Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,456 results · page 27 of 30
Jan 24, 2022Ultimate FAQ: Does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actionsCVE-2021-24968 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
- Product
- Ultimate FAQ
- Fixed in
- 2.1.2
- What to do
- Update Ultimate FAQ to 2.1.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Five Star Restaurant Reservations: Does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX actionCVE-2021-24965 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it. Due to the lack of sanitisation and escaping, users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.4.8
- What to do
- Update Five Star Restaurant Reservations to 2.4.8 or newer.
Jan 24, 2022WP Extra File Types: Does not have CSRF checkCVE-2021-24936 · WordPress plugins & themes · reported by WPScanHigh 8
The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
- Product
- WP Extra File Types
- Fixed in
- 0.5.1
- What to do
- Update WP Extra File Types to 0.5.1 or newer.
Jan 24, 2022Protect WP Admin: Does not check for authorisation in the lib/pwa-deactivateCVE-2021-24906 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request
- Product
- Protect WP Admin
- Fixed in
- 3.6.2
- What to do
- Update Protect WP Admin to 3.6.2 or newer.
Jan 24, 2022Simple Download Monitor: Does not enforce nonce checksCVE-2021-24696 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads
- Product
- Simple Download Monitor
- Fixed in
- 3.9.9
- What to do
- Update Simple Download Monitor to 3.9.9 or newer.
Jan 17, 2022EventCalendar: Does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actionsCVE-2021-25025 · WordPress plugins & themes · reported by WPScanMedium 4.3
The EventCalendar WordPress plugin before 1.1.51 does not have proper authorisation and CSRF checks in the add_calendar_event AJAX actions, allowing users with a role as low as subscriber to create events
- Product
- EventCalendar
- Fixed in
- 1.1.51
- What to do
- Update EventCalendar to 1.1.51 or newer.
Jan 10, 2022PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro: Does not have authorisation and CSRF checksCVE-2021-25032 · WordPress plugins & themes · reported by WPScanCritical 9.8
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.
- Product
- PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro
- Fixed in
- 2.3.1
- What to do
- Update PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro to 2.3.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 13, 2021Like Button Rating ♥ LikeBtn: Does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX actionCVE-2021-24945 · WordPress plugins & themes · reported by WPScanHigh 8
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.
- Product
- Like Button Rating ♥ LikeBtn
- Fixed in
- 2.6.38
- What to do
- Update Like Button Rating ♥ LikeBtn to 2.6.38 or newer.
Dec 13, 2021Pixel Cat: Does not have CSRF checkCVE-2021-24922 · WordPress plugins & themes · reported by WPScanCritical 9
The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks
- Product
- Pixel Cat
- Fixed in
- 2.6.2
- What to do
- Update Pixel Cat to 2.6.2 or newer.
Dec 13, 2021Quotes Collection: Does not validate and escape the bulkcheck parameter before using it in a SQL statementCVE-2021-24861 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quotes Collection WordPress plugin through 2.5.2 does not validate and escape the bulkcheck parameter before using it in a SQL statement, leading to a SQL injection
- Product
- Quotes Collection
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Quotes Collection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Temporary Login Without Password: Does not have authorisation and CSRF checksCVE-2021-24836 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
- Product
- Temporary Login Without Password
- Fixed in
- 1.7.1
- What to do
- Update Temporary Login Without Password to 1.7.1 or newer.
Dec 13, 2021WP Limits: Does not have CSRF checkCVE-2021-24818 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values
- Product
- WP Limits
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Limits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Filter Portfolio Gallery: Is lacking Cross-Site Request Forgery (CSRF) checkCVE-2021-24795 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.
- Product
- Filter Portfolio Gallery
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Filter Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021WP Admin Logo Changer: Does not have CSRF checkCVE-2021-24784 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack.
- Product
- WP Admin Logo Changer
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Admin Logo Changer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Single Post Exporter: Does not have CSRF checksCVE-2021-24780 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page (such as private and password protected) via a direct URL
- Product
- Single Post Exporter
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Single Post Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021NEX-Forms: Does not have CSRF checks in placeCVE-2021-24705 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them
- Product
- NEX-Forms
- Fixed in
- 8.4.3
- What to do
- Update NEX-Forms to 8.4.3 or newer.
Dec 6, 2021Tawk.To Live Chat: Does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actionsCVE-2021-24914 · WordPress plugins & themes · reported by WPScanHigh 8
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.
- Product
- Tawk.To Live Chat
- Fixed in
- 0.6.0
- What to do
- Update Tawk.To Live Chat to 0.6.0 or newer.
Dec 2, 2021ClickBank Affiliate Ads: Does not have CSRF checkCVE-2015-20105 · WordPress plugins & themes · reported by WPScanCritical 9.6
The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues
- Product
- ClickBank Affiliate Ads
- Affected
- up to 1.20
- What to do
- Affects up to 1.20. Update ClickBank Affiliate Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 29, 2021Contest Gallery: Does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statementCVE-2021-24915 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address
- Product
- Contest Gallery
- Fixed in
- 13.1.0.6
- What to do
- Update Contest Gallery to 13.1.0.6 or newer.
Full record and what to do →NVD recordgist.github.comwpscan.com
Nov 29, 2021Check & Log Email: Does not escape the d parameter before outputting it back in an attributeCVE-2021-24908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Check & Log Email
- Fixed in
- 1.0.4
- What to do
- Update Check & Log Email to 1.0.4 or newer.
Nov 29, 2021Bulk Datetime Change: Does not enforce capability checksCVE-2021-24842 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.
- Product
- Bulk Datetime Change
- Fixed in
- 1.12
- What to do
- Update Bulk Datetime Change to 1.12 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 29, 2021Stylish Cost Calculator: Does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users)CVE-2021-24822 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters
- Product
- Stylish Cost Calculator
- Fixed in
- 7.0.4
- What to do
- Update Stylish Cost Calculator to 7.0.4 or newer.
Nov 29, 2021URL Shortify: Does not have CSRF check in placeCVE-2021-24749 · WordPress plugins & themes · reported by WPScanMedium 4.3
The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.
- Product
- URL Shortify
- Fixed in
- 1.5.1
- What to do
- Update URL Shortify to 1.5.1 or newer.
Nov 23, 2021Download: Does not have capability and CSRF checks in the dpwap_plugin_activate AJAX actionCVE-2021-24703 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.
- Product
- Download
- Fixed in
- 1.6.1
- What to do
- Update Download to 1.6.1 or newer.
Nov 23, 2021MAZ Loader: Does not enforce nonce checksCVE-2021-24668 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack
- Product
- MAZ Loader
- Fixed in
- 1.4.1
- What to do
- Update MAZ Loader to 1.4.1 or newer.
Nov 23, 2021Images to WebP: Does not have CSRF checks in placeCVE-2021-24641 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion
- Product
- Images to WebP
- Fixed in
- 1.9
- What to do
- Update Images to WebP to 1.9 or newer.
Nov 17, 2021QR Redirector: Does not have capability and CSRF checksCVE-2021-24853 · WordPress plugins & themes · reported by WPScanMedium 4.3
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects
- Product
- QR Redirector
- Fixed in
- 1.6
- What to do
- Update QR Redirector to 1.6 or newer.
Nov 17, 2021MouseWheel Smooth Scroll: Does not have CSRF check in place on its settings pageCVE-2021-24852 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- MouseWheel Smooth Scroll
- Fixed in
- 5.7
- What to do
- Update MouseWheel Smooth Scroll to 5.7 or newer.
Nov 17, 2021Simple JWT Login: Does not have nonce checksCVE-2021-24804 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.
- Product
- Simple JWT Login
- Fixed in
- 3.2.1
- What to do
- Update Simple JWT Login to 3.2.1 or newer.
Nov 17, 2021Colorful Categories: Does not enforce nonce checksCVE-2021-24802 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack
- Product
- Colorful Categories
- Fixed in
- 2.0.15
- What to do
- Update Colorful Categories to 2.0.15 or newer.
Nov 17, 2021WP Performance Score Booster: Does not have CSRF checkCVE-2021-24776 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- WP Performance Score Booster
- Fixed in
- 2.1
- What to do
- Update WP Performance Score Booster to 2.1 or newer.
Nov 8, 2021Phoenix Media Rename: Does not have capability checks in its phoenix_media_rename AJAX actionCVE-2021-24816 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own.
- Product
- Phoenix Media Rename
- Fixed in
- 3.4.4
- What to do
- Update Phoenix Media Rename to 3.4.4 or newer.
Nov 8, 2021wpDiscuz: Does check for CSRFCVE-2021-24806 · WordPress plugins & themes · reported by WPScanMedium 4.3
The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment.
- Product
- wpDiscuz
- Fixed in
- 7.3.4
- What to do
- Update wpDiscuz to 7.3.4 or newer.
Nov 8, 2021WP Survey Plus: Does not have any authorisation and CSRF checks in place in its AJAX actionsCVE-2021-24801 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues
- Product
- WP Survey Plus
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Survey Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2021Post Expirator: Does not have proper capability checks in placeCVE-2021-24783 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.
- Product
- Post Expirator
- Fixed in
- 2.6.0
- What to do
- Update Post Expirator to 2.6.0 or newer.
Nov 8, 2021Redirect 404 Error Page to Homepage or Custom Page with Logs: Does not check for CSRFCVE-2021-24767 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
- Product
- Redirect 404 Error Page to Homepage or Custom Page with Logs
- Fixed in
- 1.7.9
- What to do
- Update Redirect 404 Error Page to Homepage or Custom Page with Logs to 1.7.9 or newer.
Nov 8, 2021404 to 301 – Redirect, Log and Notify 404 Errors: Does not have CSRF check in placeCVE-2021-24766 · WordPress plugins & themes · reported by WPScanMedium 6.5
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack
- Product
- 404 to 301 – Redirect, Log and Notify 404 Errors
- Fixed in
- 3.0.9
- What to do
- Update 404 to 301 – Redirect, Log and Notify 404 Errors to 3.0.9 or newer.
Nov 8, 2021Chameleon CSS: Does not have any CSRF and capability checks in all its AJAX callsCVE-2021-24626 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection
- Product
- Chameleon CSS
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Chameleon CSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 5, 2021WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenCVE-2021-42359 · WordPress plugins & themes · reported by WordfenceHigh 7.5
WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.
- Affected
- up to 3.1.23
- What to do
- Affects up to 3.1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Nov 1, 2021BP Better Messages: Does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chatCVE-2021-24809 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions
- Product
- BP Better Messages
- Fixed in
- 1.9.9.41
- What to do
- Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021Far Future Expiry Header: Does not have CSRF checkCVE-2021-24799 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- Far Future Expiry Header
- Fixed in
- 1.5
- What to do
- Update Far Future Expiry Header to 1.5 or newer.
Nov 1, 2021Stylish Price List: Does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users)CVE-2021-24770 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users), which could allow any authenticated users, such as subscriber, to upload arbitrary images.
- Product
- Stylish Price List
- Fixed in
- 6.9.1
- What to do
- Update Stylish Price List to 6.9.1 or newer.
Nov 1, 2021Stylish Price List: Does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users)CVE-2021-24757 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.
- Product
- Stylish Price List
- Fixed in
- 6.9.0
- What to do
- Update Stylish Price List to 6.9.0 or newer.
Nov 1, 2021Logo Slider and Showcase: Allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability checkCVE-2021-24742 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.
- Product
- Logo Slider and Showcase
- Fixed in
- 1.3.37
- What to do
- Update Logo Slider and Showcase to 1.3.37 or newer.
Nov 1, 2021AutomatorWP: Does not perform capability checksCVE-2021-24717 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions.
- Product
- AutomatorWP
- Fixed in
- 1.7.6
- What to do
- Update AutomatorWP to 1.7.6 or newer.
Nov 1, 2021Flat Preloader: Does not enforce nonce checksCVE-2021-24685 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)
- Product
- Flat Preloader
- Fixed in
- 1.5.4
- What to do
- Update Flat Preloader to 1.5.4 or newer.
Nov 1, 2021Delete All Comments Easily: Is lacking Cross-Site Request Forgery (CSRF) checksCVE-2020-36505 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog.
- Product
- Delete All Comments Easily
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Delete All Comments Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2021WP-Pro-Quiz: Does not have CSRF check in placeCVE-2020-36504 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog
- Product
- WP-Pro-Quiz
- Affected
- up to 0.37
- What to do
- Affects up to 0.37. Update WP-Pro-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2021WP-Stats: Does not have CSRF checkCVE-2015-10001 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
- Product
- WP-Stats
- Fixed in
- 2.52
- What to do
- Update WP-Stats to 2.52 or newer.
Full record and what to do →NVD recordwpscan.comopenwall.com
Oct 25, 2021WP Debugging: Has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checksCVE-2021-24779 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.
- Product
- WP Debugging
- Fixed in
- 2.11.0
- What to do
- Update WP Debugging to 2.11.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.