does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin pageCVE-2021-24939 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
LoginWP (Formerly Peter's Login Redirect)
Fixed in
3.0.0.5
What to do
Update LoginWP (Formerly Peter's Login Redirect) to 3.0.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WOOCS: Does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24938 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue
Product
WOOCS
Fixed in
1.3.7.1
What to do
Update WOOCS to 1.3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WP Google Fonts: Does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributesCVE-2021-24935 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues
Product
WP Google Fonts
Fixed in
3.1.5
What to do
Update WP Google Fonts to 3.1.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021Secure Copy Content Protection and Content Locking: Does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SCVE-2021-24931 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.
Product
Secure Copy Content Protection and Content Locking
Fixed in
2.8.2
What to do
Update Secure Copy Content Protection and Content Locking to 2.8.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Dec 6, 2021Email Log: Does not escape the d parameter before outputting it back in an attribute in the Log pageCVE-2021-24924 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue
Product
Email Log
Fixed in
2.4.8
What to do
Update Email Log to 2.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WP Data Access: Does not properly sanitise and escape the backup_date parameter before using it a SQL statementCVE-2021-24866 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion
Product
WP Data Access
Fixed in
5.0.0
What to do
Update WP Data Access to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 1, 2021Events Manager: Does not sanitise and escape some search parameter before outputing them in pagesCVE-2020-35037 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues
Product
Events Manager
Fixed in
5.9.8
What to do
Update Events Manager to 5.9.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 1, 2021Events Manager: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2020-35012 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to an SQL Injection
Product
Events Manager
Fixed in
5.9.8
What to do
Update Events Manager to 5.9.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 29, 2021My Calendar: Does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24927 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
My Calendar
Fixed in
3.2.18
What to do
Update My Calendar to 3.2.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Contest Gallery: Does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statementCVE-2021-24915 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address
Product
Contest Gallery
Fixed in
13.1.0.6
What to do
Update Contest Gallery to 13.1.0.6 or newer.
Full record and what to do →NVD record gist.github.com wpscan.com
Nov 29, 2021Check & Log Email: Does not escape the d parameter before outputting it back in an attributeCVE-2021-24908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Check & Log Email
Fixed in
1.0.4
What to do
Update Check & Log Email to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
Product
Ninja Forms Contact Form
Fixed in
3.6.4
What to do
Update Ninja Forms Contact Form to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Registrations for the Events Calendar: Does not escape the v parameter before outputting it back in an attributeCVE-2021-24876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Registrations for the Events Calendar
Fixed in
2.7.5
What to do
Update Registrations for the Events Calendar to 2.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021BSK PDF Manager: Does not validate and escape the orderby and order parameters before using them in a SQL statementCVE-2021-24860 · WordPress plugins & themes · reported by WPScanHigh 7.2
The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue
Product
BSK PDF Manager
Fixed in
3.1.2
What to do
Update BSK PDF Manager to 3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021myCred: Does not validate or escape the fields parameter before using it in a SQL statementCVE-2021-24755 · WordPress plugins & themes · reported by WPScanHigh 8.8
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user
Product
myCred
Fixed in
2.3
What to do
Update myCred to 2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Email Before Download: Does not properly validate and escape the order and orderby GET parameters before using them in SQL statementsCVE-2021-24748 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
Product
Email Before Download
Fixed in
6.8
What to do
Update Email Before Download to 6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021myCred: Does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboardCVE-2017-20008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting
Product
myCred
Fixed in
1.7.8
What to do
Update myCred to 1.7.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 26, 2021Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id,CVE-2021-36919 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 23, 2021MainWP Child: Does not validate the orderby and order parameter before using them in a SQL statementCVE-2021-24877 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
Product
MainWP Child
Fixed in
4.1.8
What to do
Update MainWP Child to 4.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021eCommerce Product Catalog Plugin for: Does not escape the ic-settings-search parameter before outputting it back in the page in an attributeCVE-2021-24875 · WordPress plugins & themes · reported by WPScanMedium 6.1
The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
eCommerce Product Catalog Plugin for
Fixed in
3.0.39
What to do
Update eCommerce Product Catalog Plugin for to 3.0.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021Images to WebP: Does not validate or sanitise the tab parameter before passing it to the include() functionCVE-2021-24644 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to a Local File Inclusion issue
Product
Images to WebP
Fixed in
1.9
What to do
Update Images to WebP to 1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021Stream: Does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statementCVE-2021-24772 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue.
Product
Stream
Fixed in
3.8.2
What to do
Update Stream to 3.8.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Affiliates Manager: Does not validate the orderby parameter before using it in an SQL statement in the admin dashboardCVE-2021-24844 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue
Product
Affiliates Manager
Fixed in
2.8.7
What to do
Update Affiliates Manager to 2.8.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021WP Header Images: Does not sanitise and escape the t parameter before outputting it back in the plugin's settings pageCVE-2021-24798 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page, leading to a Reflected Cross-Site Scripting issue
Product
WP Header Images
Fixed in
2.0.1
What to do
Update WP Header Images to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Header Footer Code Manager: Does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statementCVE-2021-24791 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections
Product
Header Footer Code Manager
Fixed in
1.1.14
What to do
Update Header Footer Code Manager to 1.1.14 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Simple Download Monitor: Does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributesCVE-2021-24697 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Simple Download Monitor
Fixed in
3.9.5
What to do
Update Simple Download Monitor to 3.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021MAZ Loader – Preloader Builder for: Does not validate or escape the loader_id parameter of the mzldr shortcodeCVE-2021-24669 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection.
Product
MAZ Loader – Preloader Builder for
Fixed in
1.3.3
What to do
Update MAZ Loader – Preloader Builder for to 1.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Unlimited PopUps: Does not sanitise or escape the did GET parameter before using it in a SQL statementCVE-2021-24631 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection
Product
Unlimited PopUps
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update Unlimited PopUps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 8, 2021Schreikasten: Does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actionsCVE-2021-24630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
Product
Schreikasten
Affected
up to 0.14.18
What to do
Affects up to 0.14.18. Update Schreikasten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 8, 2021Post Content XMLRPC: Does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboardCVE-2021-24629 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
Product
Post Content XMLRPC
Affected
up to 1.0
What to do
Affects up to 1.0. Update Post Content XMLRPC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 8, 2021Wow Forms: Does not sanitise or escape a 'did' GET parameter before using it in a SQL statementCVE-2021-24628 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection
Product
Wow Forms
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Wow Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 8, 2021G Auto-Hyperlink: Does not sanitise or escape an 'id' GET parameter before using it in a SQL statementCVE-2021-24627 · WordPress plugins & themes · reported by WPScanHigh 7.2
The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection
Product
G Auto-Hyperlink
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update G Auto-Hyperlink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 8, 2021SpiderCatalog: Does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statementCVE-2021-24625 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category
Product
SpiderCatalog
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update SpiderCatalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 1, 2021BP Better Messages: Sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attributeCVE-2021-24808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
BP Better Messages
Fixed in
1.9.9.41
What to do
Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 25, 2021YOP Poll: Does not escape the perpage parameter before outputting it back in an attributeCVE-2021-24885 · WordPress plugins & themes · reported by WPScanMedium 6.1
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
YOP Poll
Fixed in
6.1.2
What to do
Update YOP Poll to 6.1.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 25, 2021Check & Log Email: Does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statementCVE-2021-24774 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
Product
Check & Log Email
Fixed in
1.0.3
What to do
Update Check & Log Email to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Permalink Manager Lite: Does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager pageCVE-2021-24769 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection
Product
Permalink Manager Lite
Fixed in
2.2.13.1
What to do
Update Permalink Manager Lite to 2.2.13.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Game Server Status: Does not validate or escape the server_id parameter before using it in SQL statementCVE-2021-24662 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authenticated SQL Injection in an admin page
Product
Game Server Status
Affected
up to 1.0
What to do
Affects up to 1.0. Update Game Server Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Video Player for YouTube: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24414 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Player for YouTube WordPress plugin before 1.4 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Product
Video Player for YouTube
Fixed in
1.4
What to do
Update Video Player for YouTube to 1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021MainWP Child Reports: Does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboardCVE-2021-24754 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue
Product
MainWP Child Reports
Fixed in
2.0.8
What to do
Update MainWP Child Reports to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021GamePress: Does not escape the op_edit POST parameter before outputting it back in multiple Game Option pagesCVE-2021-24617 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues
Product
GamePress
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update GamePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021StreamCast – Radio Player for: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24416 · WordPress plugins & themes · reported by WPScanMedium 5.4
The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Product
StreamCast – Radio Player for
Fixed in
2.1.1
What to do
Update StreamCast – Radio Player for to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Polo Video Gallery – Best wordpress video gallery: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24415 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Product
Polo Video Gallery – Best wordpress video gallery
Affected
up to 1.2
What to do
Affects up to 1.2. Update Polo Video Gallery – Best wordpress video gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Easy Twitter Feed: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24413 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Product
Easy Twitter Feed
Fixed in
1.2
What to do
Update Easy Twitter Feed to 1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Html5 Audio Player – Audio Player for: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24412 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Product
Html5 Audio Player – Audio Player for
Fixed in
2.1.3
What to do
Update Html5 Audio Player – Audio Player for to 2.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021Bitcoin / AltCoin Payment Gateway for WooCommerce: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
Product
Bitcoin / AltCoin Payment Gateway for WooCommerce
Fixed in
1.6.1
What to do
Update Bitcoin / AltCoin Payment Gateway for WooCommerce to 1.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021Better Find and Replace: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24676 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
Product
Better Find and Replace
Fixed in
1.2.9
What to do
Update Better Find and Replace to 1.2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not escape the message parameter before outputting it back in the admin dashboardCVE-2021-24632 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Recipe Card Blocks by WPZOOM
Fixed in
2.8.1
What to do
Update Recipe Card Blocks by WPZOOM to 2.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Support Board: Does not escape multiple POST parameters (suchCVE-2021-24741 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
Product
Support Board
Fixed in
3.3.4
What to do
Update Support Board to 3.3.4 or newer.
Full record and what to do →NVD record board.support medium.com
Sep 20, 2021OMGF: Does not escape or validate the handle parameter of the REST APICVE-2021-24638 · WordPress plugins & themes · reported by WPScanCritical 9.1
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
Product
OMGF
Fixed in
4.5.4
What to do
Update OMGF to 4.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.