Updated 10 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,508 results · page 29 of 31

Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4211 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4210 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4209 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4208 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Nov 29, 2022Quiz and Survey Master: Input validation bypassCVE-2022-4033 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type.
Product
Quiz and Survey Master
Affected
up to 8.0.4
What to do
Affects up to 8.0.4. Update Quiz and Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Quiz and Survey Master: IFrame InjectionCVE-2022-4032 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execute whenever a user accesses an injected page.
Product
Quiz and Survey Master
Affected
up to 8.0.4
What to do
Affects up to 8.0.4. Update Quiz and Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 28, 2022Download: Does not properly validate a user has the required privileges to access a backup's nonce identifierCVE-2021-25059 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.
Product
Download
Fixed in
2.0.0
What to do
Update Download to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 18, 2022Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-42883 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.
Affected
up to 7.3.10
What to do
Affects up to 7.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-41652 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
Affected
up to 7.3.10
What to do
Affects up to 7.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 14, 2022tagDiv Composer WordPress plugin before 3.5, required by the Newspaper: And Newsmag WordPress theme before 5CVE-2022-3477 · WordPress plugins & themes · reported by WPScanCritical 9.8
The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address
Product
tagDiv Composer WordPress plugin before 3.5, required by the Newspaper
Fixed in
3.5
What to do
Update tagDiv Composer WordPress plugin before 3.5, required by the Newspaper to 3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 3, 2022Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.CVE-2021-36906 · WordPress plugins & themes · reported by PatchstackLow 2.7
Multiple Insecure Direct Object References (IDOR) vulnerabilities in ExpressTech Quiz And Survey Master plugin <= 7.3.6 on WordPress.
Affected
up to 7.3.6
What to do
Affects up to 7.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 30, 2022ExpressTech Quiz And Survey Master plugin <= 7.3.4 at: Insecure direct object references (IDOR)CVE-2021-36865 · WordPress plugins & themes · reported by PatchstackLow 3.8
Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.
Product
ExpressTech Quiz And Survey Master plugin <= 7.3.4 at
Affected
up to 7.3.4
What to do
Affects up to 7.3.4. Update ExpressTech Quiz And Survey Master plugin <= 7.3.4 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 16, 2022Classima: And some of its required plugins (Classified Listing before 2CVE-2022-2654 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting
Product
Classima
Fixed in
2.1.11
What to do
Update Classima to 2.1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 16, 2022Mobile Events Manager: Does not properly escape the Enquiry source fieldCVE-2022-1194 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
Product
Mobile Events Manager
Fixed in
1.4.8
What to do
Update Mobile Events Manager to 1.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022WPIDE: Does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboardCVE-2022-2261 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue.
Product
WPIDE
Fixed in
3.0
What to do
Update WPIDE to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022mTouch Quiz: Does not sanitise and escape some of its settingsCVE-2022-2410 · WordPress plugins & themes · reported by WPScanMedium 4.8
The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
mTouch Quiz
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update mTouch Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022CAPTCHA 4WP: Lets user input reach a sensitive require_once call in one of its admin-side templatesCVE-2022-2184 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.
Product
CAPTCHA 4WP
Fixed in
7.1.0
What to do
Update CAPTCHA 4WP to 7.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 20, 2022Quick Restaurant Reservations (WordPress plugin): Cross-site Scripting (XSS)CVE-2022-29923 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This issue affects Quick Restaurant Reservations (WordPress plugin): from n/a through 1.4.1.
Product
Quick Restaurant Reservations (WordPress plugin)
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Quick Restaurant Reservations (WordPress plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2022Quick Subscribe: Does not have CSRF check in placeCVE-2022-1792 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them
Product
Quick Subscribe
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Quick Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2022-27854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher role via &wpt_test_page_submit_button_caption parameter.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2021-36867 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher user rights.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022Cab fare calculator: Does not validate the controller parameter before using it in require statementsCVE-2022-1391 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.
Product
Cab fare calculator
Fixed in
1.0.4
What to do
Update Cab fare calculator to 1.0.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Apr 4, 2022Booking Package: Requires a token for exporting the ical representation of it's booking calendarCVE-2022-0709 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
Product
Booking Package
Fixed in
1.5.29
What to do
Update Booking Package to 1.5.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Narnoo Distributor: Fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticatCVE-2022-0679 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.
Product
Narnoo Distributor
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Narnoo Distributor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user)CVE-2022-0397 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Product
WPC Smart Wishlist for WooCommerce
Fixed in
2.9.4
What to do
Update WPC Smart Wishlist for WooCommerce to 2.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2022SEO Plugin by Squirrly SEO: Does not escape the type parameter before outputting it back in an attribute in an admin pageCVE-2021-25019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
SEO Plugin by Squirrly SEO
Fixed in
11.1.12
What to do
Update SEO Plugin by Squirrly SEO to 11.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Popup Builder: Does not validate and sanitise the sgpb_type parameter before using it in a require statementCVE-2021-25082 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
Product
Popup Builder
Fixed in
4.0.7
What to do
Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 17, 2022The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nCVE-2022-0633 · WordPress plugins & themes · reported by WPScanMedium 6.5
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
Fixed in
1.22.3
What to do
Update the plugin to 1.22.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com jetpack.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Stored cross-site scriptingCVE-2022-0182 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Reflected cross-site scriptingCVE-2022-0181 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Cross-site request forgery (CSRF)CVE-2022-0180 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Jan 3, 2022LiteSpeed Cache: Does not properly verify that requests are coming from QUICCVE-2021-24964 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
Product
LiteSpeed Cache
Fixed in
4.4.4
What to do
Update LiteSpeed Cache to 4.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021All-in-One Video Gallery: Does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboardCVE-2021-24970 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue
Product
All-in-One Video Gallery
Fixed in
2.5.0
What to do
Update All-in-One Video Gallery to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Qwizcards – online quizzes and flashcards: Does not properly sanitize and escape some of its settingsCVE-2021-24706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Qwizcards – online quizzes and flashcards
Fixed in
3.62
What to do
Update Qwizcards – online quizzes and flashcards to 3.62 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Quiz Tool Lite: Does not sanitize multiple input fields usedCVE-2021-24701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in other setting options, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Quiz Tool Lite
Affected
up to 2.3.15
What to do
Affects up to 2.3.15. Update Quiz Tool Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WP-Pro-Quiz: Does not have CSRF check in placeCVE-2020-36504 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow an attacker to make a logged in admin delete arbitrary quiz on the blog
Product
WP-Pro-Quiz
Affected
up to 0.37
What to do
Affects up to 0.37. Update WP-Pro-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com wpscan.com
Oct 25, 2021Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for: Does not sanitise and escape its Form's LabelsCVE-2021-24608 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for
Fixed in
5.0.07
What to do
Update Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for to 5.0.07 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 11, 2021Quiz And Survey Master: Does not escape the Quiz Url Slug setting before outputting it in some pagesCVE-2021-24691 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Quiz And Survey Master
Fixed in
7.3.2
What to do
Update Quiz And Survey Master to 7.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Chained Quiz: Does not properly sanitize or escape inputs in the plugin's settingsCVE-2021-24690 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings.
Product
Chained Quiz
Fixed in
1.2.7.2
What to do
Update Chained Quiz to 1.2.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021Email Encoder – Protect Email Addresses: Has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the dataCVE-2021-24599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data.
Product
Email Encoder – Protect Email Addresses
Fixed in
2.1.2
What to do
Update Email Encoder – Protect Email Addresses to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021HD Quiz: Does not escape some of its Answers before outputting them in attributeCVE-2021-24571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to Stored Cross-Site Scripting issues
Product
HD Quiz
Fixed in
1.8.4
What to do
Update HD Quiz to 1.8.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 18, 2021Quiz And Survey Master versions prior to 7.1.14: Cross-site scriptingCVE-2021-20792 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.
Product
Quiz And Survey Master versions prior to 7.1.14
Fixed in
7.1.14
What to do
Update Quiz And Survey Master versions prior to 7.1.14 to 7.1.14 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Aug 2, 2021Quiz Maker: Did not properly sanitise and escape the order and orderby parameters before using them in SQL statementsCVE-2021-24456 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard
Product
Quiz Maker
Fixed in
6.2.0.9
What to do
Update Quiz Maker to 6.2.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 6, 2021Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPCVE-2021-24375 · WordPress plugins & themes · reported by WPScanCritical 9.8
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.
Product
Motor
Fixed in
3.1.0
What to do
Update Motor to 3.1.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Jun 20, 2021Quiz And Survey Master – Best Quiz, Exam and Survey: Did not sanitise or escape its result_id parameterCVE-2021-24368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link
Product
Quiz And Survey Master – Best Quiz, Exam and Survey
Fixed in
7.1.18
What to do
Update Quiz And Survey Master – Best Quiz, Exam and Survey to 7.1.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2021Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: Did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attributeCVE-2021-24221 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
Product
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for
Fixed in
7.1.12
What to do
Update Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for to 7.1.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 5, 2021tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24186 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24183 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution: Was vulnerable to UNION based SQL injection that could be exploited by studentsCVE-2021-24182 · WordPress plugins & themes · reported by WPScanMedium 6.5
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Product
tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution
Fixed in
1.8.3
What to do
Update tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021REST API endpoint get_users in the User Profile Picture: Returned more information than was required for its functionality to users with the upload_files capabilityCVE-2021-24170 · WordPress plugins & themes · reported by WPScanHigh 7.5
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
Product
REST API endpoint get_users in the User Profile Picture
Fixed in
2.5.0
What to do
Update REST API endpoint get_users in the User Profile Picture to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.