Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,298 results · page 25 of 26

Jun 26, 2023MainWP Child: Sensitive Information ExposureCVE-2023-3132 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.
Product
MainWP Child
Affected
up to 4.4.1.1
What to do
Affects up to 4.4.1.1. Update MainWP Child to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 26, 2023EmbedPress: Sensitive Information ExposureCVE-2023-3371 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt and view the password protected content.
Product
EmbedPress
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023FluentCRM - Marketing Automation For WordPress: Unauthorized modification of dataCVE-2023-1430 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.
Product
FluentCRM - Marketing Automation For WordPress
Affected
up to 2.8.01
What to do
Affects up to 2.8.01. Update FluentCRM - Marketing Automation For WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0694 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0693 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0692 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0691 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, specifically the submitter's last name.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0688 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 2, 2023Download Manager: Leaks master key information without the need for a passwordCVE-2023-1809 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files.
Product
Download Manager
Fixed in
6.3.0
What to do
Update Download Manager to 6.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023Gallery by BestWebSoft: Does not perform proper sanitization of gallery informationCVE-2023-0764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role.
Product
Gallery by BestWebSoft
Fixed in
4.7.0
What to do
Update Gallery by BestWebSoft to 4.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 16, 2023Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.CVE-2023-22687 · WordPress plugins & themes · reported by PatchstackLow 3.7
Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.
Affected
up to 1.9.4.0
What to do
Affects up to 1.9.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 10, 2023WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins
Product
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
Fixed in
2.7.9.4
What to do
Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to 2.7.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 16, 2023WP Simple Shopping Cart: Sensitive Information ExposureCVE-2023-1431 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due to the plugin saving shopping cart data exports in a publicly accessible location (/wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/). This makes it possible for unauthenticated attackers to view information that should be limited to administrators only and can include data like first name, last name, email, address, IP Address, and more.
Product
WP Simple Shopping Cart
Affected
up to 4.6.3
What to do
Affects up to 4.6.3. Update WP Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 15, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin <= 4.10.3 versions.CVE-2022-38456 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin <= 4.10.3 versions.
Affected
up to 4.10.3
What to do
Affects up to 4.10.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 7, 2023CMP – Coming Soon & Maintenance: Information ExposureCVE-2023-1263 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled.
Product
CMP – Coming Soon & Maintenance
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023Total Upkeep: Information disclosureCVE-2022-4932 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
Product
Total Upkeep
Affected
up to 1.14.13
What to do
Affects up to 1.14.13. Update Total Upkeep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023BackupWordPress: Information disclosureCVE-2022-4931 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
Product
BackupWordPress
Affected
up to 3.12
What to do
Affects up to 3.12. Update BackupWordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Sensitive information disclosureCVE-2020-36668 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.
Product
JetBackup – WP Backup, Migrate & Restore
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 13, 2023Profile Builder – User Profile & User Registration Forms: Sensitive information disclosureCVE-2023-0814 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
Product
Profile Builder – User Profile & User Registration Forms
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Jan 27, 2023ContentStudio: Sensitive Information ExposureCVE-2023-0557 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
Product
ContentStudio
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 19, 2022Directorist: Does not prevent users with low privileges (like subscribers) from accessing sensitive system informationCVE-2022-3961 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information.
Product
Directorist
Fixed in
7.4.4
What to do
Update Directorist to 7.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 21, 2022The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.CVE-2022-3750 · WordPress plugins & themes · reported by WPScanMedium 4.7
The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.
Fixed in
6.8.7
What to do
Update the plugin to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 21, 2022DeepL Pro API translation: Discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an externalCVE-2022-3691 · WordPress plugins & themes · reported by WPScanHigh 7.5
The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.
Product
DeepL Pro API translation
Fixed in
1.7.5
What to do
Update DeepL Pro API translation to 1.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 18, 2022Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-42883 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.
Affected
up to 7.3.10
What to do
Affects up to 7.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 23, 2022Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPressCVE-2022-40194 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 6, 2022WP Libre Form 2 plugin <= 2.0.8 at: Unauthenticated Sensitive Information DisclosureCVE-2022-34867 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions. Affects only versions from 2.0.0 to 2.0.8.
Product
WP Libre Form 2 plugin <= 2.0.8 at
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update WP Libre Form 2 plugin <= 2.0.8 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com patchstack.com
Sep 6, 2022Transposh WordPress Translation: Sensitive information disclosure to unauthenticated usersCVE-2022-2462 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.
Product
Transposh WordPress Translation
Affected
up to 1.0.9.6
What to do
Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Aug 22, 2022Duplicator: Does not authenticate or authorize visitors before displaying information about the system suchCVE-2022-2552 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site.
Product
Duplicator
Fixed in
1.4.7
What to do
Update Duplicator to 1.4.7 or newer.
Full record and what to do →NVD record github.com wpscan.com
Aug 22, 2022Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami: Does not have authorisation and CSRF checks in one of its AJAX actionCVE-2022-2389 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations
Product
Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami
Fixed in
2.1.2
What to do
Update Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 18, 2022GiveWP: Sensitive Information DisclosureCVE-2022-2117 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been completely removed in version 2.20.2.
Product
GiveWP
Affected
up to 2.20.2
What to do
Affects up to 2.20.2. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 10, 2022Metform: Sensitive information disclosureCVE-2022-1442 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Metform WordPress plugin is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs like that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA and many more, in versions up to and including 2.1.3.
Product
Metform
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Metform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
May 9, 2022WPGraphQL: Doesn't properly restrict access to information about other users' roles on the affected siteCVE-2019-25060 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
Product
WPGraphQL
Fixed in
0.3.5
What to do
Update WPGraphQL to 0.3.5 or newer.
Full record and what to do →NVD record github.com wpscan.com
May 2, 2022LifterLMS PayPal: Does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the pageCVE-2022-1250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue
Product
LifterLMS PayPal
Fixed in
1.4.0
What to do
Update LifterLMS PayPal to 1.4.0 or newer.
Full record and what to do →NVD record make.lifterlms.com wpscan.com
Apr 19, 2022Sensitive Information Exposure in E4J s.r.l.CVE-2022-27863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by guessing / brute-forcing easy predictable booking IDs via search POST requests.
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 19, 2022The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API routeCVE-2022-1186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 15, 2022Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115CVE-2022-27849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115
Affected
up to 20220115
What to do
Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Cookie Information | Free GDPR Consent Solution
Fixed in
2.0.8
What to do
Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022RegistrationMagic: Does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboardCVE-2022-0420 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
Product
RegistrationMagic
Fixed in
5.0.2.2
What to do
Update RegistrationMagic to 5.0.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).CVE-2022-23984 · WordPress plugins & themes · reported by PatchstackLow 3.7
Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).
Affected
up to 7.3.11
What to do
Affects up to 7.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 21, 2022Five Star Business Profile and Schema: Does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX actionCVE-2021-25060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues
Product
Five Star Business Profile and Schema
Fixed in
2.1.7
What to do
Update Five Star Business Profile and Schema to 2.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 18, 2022The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.CVE-2022-23982 · WordPress plugins & themes · reported by PatchstackMedium 4.3
The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 13, 2021obtaining the user list which may allow a user to obtain the unauthorized information: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20866 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
Product
obtaining the user list which may allow a user to obtain the unauthorized information
What to do
Update obtaining the user list which may allow a user to obtain the unauthorized information to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Nov 1, 2021OptinMonster: Sensitive information disclosure and unauthorized setting updatesCVE-2021-39341 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.
Product
OptinMonster
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2021Ninja Forms: Sensitive information disclosureCVE-2021-34647 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.
Product
Ninja Forms
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 17, 2021BulletProof Security: Sensitive information disclosureCVE-2021-39327 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.
Product
BulletProof Security
Affected
up to 5.1
What to do
Affects up to 5.1. Update BulletProof Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Aug 23, 2021Slider Hero with Animation, Video Background & Intro Maker: Does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statementCVE-2021-24506 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
Product
Slider Hero with Animation, Video Background & Intro Maker
Fixed in
8.2.7
What to do
Update Slider Hero with Animation, Video Background & Intro Maker to 8.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2021REST API endpoint get_users in the User Profile Picture: Returned more information than was required for its functionality to users with the upload_files capabilityCVE-2021-24170 · WordPress plugins & themes · reported by WPScanHigh 7.5
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
Product
REST API endpoint get_users in the User Profile Picture
Fixed in
2.5.0
What to do
Update REST API endpoint get_users in the User Profile Picture to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Aug 31, 2020Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.CVE-2020-20625 · WordPress plugins & themes · reported by MITREHigh 7.5
Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Apr 24, 2020The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request viaCVE-2020-12070 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.
Product
Advanced Woo Search
Affected
up to 1.99
What to do
Affects up to 1.99. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 13, 2020The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via adminCVE-2020-10195 · WordPress plugins & themes · reported by MITREMedium 6.3
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal (subscriber-level) permissions can modify the plugin's settings to allow arbitrary roles (including subscribers) access to plugin functionality by setting the action parameter to sgpbSaveSettings, export a list of current newsletter subscribers by setting the action parameter to csv_file, or obtain system configuration information including webserver configuration and a list of installed plugins by setting the action parameter to sgpb_system_info.
Product
popup-builder
Fixed in
3.64.1
What to do
Update popup-builder to 3.64.1 or newer.
Full record and what to do →NVD record wpvulndb.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.