Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

496new WordPress flaws this week

394,829entries in the database

12,551 results · page 238 of 252

Aug 16, 2021Smart Email Alerts: Reflected Cross-Site ScriptingCVE-2021-34642 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the api_key in the ~/views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10.
Product
Smart Email Alerts
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Smart Email Alerts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 16, 2021SEOPress: Stored Cross-Site-ScriptingCVE-2021-34641 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.
Product
SEOPress
Affected
5.0.0 to 5.0.3
What to do
Affects 5.0.0 to 5.0.3. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 16, 2021Mimetic Books: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings pageCVE-2021-24548 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page.
Product
Mimetic Books
Affected
up to 0.2.13
What to do
Affects up to 0.2.13. Update Mimetic Books to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Video Posts Webcam Recorder: Has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videosCVE-2021-24512 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
Product
Video Posts Webcam Recorder
Fixed in
3.2.4
What to do
Update Video Posts Webcam Recorder to 3.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 11, 2021Securimage-WP-Fixed: Reflected Cross-Site ScriptingCVE-2021-34640 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4.
Product
Securimage-WP-Fixed
Affected
up to 3.5.4
What to do
Affects up to 3.5.4. Update Securimage-WP-Fixed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 9, 2021WP Fusion Lite: Reflected Cross-Site ScriptingCVE-2021-34660 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Fusion Lite WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the ~/includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.37.18.
Product
WP Fusion Lite
Affected
up to 3.37.18
What to do
Affects up to 3.37.18. Update WP Fusion Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2021Poll Maker: Reflected Cross-Site ScriptingCVE-2021-34635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8.
Product
Poll Maker
Affected
up to 3.2.8
What to do
Affects up to 3.2.8. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2021Leaflet Map: Does not escape some shortcode attributes before they are used in JavaScript code or HTMLCVE-2021-24468 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues
Product
Leaflet Map
Fixed in
3.0.0
What to do
Update Leaflet Map to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021TaxoPress – Create and Manage Taxonomies, Tags, Categories: Does not sanitise its Taxonomy description fieldCVE-2021-24444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.
Product
TaxoPress – Create and Manage Taxonomies, Tags, Categories
Fixed in
3.0.7.2
What to do
Update TaxoPress – Create and Manage Taxonomies, Tags, Categories to 3.0.7.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jul 19, 2021W3 Total Cache: Was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboardCVE-2021-24452 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Product
W3 Total Cache
Fixed in
2.1.5
What to do
Update W3 Total Cache to 2.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 19, 2021W3 Total Cache: Was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboardCVE-2021-24436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Product
W3 Total Cache
Fixed in
2.1.4
What to do
Update W3 Total Cache to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 13, 2021A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in thCVE-2020-26153 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Fixed in
4.10.7.p
What to do
Update the plugin to 4.10.7.p or newer.
Full record and what to do →NVD record github.com labs.nettitude.com
Jul 7, 2021Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitCVE-2020-24145 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action.
Product
CM Download Manager (aka cm-download-manager)
Affected
2.7.0 to 2.7.0
What to do
Affects 2.7.0 to 2.7.0. Update CM Download Manager (aka cm-download-manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scriptCVE-2021-34625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021WP Fluent Forms plugin < 3.6.67: Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege EscalationCVE-2021-34620 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
Product
WP Fluent Forms plugin < 3.6.67
What to do
Update WP Fluent Forms plugin < 3.6.67 to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 27, 2021WordPress Popular Posts 5.3.2 and earlier: Cross-site scriptingCVE-2021-20746 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Product
WordPress Popular Posts 5.3.2 and earlier
Affected
up to 5.3.2
What to do
Affects up to 5.3.2. Update WordPress Popular Posts 5.3.2 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cabrerahector.com cabrerahector.com
Jun 21, 2021WP Hardening – Fix Your WordPress Security: Did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript blockCVE-2021-24373 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hardening – Fix Your WordPress Security WordPress plugin before 1.2.2 did not sanitise or escape the historyvalue GET parameter before outputting it in a Javascript block, leading to a reflected Cross-Site Scripting issue.
Product
WP Hardening – Fix Your WordPress Security
Fixed in
1.2.2
What to do
Update WP Hardening – Fix Your WordPress Security to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021WP Config File Editor: Was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2021-24367 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability.
Product
WP Config File Editor
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update WP Config File Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameterCVE-2021-24339 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
Product
Pods – Custom Content Types and Fields
Fixed in
2.7.27
What to do
Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD record wpscan.com whitesourcesoftware.com
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameterCVE-2021-24338 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
Product
Pods – Custom Content Types and Fields
Fixed in
2.7.27
What to do
Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD record wpscan.com whitesourcesoftware.com
Jun 14, 2021Visitors: Is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2021-24350 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.
Product
Visitors
Affected
up to 0.3
What to do
Affects up to 0.3. Update Visitors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021Hana Flv Player: Is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' fieldCVE-2021-24302 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field.
Product
Hana Flv Player
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Hana Flv Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021Hotjar Connecticator: Is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textareaCVE-2021-24301 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users.
Product
Hotjar Connecticator
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Hotjar Connecticator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021tab parameter of the settings page of the All 404 Redirect to Homepage: Was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issueCVE-2021-24326 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute.
Product
tab parameter of the settings page of the All 404 Redirect to Homepage
Fixed in
1.21
What to do
Update tab parameter of the settings page of the All 404 Redirect to Homepage to 1.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021tab parameter of the settings page of the 404 SEO Redirection: Is vulnerable to a reflected Cross-Site Scripting (XSS) issueCVE-2021-24325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or escaped before being output in an attribute.
Product
tab parameter of the settings page of the 404 SEO Redirection
Affected
up to 1.3
What to do
Affects up to 1.3. Update tab parameter of the settings page of the 404 SEO Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor: Have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.
Product
Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor
Fixed in
2.24.0
What to do
Update Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor to 2.24.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 14, 2021Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_idCVE-2021-24291 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Fixed in
1.5.69
What to do
Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to 1.5.69 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 14, 2021The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticatCVE-2021-24285 · WordPress plugins & themes · reported by WPScanCritical 9.8
The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
Product
Car Seller - Auto Classifieds Script
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Car Seller - Auto Classifieds Script to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
May 5, 2021Clever Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Clever Addons for Elementor
Fixed in
2.1.0
What to do
Update Clever Addons for Elementor to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Ultimate Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Ultimate Addons for Elementor
Fixed in
1.30.0
What to do
Update Ultimate Addons for Elementor to 1.30.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021DeTheme Kit for Elementor: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24270 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
DeTheme Kit for Elementor
Fixed in
1.5.5.5
What to do
Update DeTheme Kit for Elementor to 1.5.5.5 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Sina Extension for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24269 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Sina Extension for Elementor
Fixed in
3.3.12
What to do
Update Sina Extension for Elementor to 3.3.12 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021JetWidgets For Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24268 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
JetWidgets For Elementor
Fixed in
1.0.9
What to do
Update JetWidgets For Elementor to 1.0.9 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021All-in-One Addons for Elementor – WidgetKit: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24267 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
All-in-One Addons for Elementor – WidgetKit
Fixed in
2.3.10
What to do
Update All-in-One Addons for Elementor – WidgetKit to 2.3.10 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021The Plus Addons for Elementor Page Builder Lite: Has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24266 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
The Plus Addons for Elementor Page Builder Lite
Fixed in
2.0.6
What to do
Update The Plus Addons for Elementor Page Builder Lite to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Rife Elementor Extensions & Templates: Has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24265 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Rife Elementor Extensions & Templates
Fixed in
1.1.6
What to do
Update Rife Elementor Extensions & Templates to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Image Hover Effects – Elementor Addon: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24264 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Image Hover Effects – Elementor Addon
Fixed in
1.3.4
What to do
Update Image Hover Effects – Elementor Addon to 1.3.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor Addons – PowerPack Addons for Elementor: For WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24263 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addons – PowerPack Addons for Elementor
Fixed in
2.3.2
What to do
Update Elementor Addons – PowerPack Addons for Elementor to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021WooLentor – WooCommerce Elementor Addons + Builder: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24262 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
WooLentor – WooCommerce Elementor Addons + Builder
Fixed in
1.8.6
What to do
Update WooLentor – WooCommerce Elementor Addons + Builder to 1.8.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021HT Mega – Absolute Addons for Elementor Page Builder: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24261 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
HT Mega – Absolute Addons for Elementor Page Builder
Fixed in
1.5.7
What to do
Update HT Mega – Absolute Addons for Elementor Page Builder to 1.5.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Livemesh Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24260 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Livemesh Addons for Elementor
Fixed in
6.8
What to do
Update Livemesh Addons for Elementor to 6.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor Addon Elements: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24259 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addon Elements
Fixed in
1.11.2
What to do
Update Elementor Addon Elements to 1.11.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lCVE-2021-24258 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Fixed in
2.2.0
What to do
Update the plugin to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Premium Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24257 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Premium Addons for Elementor
Fixed in
4.2.8
What to do
Update Premium Addons for Elementor to 4.2.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor – Header, Footer & Blocks Template: Has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24256 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor – Header, Footer & Blocks Template
Fixed in
1.5.8
What to do
Update Elementor – Header, Footer & Blocks Template to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Essential Addons for Elementor Lite: Has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24255 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.
Product
Essential Addons for Elementor Lite
Fixed in
4.5.4
What to do
Update Essential Addons for Elementor Lite to 4.5.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 22, 2021Cooked Pro: Was affected by unauthenticated reflected Cross-Site Scripting issuesCVE-2021-24233 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
Product
Cooked Pro
Fixed in
1.7.5.6
What to do
Update Cooked Pro to 1.7.5.6 or newer.
Full record and what to do →NVD record wpscan.com getastra.com
Apr 12, 2021The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin befoCVE-2021-24229 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability.
Fixed in
1.7.2
What to do
Update the plugin to 1.7.2 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon: The WordPress login form (wp-loginCVE-2021-24228 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized.
Product
Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon
Fixed in
1.7.2
What to do
Update Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon to 1.7.2 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021GiveWP – Donation Plugin and Fundraising Platform: Was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panelCVE-2021-24213 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
Product
GiveWP – Donation Plugin and Fundraising Platform
Fixed in
2.10.0
What to do
Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.0 or newer.
Full record and what to do →NVD record bentl.ee wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.