Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,456 results · page 26 of 30
Mar 21, 2022Simple Membership: Does not have CSRF check in placeCVE-2022-0681 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack
- Product
- Simple Membership
- Fixed in
- 4.1.0
- What to do
- Update Simple Membership to 4.1.0 or newer.
Mar 21, 2022Amelia: Does not have CSRF check in placeCVE-2022-0616 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack
- Product
- Amelia
- Fixed in
- 1.0.47
- What to do
- Update Amelia to 1.0.47 or newer.
Mar 21, 20223D FlipBook: Does not have authorisation and CSRF checksCVE-2022-0423 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook.
- Product
- 3D FlipBook
- Fixed in
- 1.12.1
- What to do
- Update 3D FlipBook to 1.12.1 or newer.
Mar 21, 2022miniOrange's Google Authenticator: Does not have proper authorisation and CSRF checksCVE-2022-0229 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
- Product
- miniOrange's Google Authenticator
- Fixed in
- 5.5
- What to do
- Update miniOrange's Google Authenticator to 5.5 or newer.
Mar 21, 2022Advanced Contact form 7 DB: Does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX actionCVE-2021-24905 · WordPress plugins & themes · reported by WPScanHigh 8
The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.
- Product
- Advanced Contact form 7 DB
- Fixed in
- 1.8.7
- What to do
- Update Advanced Contact form 7 DB to 1.8.7 or newer.
Mar 14, 2022Simple Quotation: Does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user dataCVE-2022-22735 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks
- Product
- Simple Quotation
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Simple Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Simple Quotation: Does not have CSRF checkCVE-2022-22734 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them
- Product
- Simple Quotation
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Simple Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Meks Easy Photo Feed Widget: Does not have capability and CSRF checks in the meks_save_business_selected_account AJAX actionCVE-2021-24958 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_account AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site Scripting payloads in them
- Product
- Meks Easy Photo Feed Widget
- Fixed in
- 1.2.4
- What to do
- Update Meks Easy Photo Feed Widget to 1.2.4 or newer.
Mar 14, 2022Insight Core: Does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user)CVE-2021-24950 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user), does not validate user input before passing it to unserialize(), nor sanitise and escape it before outputting it in the response. As a result, it could allow users with a role as low as Subscriber to perform PHP Object Injection, as well as Stored Cross-Site Scripting attacks
- Product
- Insight Core
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Insight Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2022WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent: Does not have CSRF checks in placeCVE-2022-0445 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack
- Product
- WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent
- Fixed in
- 2.14.2
- What to do
- Update WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent to 2.14.2 or newer.
Mar 7, 2022Download Manager: Does not have any authorisation checks in some of the REST API endpointsCVE-2021-25087 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.2.35 does not have any authorisation checks in some of the REST API endpoints, allowing unauthenticated attackers to call them, which could lead to sensitive information disclosure, such as posts passwords (fixed in 3.2.24) and files Master Keys (fixed in 3.2.25).
- Product
- Download Manager
- Fixed in
- 3.2.35
- What to do
- Update Download Manager to 3.2.35 or newer.
Feb 28, 2022Customize WordPress Emails and Alerts: Does not have authorisation and CSRF check in its bnfw_search_users AJAX actionCVE-2022-0345 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
- Product
- Customize WordPress Emails and Alerts
- Fixed in
- 1.8.7
- What to do
- Update Customize WordPress Emails and Alerts to 1.8.7 or newer.
Feb 28, 2022Simple Membership: Does not have CSRF checkCVE-2022-0328 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Simple Membership
- Fixed in
- 4.0.9
- What to do
- Update Simple Membership to 4.0.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Maps Plugin using Google Maps for: Does not have CSRF checks in most of its AJAX actionsCVE-2021-25081 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack
- Product
- Maps Plugin using Google Maps for
- Fixed in
- 1.8.4
- What to do
- Update Maps Plugin using Google Maps for to 1.8.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022WP Visitor Statistics (Real Time Traffic): Does not have authorisation and CSRF checks in the updateIpAddress AJAX actionCVE-2021-25042 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 5.5
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 5.5 or newer.
Feb 28, 2022Post Snippets: Does not have CSRF checkCVE-2021-25010 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues
- Product
- Post Snippets
- Fixed in
- 3.1.4
- What to do
- Update Post Snippets to 3.1.4 or newer.
Feb 28, 2022Use Any Font | Custom Font Uploader: Does not have any authorisation checksCVE-2021-24977 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues
- Product
- Use Any Font | Custom Font Uploader
- Fixed in
- 6.2.1
- What to do
- Update Use Any Font | Custom Font Uploader to 6.2.1 or newer.
Feb 28, 2022WP Responsive Menu: Does not have capability and CSRF checks in the wpr_live_update AJAX actionCVE-2021-24971 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin's settings and perform Cross-Site Scripting attacks against all visitor and users on the frontend
- Product
- WP Responsive Menu
- Fixed in
- 3.1.7.1
- What to do
- Update WP Responsive Menu to 3.1.7.1 or newer.
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF check in the lswss_save_attachment_data AJAX actionCVE-2021-24913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.
- Product
- Logo Showcase with Slick Slider
- Fixed in
- 2.0.1
- What to do
- Update Logo Showcase with Slick Slider to 2.0.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Support Board: Does not have any CSRF checks in actions handled by the include/ajaxCVE-2021-24823 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files
- Product
- Support Board
- Fixed in
- 3.3.6
- What to do
- Update Support Board to 3.3.6 or newer.
Full record and what to do →NVD recordnoob3xploiter.medium.comwpscan.com
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX actionCVE-2021-24730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.
- Product
- Logo Showcase with Slick Slider
- Fixed in
- 1.2.5
- What to do
- Update Logo Showcase with Slick Slider to 1.2.5 or newer.
Feb 28, 2022Orange Form: Does not have any authorisation and CSRF checks in all of its AJAX callsCVE-2021-24688 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)
- Product
- Orange Form
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Float menu: Does not have CSRF check in placeCVE-2022-0313 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Float menu
- Fixed in
- 4.3.1
- What to do
- Update Float menu to 4.3.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Coming soon and Maintenance mode: Does not have CSRF check in its coming_soon_send_mail AJAX actionCVE-2022-0199 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.6.8
- What to do
- Update Coming soon and Maintenance mode to 3.6.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Coming soon and Maintenance mode: Does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX actionCVE-2022-0164 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.5.3
- What to do
- Update Coming soon and Maintenance mode to 3.5.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022AnyComment: Does not have CSRF checks in the Import and Revert HyperComments featuresCVE-2022-0134 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Feb 21, 2022GiveWP: Does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX actionCVE-2021-25099 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Duplicate Page or Post: Does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX actionCVE-2021-25075 · WordPress plugins & themes · reported by WPScanLow 3.5
The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues
- Product
- Duplicate Page or Post
- Fixed in
- 1.5.1
- What to do
- Update Duplicate Page or Post to 1.5.1 or newer.
Feb 14, 2022PPOM for WooCommerce: Does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX actionCVE-2021-25018 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
- Product
- PPOM for WooCommerce
- Fixed in
- 24.0
- What to do
- Update PPOM for WooCommerce to 24.0 or newer.
Feb 14, 2022Ibtana: Does not have authorisation and CSRF checks in the ive_save_general_settings AJAX actionCVE-2021-25014 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.
- Product
- Ibtana
- Fixed in
- 1.1.4.9
- What to do
- Update Ibtana to 1.1.4.9 or newer.
Feb 14, 2022Remove Footer Credit: Does not have CSRF check in placeCVE-2021-24446 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
- Product
- Remove Footer Credit
- Fixed in
- 1.0.6
- What to do
- Update Remove Footer Credit to 1.0.6 or newer.
Feb 7, 2022IP2Location Country Blocker: Does not have CSRF check in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25108 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.6
- What to do
- Update IP2Location Country Blocker to 2.26.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages: Does not check for authorisation and has a flawed CSRF logicCVE-2021-25106 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting
- Product
- Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages
- Fixed in
- 2.7.1
- What to do
- Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages to 2.7.1 or newer.
Feb 7, 2022IP2Location Country Blocker: Does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25095 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
- Product
- IP2Location Country Blocker
- Fixed in
- 2.26.5
- What to do
- Update IP2Location Country Blocker to 2.26.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Ultimate Product Catalog: Does not have authorisation and CSRF checks in some AJAX actionsCVE-2021-24993 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
- Product
- Ultimate Product Catalog
- Fixed in
- 5.0.26
- What to do
- Update Ultimate Product Catalog to 5.0.26 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022SupportCandy: Does not have CSRF check in the wpsc_tickets AJAX actionCVE-2021-24879 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.
- Product
- SupportCandy
- Fixed in
- 2.2.7
- What to do
- Update SupportCandy to 2.2.7 or newer.
Feb 7, 2022SupportCandy: Does not have CRSF check in its wpsc_tickets AJAX actionCVE-2021-24843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.
- Product
- SupportCandy
- Fixed in
- 2.2.7
- What to do
- Update SupportCandy to 2.2.7 or newer.
Feb 7, 2022SupportCandy: Does not have authorisation and CSRF checks in its wpsc_tickets AJAX actionCVE-2021-24839 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
- Product
- SupportCandy
- Fixed in
- 2.2.5
- What to do
- Update SupportCandy to 2.2.5 or newer.
Feb 1, 2022The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, respondsCVE-2022-0220 · WordPress plugins & themes · reported by WPScanMedium 6.1
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)
- Product
- WordPress GDPR
- Fixed in
- 1.9.27
- What to do
- Update WordPress GDPR to 1.9.27 or newer.
Feb 1, 2022LabTools: Does not have proper authorisation and CSRF check in placeCVE-2021-25097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
- Product
- LabTools
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update LabTools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2022Link Library: Does not have CSRF checkCVE-2021-25092 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack
- Product
- Link Library
- Fixed in
- 7.2.8
- What to do
- Update Link Library to 7.2.8 or newer.
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not have CSRF check in placeCVE-2021-25072 · WordPress plugins & themes · reported by WPScanMedium 6.5
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.3.25
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.3.25 or newer.
Feb 1, 2022Domain Check: Does not sanitise and escape the domain parameter before outputting it back in the pageCVE-2021-24926 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue
- Product
- Domain Check
- Fixed in
- 1.0.17
- What to do
- Update Domain Check to 1.0.17 or newer.
Feb 1, 2022The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, respondsCVE-2021-24814 · WordPress plugins & themes · reported by WPScanCritical 9.6
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction).
- Product
- WordPress GDPR
- Fixed in
- 1.9.26
- What to do
- Update WordPress GDPR to 1.9.26 or newer.
Feb 1, 2022Perfect Survey: Does not have proper authorisation nor CSRF checks in the save_global_setting AJAX actionCVE-2021-24763 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey
- Product
- Perfect Survey
- Fixed in
- 1.5.2
- What to do
- Update Perfect Survey to 1.5.2 or newer.
Feb 1, 2022Error Log Viewer: Does not perform nonce checkCVE-2021-24761 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server.
- Product
- Error Log Viewer
- Fixed in
- 1.1.2
- What to do
- Update Error Log Viewer to 1.1.2 or newer.
Jan 24, 2022WP125: Does not have CSRF checks in various actionCVE-2021-25073 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, allowing attackers to make a logged in admin delete them via a CSRF attack
- Product
- WP125
- Fixed in
- 1.5.5
- What to do
- Update WP125 to 1.5.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Qubely: Does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX actionCVE-2021-25013 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts
- Product
- Qubely
- Fixed in
- 1.7.8
- What to do
- Update Qubely to 1.7.8 or newer.
Jan 24, 2022Accept Donations with PayPal: Does not have CSRF check in place and does not ensure that the post to be deleted belongs to the pluginCVE-2021-24989 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.4
- What to do
- Update Accept Donations with PayPal to 1.3.4 or newer.
Jan 24, 2022Product Feed PRO for WooCommerce: Does not have authorisation and CSRF check in some of its AJAX actionsCVE-2021-24974 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.
- Product
- Product Feed PRO for WooCommerce
- Fixed in
- 11.0.7
- What to do
- Update Product Feed PRO for WooCommerce to 11.0.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.