Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,456 results · page 28 of 30
Oct 25, 2021Check & Log Email: Does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statementCVE-2021-24774 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
- Product
- Check & Log Email
- Fixed in
- 1.0.3
- What to do
- Update Check & Log Email to 1.0.3 or newer.
Oct 25, 2021jQuery Reply to Comment: Does not have any CSRF checkCVE-2021-24543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
- Product
- jQuery Reply to Comment
- Affected
- up to 1.31
- What to do
- Affects up to 1.31. Update jQuery Reply to Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021St-Daily-Tip: Does not have any CSRF check in placeCVE-2021-24487 · WordPress plugins & themes · reported by WPScanHigh 8.8
The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue
- Product
- St-Daily-Tip
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update St-Daily-Tip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users,CVE-2021-24752 · WordPress plugins & themes · reported by WPScanMedium 5.7
Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.
- Product
- ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets
- Fixed in
- 1.9
- What to do
- Update ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets to 1.9 or newer.
Oct 18, 2021Compact WP Audio Player: Does not implement nonce checksCVE-2021-24735 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack.
- Product
- Compact WP Audio Player
- Fixed in
- 1.9.7
- What to do
- Update Compact WP Audio Player to 1.9.7 or newer.
Oct 18, 2021Find My Blocks: Does not have authorisation checks in its REST APICVE-2021-24677 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.
- Product
- Find My Blocks
- Fixed in
- 3.4.0
- What to do
- Update Find My Blocks to 3.4.0 or newer.
Oct 18, 2021One User Avatar: Does not check for CSRFCVE-2021-24675 · WordPress plugins & themes · reported by WPScanMedium 6.5
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack
- Product
- One User Avatar
- Fixed in
- 2.3.7
- What to do
- Update One User Avatar to 2.3.7 or newer.
Oct 18, 2021Scroll Baner: Does not have CSRF check in placeCVE-2021-24642 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS
- Product
- Scroll Baner
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Scroll Baner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Wp Cookie Choice: Is lacking any CSRF checkCVE-2021-24595 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack.
- Product
- Wp Cookie Choice
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Wp Cookie Choice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admCVE-2021-38345 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127.
- Product
- Brizy Page Builder
- Affected
- up to 2.3.11
- Fixed in
- 1.0.126
- What to do
- Update Brizy Page Builder to 1.0.126 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Oct 11, 2021del_reistered_domains AJAX action of the Software License Manager: Does not have any CSRF checksCVE-2021-24711 · WordPress plugins & themes · reported by WPScanHigh 8.8
The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack
- Product
- del_reistered_domains AJAX action of the Software License Manager
- Fixed in
- 4.5.1
- What to do
- Update del_reistered_domains AJAX action of the Software License Manager to 4.5.1 or newer.
Oct 11, 2021Weather Effect: Does not have any CSRF checks in placeCVE-2021-24683 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.
- Product
- Weather Effect
- Fixed in
- 1.3.4
- What to do
- Update Weather Effect to 1.3.4 or newer.
Oct 4, 2021The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.pCVE-2021-39347 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
- Affected
- 3.0.0 to 3.3.9
- What to do
- Affects 3.0.0 to 3.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 27, 2021Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pagCVE-2021-36876 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pages.
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 27, 2021PostX – Gutenberg Blocks for Post Grid: Performs incorrect checks before allowing any logged in user to perform some ajax based requestsCVE-2021-24652 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.
- Product
- PostX – Gutenberg Blocks for Post Grid
- Fixed in
- 2.4.10
- What to do
- Update PostX – Gutenberg Blocks for Post Grid to 2.4.10 or newer.
Sep 20, 2021Print My Blog: Does not enforce nonce (CSRF) checksCVE-2021-24636 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Print My Blog WordPress Plugin before 3.4.2 does not enforce nonce (CSRF) checks, which allows attackers to make logged in administrators deactivate the Print My Blog plugin and delete all saved data for that plugin by tricking them to open a malicious link
- Product
- Print My Blog
- Fixed in
- 3.4.2
- What to do
- Update Print My Blog to 3.4.2 or newer.
Sep 20, 2021check_order function of The Sorter: Uses an `area_id` parameterCVE-2021-24399 · WordPress plugins & themes · reported by WPScanHigh 7.2
The check_order function of The Sorter WordPress plugin through 1.0 uses an `area_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- check_order function of The Sorter
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update check_order function of The Sorter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 13, 2021Comment Link Remove and Other Comment Tools: Does not have CSRF check in its 'Delete comments easily'CVE-2021-24725 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments
- Product
- Comment Link Remove and Other Comment Tools
- Fixed in
- 2.1.6
- What to do
- Update Comment Link Remove and Other Comment Tools to 2.1.6 or newer.
Full record and what to do →NVD recordwpscan.comtrustwave.com
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
- Product
- WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Per page add to head: Is lacking any CSRF checkCVE-2021-24586 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.
- Product
- Per page add to head
- Fixed in
- 1.4.4
- What to do
- Update Per page add to head to 1.4.4 or newer.
Sep 13, 2021Fileviewer: Does not have CSRF checks in placeCVE-2021-24491 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack
- Product
- Fileviewer
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Fileviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Email Artillery (MASS EMAIL): Does not properly check the uploaded files from the Import Emails featureCVE-2021-24490 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS
- Product
- Email Artillery (MASS EMAIL)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Email Artillery (MASS EMAIL) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2021The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered underCVE-2021-38312 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.
- Product
- Gutenberg Template Library & Redux Framework
- Affected
- up to 4.2.11
- What to do
- Affects up to 4.2.11. Update Gutenberg Template Library & Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Aug 23, 2021Contact Form 7 Captcha: Does not have any CSRF check in placeCVE-2021-24565 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.
- Product
- Contact Form 7 Captcha
- Fixed in
- 0.0.9
- What to do
- Update Contact Form 7 Captcha to 0.0.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 16, 2021Custom Login Redirect: Does not have CSRF check in placeCVE-2021-24536 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue
- Product
- Custom Login Redirect
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Custom Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021Light Messages: Is lacking CSRF checkCVE-2021-24535 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin's settings), or both frontend and backend.
- Product
- Light Messages
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Light Messages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021Verse-O-Matic: Does not have any CSRF checks in placeCVE-2021-24466 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this could also lead to Stored Cross-Site Scripting issues
- Product
- Verse-O-Matic
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update Verse-O-Matic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021Social Tape: Does not have CSRF checks in placeCVE-2021-24411 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack
- Product
- Social Tape
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Social Tape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021తెలుగు బైబిల్ వచనములు: Is lacking any CSRF checkCVE-2021-24410 · WordPress plugins & themes · reported by WPScanMedium 6.1
The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or escape them when outputting them back in the page. This could allow attackers to make a logged in admin change the settings, as well as add malicious verses containing JavaScript code in them, leading to Stored XSS issues
- Product
- తెలుగు బైబిల్ వచనములు
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update తెలుగు బైబిల్ వచనములు to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021Shantz WordPress QOTD: Is lacking any CSRF checkCVE-2021-24380 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.
- Product
- Shantz WordPress QOTD
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Shantz WordPress QOTD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 9, 2021Workreap: Had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations suchCVE-2021-24501 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site.
- Product
- Workreap
- Fixed in
- 2.2.2
- What to do
- Update Workreap to 2.2.2 or newer.
Aug 9, 2021Workreap: AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checksCVE-2021-24499 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.
- Product
- Workreap
- Fixed in
- 2.2.2
- What to do
- Update Workreap to 2.2.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comjetpack.com
Jul 6, 2021Easy Cookies Policy: Is lacking any capability and CSRF checkCVE-2021-24405 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (such as subscriber) to change them. If users can't register, this can be done through CSRF. Furthermore, the cookie banner setting is not sanitised or validated before being output in all pages of the frontend and the backend settings one, leading to a Stored Cross-Site Scripting issue.
- Product
- Easy Cookies Policy
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Easy Cookies Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 21, 2021Autoptimize: Does not check for malicious files suchCVE-2021-24378 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
- Product
- Autoptimize
- Fixed in
- 2.7.8
- What to do
- Update Autoptimize to 2.7.8 or newer.
Jun 14, 2021Plus Addons for Elementor Page Builder: Did not properly check that a user requesting a password reset was the legitimate userCVE-2021-24359 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
- Product
- Plus Addons for Elementor Page Builder
- Fixed in
- 4.1.11
- What to do
- Update Plus Addons for Elementor Page Builder to 4.1.11 or newer.
Full record and what to do →NVD recordtheplusaddons.comwpscan.com
Jun 14, 2021In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301CVE-2021-24356 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.
- Product
- Simple 301 Redirects by BetterLinks
- Fixed in
- 2.0.4
- What to do
- Update Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jun 14, 2021In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simpleCVE-2021-24355 · WordPress plugins & themes · reported by WPScanMedium 4.3
In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects.
- Product
- Simple 301 Redirects by BetterLinks
- Fixed in
- 2.0.4
- What to do
- Update Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jun 14, 2021A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it poCVE-2021-24354 · WordPress plugins & themes · reported by WPScanHigh 8.8
A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites.
- Product
- Simple 301 Redirects by BetterLinks
- Fixed in
- 2.0.4
- What to do
- Update Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jun 14, 2021import_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirectsCVE-2021-24353 · WordPress plugins & themes · reported by WPScanHigh 8.8
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
- Product
- import_data function of the Simple 301 Redirects by BetterLinks
- Fixed in
- 2.0.4
- What to do
- Update import_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jun 14, 2021export_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to export a site's redirectsCVE-2021-24352 · WordPress plugins & themes · reported by WPScanHigh 8.8
The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.
- Product
- export_data function of the Simple 301 Redirects by BetterLinks
- Fixed in
- 2.0.4
- What to do
- Update export_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jun 1, 2021Content Copy Protection & Prevent Image Save: Does not check for CSRFCVE-2021-24333 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.
- Product
- Content Copy Protection & Prevent Image Save
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Content Copy Protection & Prevent Image Save to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2021WP Login Security and History: Did not have CSRF checkCVE-2021-24328 · WordPress plugins & themes · reported by WPScanMedium 6.2
The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well
- Product
- WP Login Security and History
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Login Security and History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2021404 SEO Redirection: Is lacking CSRF checks in all its settingsCVE-2021-24324 · WordPress plugins & themes · reported by WPScanMedium 6.5
The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues
- Product
- 404 SEO Redirection
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update 404 SEO Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.4
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
May 14, 2021settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24287 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
- Product
- settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
- Fixed in
- 1.3.2
- What to do
- Update settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons to 1.3.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 6, 2021College publisher Import: Does not check for the uploaded CSV file to importCVE-2021-24254 · WordPress plugins & themes · reported by WPScanHigh 7.2
The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.
- Product
- College publisher Import
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update College publisher Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2021Classyfrieds: Does not properly check the uploaded fileCVE-2021-24253 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.
- Product
- Classyfrieds
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Classyfrieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Did not properly check for imported filesCVE-2021-24248 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11.1
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11.1 or newer.
May 6, 2021Contact Form Check Tester: Settings are visible to all registered users in the dashboard and are lacking any sanitisationCVE-2021-24247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
- Product
- Contact Form Check Tester
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Contact Form Check Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2021An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low prCVE-2021-24244 · WordPress plugins & themes · reported by WPScanMedium 6.5
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).
- Fixed in
- 4.5.8
- What to do
- Update the plugin to 4.5.8 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.