Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,456 results · page 25 of 30
Jun 13, 2022RB Internal Links: Does not have CSRF check in placeCVE-2022-1759 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as perform Stored Cross-Site Scripting attacks due to the lack of sanitisation and escaping
- Product
- RB Internal Links
- Affected
- up to 2.0.16
- What to do
- Affects up to 2.0.16. Update RB Internal Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Genki Pre-Publish Reminder: Does not have CSRF check in placeCVE-2022-1758 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS as well as RCE when custom code is added via the plugin settings.
- Product
- Genki Pre-Publish Reminder
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Genki Pre-Publish Reminder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Useful Banner Manager: Does not perform CSRF checks on POST requests to its admin pageCVE-2022-1694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.
- Product
- Useful Banner Manager
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Useful Banner Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Latest Tweets Widget: Does not have CSRF check in placeCVE-2022-1624 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Latest Tweets Widget
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Latest Tweets Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Webriti SMTP Mail: Does not have CSRF check in placeCVE-2022-1612 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Webriti SMTP Mail
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Webriti SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022OnePress Social Locker: Does not have CSRF check in placeCVE-2022-1608 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- OnePress Social Locker
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update OnePress Social Locker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Email Users: Does not have CSRF check in placeCVE-2022-1605 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and change the notification settings of arbitrary users
- Product
- Email Users
- Affected
- up to 4.8.8
- What to do
- Affects up to 4.8.8. Update Email Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022HC Custom WP-Admin URL: Does not have CSRF check in placeCVE-2022-1594 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL
- Product
- HC Custom WP-Admin URL
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HC Custom WP-Admin URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Member Hero: Lacks authorization checksCVE-2022-0885 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
- Product
- Member Hero
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Member Hero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Enqueue Anything: Does not have authorisation and CSRF checks in the remove_asset AJAX actionCVE-2021-25116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
- Product
- Enqueue Anything
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Enqueue Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022LiveSync for: Does not have CSRF check in placeCVE-2022-1712 · WordPress plugins & themes · reported by WPScanMedium 4.3
The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- LiveSync for
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update LiveSync for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Throws SPAM Away: Does not have CSRF checks in placeCVE-2022-1709 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers to make a logged in admin delete comments via a CSRF attack
- Product
- Throws SPAM Away
- Fixed in
- 3.3.1
- What to do
- Update Throws SPAM Away to 3.3.1 or newer.
Jun 8, 2022WP Simple Adsense Insertion: Does not perform CSRF checks on updates to its admin pageCVE-2022-1695 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form.
- Product
- WP Simple Adsense Insertion
- Fixed in
- 2.1
- What to do
- Update WP Simple Adsense Insertion to 2.1 or newer.
Jun 8, 2022Database Backup for: Does not have CSRF check in placeCVE-2022-1577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
- Product
- Database Backup for
- Fixed in
- 2.5.2
- What to do
- Update Database Backup for to 2.5.2 or newer.
Jun 8, 2022Files Download Delay: Does not have authorisation and CSRF checksCVE-2022-1570 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.
- Product
- Files Download Delay
- Fixed in
- 1.0.7
- What to do
- Update Files Download Delay to 1.0.7 or newer.
Jun 8, 2022Ask me: Does not perform CSRF checks for any of its AJAX actionsCVE-2022-1424 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform various actions on their behalf on the site.
- Product
- Ask me
- Fixed in
- 6.8.2
- What to do
- Update Ask me to 6.8.2 or newer.
Jun 8, 2022Discy: Does not check for CSRF tokens in the AJAX action discy_reset_optionsCVE-2022-1422 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetting the site settings back to defaults.
- Product
- Discy
- Fixed in
- 5.2
- What to do
- Update Discy to 5.2 or newer.
Jun 8, 2022Discy: Lacks CSRF checks in some AJAX actionsCVE-2022-1421 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack
- Product
- Discy
- Fixed in
- 5.2
- What to do
- Update Discy to 5.2 or newer.
May 30, 2022Bulk Page Creator: Does not protect its page creation functionalities with nonce checksCVE-2022-1611 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF.
- Product
- Bulk Page Creator
- Fixed in
- 1.1.4
- What to do
- Update Bulk Page Creator to 1.1.4 or newer.
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 30, 2022Content Mask: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2022-1203 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
- Product
- Content Mask
- Fixed in
- 1.8.4.1
- What to do
- Update Content Mask to 1.8.4.1 or newer.
May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
- Product
- JivoChat Live Chat
- Fixed in
- 1.3.5.4
- What to do
- Update JivoChat Live Chat to 1.3.5.4 or newer.
May 23, 2022Check & Log Email: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1547 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Check & Log Email
- Fixed in
- 1.0.6
- What to do
- Update Check & Log Email to 1.0.6 or newer.
May 20, 2022Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress.CVE-2022-29425 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 16, 2022ULeak Security & Monitoring: Does not have authorisation and CSRF checksCVE-2022-1557 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings
- Product
- ULeak Security & Monitoring
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update ULeak Security & Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022Social Stickers: Does not have CSRF checks in placeCVE-2022-1418 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does not escape some of these fields, which could allow attackers to make a logged-in admin change them and lead to Stored Cross-Site Scripting issues.
- Product
- Social Stickers
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Social Stickers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not have CSRF check in placeCVE-2022-1407 · WordPress plugins & themes · reported by WPScanMedium 6.5
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 2, 2022Sitemap by click5: Does not have authorisation and CSRF checksCVE-2022-0952 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.
- Product
- Sitemap by click5
- Fixed in
- 1.0.36
- What to do
- Update Sitemap by click5 to 1.0.36 or newer.
May 2, 2022Ad Invalid Click Protector (AICP): Does not have CSRF check deleting banned usersCVE-2022-0191 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attackers to make a logged in admin remove arbitrary bans
- Product
- Ad Invalid Click Protector (AICP)
- Fixed in
- 1.2.7
- What to do
- Update Ad Invalid Click Protector (AICP) to 1.2.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022Tipsacarrier: Does not have any authorisation check in place some functionsCVE-2021-25002 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL
- Product
- Tipsacarrier
- Fixed in
- 1.5.0.5
- What to do
- Update Tipsacarrier to 1.5.0.5 or newer.
Apr 25, 2022myCred: Does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX actionCVE-2022-1092 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog
- Product
- myCred
- Fixed in
- 2.4.3.1
- What to do
- Update myCred to 2.4.3.1 or newer.
Apr 25, 2022ThirstyAffiliates: Lacks authorization checks in the ta_insert_external_image actionCVE-2022-0634 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request.
- Product
- ThirstyAffiliates
- Fixed in
- 3.10.5
- What to do
- Update ThirstyAffiliates to 3.10.5 or newer.
Apr 25, 2022ThirstyAffiliates Affiliate Link Manager: Does not have authorisation and CSRF checksCVE-2022-0398 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website
- Product
- ThirstyAffiliates Affiliate Link Manager
- Fixed in
- 3.10.5
- What to do
- Update ThirstyAffiliates Affiliate Link Manager to 3.10.5 or newer.
Apr 25, 2022myCred: Does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX actionCVE-2022-0363 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
- Product
- myCred
- Fixed in
- 2.4.3.1
- What to do
- Update myCred to 2.4.3.1 or newer.
Apr 25, 2022DW Question & Answer Pro: Does not properly check for CSRF in some of its functionsCVE-2021-24805 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.
- Product
- DW Question & Answer Pro
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update DW Question & Answer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022DW Question & Answer Pro: Does not check that the comment to edit belongs to the user making the requestCVE-2021-24800 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
- Product
- DW Question & Answer Pro
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update DW Question & Answer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Autolinks: Does not have CSRF check in placeCVE-2022-1112 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as escape them, which could allow attackers to perform Stored Cross-Site scripting against a logged in admin via a CSRF attack
- Product
- Autolinks
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Autolinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022RSVP and Event Management: Does not have any authorisation checksCVE-2022-1054 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
- Product
- RSVP and Event Management
- Fixed in
- 2.7.8
- What to do
- Update RSVP and Event Management to 2.7.8 or newer.
Apr 18, 2022Product Table for WooCommerce (wooproducttable): Does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
- Product
- Product Table for WooCommerce (wooproducttable)
- Fixed in
- 3.1.2
- What to do
- Update Product Table for WooCommerce (wooproducttable) to 3.1.2 or newer.
Apr 18, 2022Easy Digital Downloads: Does not have CSRF check in placeCVE-2022-0707 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack
- Product
- Easy Digital Downloads
- Fixed in
- 2.11.6
- What to do
- Update Easy Digital Downloads to 2.11.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 18, 2022A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts.CVE-2011-1762 · WordPress plugins & themes · reported by Red HatMedium 6.5
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Apr 12, 2022Visual Form Builder: Does not enforce nonce checksCVE-2022-0141 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks
- Product
- Visual Form Builder
- Fixed in
- 3.0.8
- What to do
- Update Visual Form Builder to 3.0.8 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Apr 11, 2022Portfolio Gallery, Product Catalog: Does not have authorisation and CSRF checks in various functions related to AJAX actionsCVE-2021-25090 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
- Product
- Portfolio Gallery, Product Catalog
- Fixed in
- 2.1.0
- What to do
- Update Portfolio Gallery, Product Catalog to 2.1.0 or newer.
Apr 4, 2022FormBuilder: Does not have CSRF checks in placeCVE-2022-0830 · WordPress plugins & themes · reported by WPScanMedium 6.5
The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in them.
- Product
- FormBuilder
- Affected
- up to 1.08
- What to do
- Affects up to 1.08. Update FormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2022Material Design for Contact Form 7: Does not check authorization or that the option mentioned in the notice param belongs to the pluginCVE-2022-0404 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.
- Product
- Material Design for Contact Form 7
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Material Design for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2022Dropdown Menu Widget: Does not have authorisation and CSRF checksCVE-2021-25113 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- Dropdown Menu Widget
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update Dropdown Menu Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022WooCommerce Affiliate: Does not have authorization and CSRF checks on a specific action handlerCVE-2022-0818 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.
- Product
- WooCommerce Affiliate
- Fixed in
- 4.16.4.5
- What to do
- Update WooCommerce Affiliate to 4.16.4.5 or newer.
Mar 28, 2022Translate WordPress with GTranslate: Does not have CSRF check in some filesCVE-2022-0770 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access to a logged in admin cookies by making them open a malicious link or page
- Product
- Translate WordPress with GTranslate
- Fixed in
- 2.9.9
- What to do
- Update Translate WordPress with GTranslate to 2.9.9 or newer.
Mar 28, 2022Sermon Browser: Does not have CSRF checks in placeCVE-2022-0499 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.
- Product
- Sermon Browser
- Affected
- up to 0.45.22
- What to do
- Affects up to 0.45.22. Update Sermon Browser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Menu Image, Icons made easy: Does not have authorisation and CSRF checksCVE-2022-0450 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and does not validate, sanitise and escape them. As a result, any authenticate users, such as subscriber can update the settings or arbitrary menu and put Cross-Site Scripting payloads in them which will be triggered in the related menu in the frontend
- Product
- Menu Image, Icons made easy
- Fixed in
- 3.0.6
- What to do
- Update Menu Image, Icons made easy to 3.0.6 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.