Updated 7 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

38added in the last 30 days

579new WordPress flaws this week

398,769entries in the database

15,638 results · page 291 of 313

Dec 14, 2021Magic Post Voice: Reflected Cross-Site ScriptingCVE-2021-39315 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
Magic Post Voice
Affected
up to 1.2
What to do
Affects up to 1.2. Update Magic Post Voice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021WooCommerce EnvioPack: Reflected Cross-Site ScriptingCVE-2021-39314 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
WooCommerce EnvioPack
Affected
up to 1.2
What to do
Affects up to 1.2. Update WooCommerce EnvioPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Simple Image Gallery: Reflected Cross-Site ScriptingCVE-2021-39313 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
Product
Simple Image Gallery
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Simple Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021link-list-manager: Reflected Cross-Site ScriptingCVE-2021-39311 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
link-list-manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update link-list-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Real WYSIWYG: Reflected Cross-Site ScriptingCVE-2021-39310 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2.
Product
Real WYSIWYG
Affected
up to 0.0.2
What to do
Affects up to 0.0.2. Update Real WYSIWYG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Parsian Bank Gateway for Woocommerce: Reflected Cross-Site ScriptingCVE-2021-39309 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parameter due to a var_dump() on $_POST variables found in the ~/vendor/dpsoft/parsian-payment/sample/rollback-payment.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
Parsian Bank Gateway for Woocommerce
Affected
up to 1.0
What to do
Affects up to 1.0. Update Parsian Bank Gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021WooCommerce myghpay Payment Gateway WordPess: Reflected Cross-Site ScriptingCVE-2021-39308 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the ~/processresponse.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.0.
Product
WooCommerce myghpay Payment Gateway WordPess
Affected
up to 3.0
What to do
Affects up to 3.0. Update WooCommerce myghpay Payment Gateway WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021.htaccess Redirect: Reflected Cross-Site ScriptingCVE-2021-38361 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redirect.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.3.1.
Product
.htaccess Redirect
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update .htaccess Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2021Pixel Cat: Does not escape some of its settingsCVE-2021-24972 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Pixel Cat
Fixed in
2.6.3
What to do
Update Pixel Cat to 2.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021Like Button Rating ♥ LikeBtn: Does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX actionCVE-2021-24945 · WordPress plugins & themes · reported by WPScanHigh 8
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.
Product
Like Button Rating ♥ LikeBtn
Fixed in
2.6.38
What to do
Update Like Button Rating ♥ LikeBtn to 2.6.38 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Auto Featured Image (Auto Post Thumbnail): Does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS blockCVE-2021-24932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue.
Product
Auto Featured Image (Auto Post Thumbnail)
Fixed in
3.9.3
What to do
Update Auto Featured Image (Auto Post Thumbnail) to 3.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
Modern Events Calendar Lite
Fixed in
6.1.5
What to do
Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Caldera Forms: Does not sanitise and escape the Form Name before outputting it in attributesCVE-2021-24896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Caldera Forms
Fixed in
1.9.5
What to do
Update Caldera Forms to 1.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Get Custom Field Values: Does not escape custom fields before outputting them in the pageCVE-2021-24871 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
Get Custom Field Values
Fixed in
4.0.1
What to do
Update Get Custom Field Values to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 10, 2021Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or CVE-2021-36911 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 6, 2021The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcCVE-2021-25041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action
Product
Photo Gallery by 10Web
Fixed in
1.5.68
What to do
Update Photo Gallery by 10Web to 1.5.68 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021LoginWP (Formerly Peter's Login Redirect): Does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin pageCVE-2021-24939 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
LoginWP (Formerly Peter's Login Redirect)
Fixed in
3.0.0.5
What to do
Update LoginWP (Formerly Peter's Login Redirect) to 3.0.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WOOCS: Does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24938 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue
Product
WOOCS
Fixed in
1.3.7.1
What to do
Update WOOCS to 1.3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WP Google Fonts: Does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributesCVE-2021-24935 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues
Product
WP Google Fonts
Fixed in
3.1.5
What to do
Update WP Google Fonts to 3.1.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021WordPress Online Booking and Scheduling: Does not escape the Staff Full Name field before outputting it back in a pageCVE-2021-24930 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue
Product
WordPress Online Booking and Scheduling
Fixed in
20.3.1
What to do
Update WordPress Online Booking and Scheduling to 20.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021Email Log: Does not escape the d parameter before outputting it back in an attribute in the Log pageCVE-2021-24924 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue
Product
Email Log
Fixed in
2.4.8
What to do
Update Email Log to 2.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021Contact Form, Survey & Popup Form Plugin for: Does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-24718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Contact Form, Survey & Popup Form Plugin for
Fixed in
1.5
What to do
Update Contact Form, Survey & Popup Form Plugin for to 1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021Import any XML or CSV File to: Does not escape the Import's Title and Unique Identifier fields before outputting them in admin pagesCVE-2021-24714 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.
Product
Import any XML or CSV File to
Fixed in
3.6.3
What to do
Update Import any XML or CSV File to to 3.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 2, 2021ClickBank Affiliate Ads: Does not escape its settingsCVE-2015-20106 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
ClickBank Affiliate Ads
Affected
up to 1.20
What to do
Affects up to 1.20. Update ClickBank Affiliate Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 1, 2021Events Manager: Does not sanitise and escape some search parameter before outputing them in pagesCVE-2020-35037 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing them in pages, which could lead to Cross-Site Scripting issues
Product
Events Manager
Fixed in
5.9.8
What to do
Update Events Manager to 5.9.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 30, 2021Browser and Operating System Finder versions prior to 1.2: Cross-site request forgery (CSRF)CVE-2021-20851 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.
Product
Browser and Operating System Finder versions prior to 1.2
Fixed in
1.2
What to do
Update Browser and Operating System Finder versions prior to 1.2 to 1.2 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Nov 29, 2021Asgaros Forums: Stored Cross-Site ScriptingCVE-2021-42365 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Asgaros Forums
Affected
up to 1.15.13
What to do
Affects up to 1.15.13. Update Asgaros Forums to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2021My Calendar: Does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24927 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
My Calendar
Fixed in
3.2.18
What to do
Update My Calendar to 3.2.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Smash Balloon Social Post Feed: Did not have any privilege or nonce validation before saving the plugin's settingCVE-2021-24918 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
Product
Smash Balloon Social Post Feed
Fixed in
4.0.1
What to do
Update Smash Balloon Social Post Feed to 4.0.1 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Nov 29, 2021Check & Log Email: Does not escape the d parameter before outputting it back in an attributeCVE-2021-24908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Check & Log Email
Fixed in
1.0.4
What to do
Update Check & Log Email to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Media-Tags: Does not sanitise and escape any of its Labels settingsCVE-2021-24899 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Media-Tags WordPress plugin through 3.2.0.2 does not sanitise and escape any of its Labels settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_htnl capability is disallowed.
Product
Media-Tags
Affected
up to 3.2.0.2
What to do
Affects up to 3.2.0.2. Update Media-Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Registrations for the Events Calendar: Does not escape the v parameter before outputting it back in an attributeCVE-2021-24876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Registrations for the Events Calendar
Fixed in
2.7.5
What to do
Update Registrations for the Events Calendar to 2.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021About Author Box: Does not sanitise and escape the Social Profiles field values before outputting them in attributesCVE-2021-24745 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
About Author Box
Fixed in
1.0.2
What to do
Update About Author Box to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021myCred: Does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboardCVE-2017-20008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting
Product
myCred
Fixed in
1.7.8
What to do
Update myCred to 1.7.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 26, 2021Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id,CVE-2021-36919 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 26, 2021Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media ConfiguCVE-2021-36843 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
Affected
up to 4.3.5
What to do
Affects up to 4.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 24, 2021Booking Package - Appointment Booking Calendar System versions prior to 1.5.11: Cross-site scriptingCVE-2021-20840 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Product
Booking Package - Appointment Booking Calendar System versions prior to 1.5.11
Fixed in
1.5.11
What to do
Update Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 to 1.5.11 or newer.
Full record and what to do →NVD record jvn.jp saasproject.net
Nov 23, 2021Reviews Plus: Does not validate the submitted ratingCVE-2021-24894 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page
Product
Reviews Plus
Fixed in
1.2.14
What to do
Update Reviews Plus to 1.2.14 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 23, 2021ImageBoss: Does not sanitise and escape its Source Name settingCVE-2021-24888 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks
Product
ImageBoss
Fixed in
3.0.6
What to do
Update ImageBoss to 3.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021eCommerce Product Catalog Plugin for: Does not escape the ic-settings-search parameter before outputting it back in the page in an attributeCVE-2021-24875 · WordPress plugins & themes · reported by WPScanMedium 6.1
The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
eCommerce Product Catalog Plugin for
Fixed in
3.0.39
What to do
Update eCommerce Product Catalog Plugin for to 3.0.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021Tutor LMS: Does not sanitise and escape user input before outputting back in attributes in the Student Registration pageCVE-2021-24873 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
Product
Tutor LMS
Fixed in
1.9.11
What to do
Update Tutor LMS to 1.9.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 23, 2021Advanced Access Manager: Does not escape some of its settingsCVE-2021-24830 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Advanced Access Manager
Fixed in
6.8.0
What to do
Update Advanced Access Manager to 6.8.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 23, 2021Logo Showcase with Slick Slider: Does not sanitise the Grid SettingsCVE-2021-24729 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase.
Product
Logo Showcase with Slick Slider
Fixed in
1.2.4
What to do
Update Logo Showcase with Slick Slider to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 19, 2021Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.CVE-2021-36884 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 19, 2021The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (aCVE-2021-43409 · WordPress plugins & themes · reported by info@appcheck-ng.comCritical 9.3
The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data. In this case, the XSS payload can be submitted by any anonymous user, the payload then renders and executes when a WordPress administrator authenticates and accesses the WordPress Dashboard. The injected payload can carry out actions on behalf of the administrator including adding other administrative users and changing application settings. This flaw could be exploited to ultimately provide full control of the affected system to the attacker.
Affected
up to 15.3
What to do
Affects up to 15.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record appcheck-ng.com wpo365.com
Nov 19, 2021Preview E-Mails for WooCommerce: Reflected Cross-Site ScriptingCVE-2021-42363 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8.
Product
Preview E-Mails for WooCommerce
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Preview E-Mails for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 17, 2021Contact Form Email: Stored Cross-Site ScriptingCVE-2021-42361 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Contact Form Email
Affected
up to 1.3.24
What to do
Affects up to 1.3.24. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 17, 2021Shared Files: Does not sanitise and escape the Download Counter Text settingsCVE-2021-24856 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Shared Files
Fixed in
1.6.61
What to do
Update Shared Files to 1.6.61 or newer.
Full record and what to do →NVD record mikadmin.fr wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.