Updated 49 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

38added in the last 30 days

579new WordPress flaws this week

398,769entries in the database

15,638 results · page 292 of 313

Nov 17, 2021MouseWheel Smooth Scroll: Does not have CSRF check in place on its settings pageCVE-2021-24852 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
MouseWheel Smooth Scroll
Fixed in
5.7
What to do
Update MouseWheel Smooth Scroll to 5.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021Helpful: Does not sanitise and escape some of its settingsCVE-2021-24841 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Helpful
Fixed in
4.4.59
What to do
Update Helpful to 4.4.59 or newer.
Full record and what to do →NVD record mikadmin.fr wpscan.com
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24834 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of custom label parameters - vote button label , results link label and back to vote caption label.
Product
YOP Poll
Fixed in
6.3.1
What to do
Update YOP Poll to 6.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.
Product
YOP Poll
Fixed in
6.3.1
What to do
Update YOP Poll to 6.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
Product
My Tickets
Fixed in
1.8.31
What to do
Update My Tickets to 1.8.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021Client Invoicing by Sprout Invoices: Does not sanitise and escape some of its settingsCVE-2021-24787 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Client Invoicing by Sprout Invoices
Fixed in
19.9.7
What to do
Update Client Invoicing by Sprout Invoices to 19.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 15, 2021plugins/wordpress_sso/pages/index.php: ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site ScriptingCVE-2021-41951 · WordPress plugins & themes · reported by MITREMedium 6.1
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.
Product
plugins/wordpress_sso/pages/index.php
Fixed in
9.6
What to do
Update plugins/wordpress_sso/pages/index.php to 9.6 or newer.
Full record and what to do →NVD record horizon3.ai horizon3.ai
Nov 8, 2021The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with aCVE-2021-24835 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawal_vendor parameter before using it in a SQL statement, allowing low privilege users such as Subscribers to perform SQL injection attacks
Product
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Fixed in
6.5.12
What to do
Update WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible to 6.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Support Board: Allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes fieldCVE-2021-24807 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
Product
Support Board
Fixed in
3.3.5
What to do
Update Support Board to 3.3.5 or newer.
Full record and what to do →NVD record github.com medium.com
Nov 8, 2021WP Header Images: Does not sanitise and escape the t parameter before outputting it back in the plugin's settings pageCVE-2021-24798 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page, leading to a Reflected Cross-Site Scripting issue
Product
WP Header Images
Fixed in
2.0.1
What to do
Update WP Header Images to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Print-O-Matic: Does not escape some of its settings before outputting them in attributeCVE-2021-24710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Print-O-Matic
Fixed in
2.0.3
What to do
Update Print-O-Matic to 2.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Export any WordPress data to XML/CSV: Does not escape its Export's Name before outputting it in Manage Exports settingsCVE-2021-24708 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Export any WordPress data to XML/CSV
Fixed in
1.3.1
What to do
Update Export any WordPress data to XML/CSV to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Qwizcards – online quizzes and flashcards: Does not properly sanitize and escape some of its settingsCVE-2021-24706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Qwizcards – online quizzes and flashcards
Fixed in
3.62
What to do
Update Qwizcards – online quizzes and flashcards to 3.62 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Simple Download Monitor: Does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributesCVE-2021-24697 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Simple Download Monitor
Fixed in
3.9.5
What to do
Update Simple Download Monitor to 3.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Simple Download Monitor: Does not escape the "File Thumbnail" post meta before outputting it in some pagesCVE-2021-24693 · WordPress plugins & themes · reported by WPScanCritical 9
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the Download is in a review state, contributor could make JavaScript code execute in a context of a reviewer such as admin and make them create a rogue admin account, or install a malicious plugin
Product
Simple Download Monitor
Fixed in
3.9.5
What to do
Update Simple Download Monitor to 3.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021School Management System – WPSchoolPress: Sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributesCVE-2021-24664 · WordPress plugins & themes · reported by WPScanMedium 4.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
Product
School Management System – WPSchoolPress
Fixed in
2.1.17
What to do
Update School Management System – WPSchoolPress to 2.1.17 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Nov 8, 2021AddToAny Share Buttons: Does not escape its Image URL button settingCVE-2021-24616 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
AddToAny Share Buttons
Fixed in
1.7.48
What to do
Update AddToAny Share Buttons to 1.7.48 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Translate WordPress – Google Language Translator: Does not sanitise and escape some of its settings before outputting it in various pagesCVE-2021-24594 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Translate WordPress – Google Language Translator
Fixed in
6.0.12
What to do
Update Translate WordPress – Google Language Translator to 6.0.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 1, 2021Google Maps Easy: Stored Cross-Site ScriptingCVE-2021-39346 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/modules/marker_groups/views/tpl/mgrEditMarkerGroup.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.9.33. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Google Maps Easy
Affected
up to 1.9.33
What to do
Affects up to 1.9.33. Update Google Maps Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 1, 2021OptinMonster: Sensitive information disclosure and unauthorized setting updatesCVE-2021-39341 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.
Product
OptinMonster
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2021Notification: Stored Cross-Site ScriptingCVE-2021-39340 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/classes/Utils/Settings.php file which made it possible for attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 7.2.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Notification
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 1, 2021NextScripts: Social Networks Auto-Poster <= 4.3.20: Reflected Cross-Site ScriptingCVE-2021-38356 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['page'] parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load the page in $_GET['page'] along with malicious JavaScript in $_POST['page'].
Product
NextScripts: Social Networks Auto-Poster <= 4.3.20
Affected
up to 4.3.20
What to do
Affects up to 4.3.20. Update NextScripts: Social Networks Auto-Poster <= 4.3.20 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Nov 1, 2021BP Better Messages: Sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attributeCVE-2021-24808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
BP Better Messages
Fixed in
1.9.9.41
What to do
Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 1, 2021Connections Business Directory: Does not escape the Address settingsCVE-2021-24794 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed.
Product
Connections Business Directory
Fixed in
10.4.3
What to do
Update Connections Business Directory to 10.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WPeMatico RSS Feed Fetcher: Does not escape the Feed URL added to a campaign before outputting it in an attributeCVE-2021-24793 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.6.12
What to do
Update WPeMatico RSS Feed Fetcher to 2.6.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Flat Preloader: Does not escape some of its settingsCVE-2021-24789 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Flat Preloader
Fixed in
1.5.5
What to do
Update Flat Preloader to 1.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WordPress Download Manager: Does not escape some of the Download settingsCVE-2021-24773 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed
Product
WordPress Download Manager
Fixed in
3.2.16
What to do
Update WordPress Download Manager to 3.2.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Logo Slider and Showcase: Allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability checkCVE-2021-24742 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.
Product
Logo Slider and Showcase
Fixed in
1.3.37
What to do
Update Logo Slider and Showcase to 1.3.37 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
Product
Modern Events Calendar Lite
Fixed in
5.22.3
What to do
Update Modern Events Calendar Lite to 5.22.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021WP Sitemap Page: Does not properly sanitise and escape some of its settingsCVE-2021-24715 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WP Sitemap Page
Fixed in
1.7.0
What to do
Update WP Sitemap Page to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021MP3 Audio Player for Music, Radio & Podcast by Sonaar: Does not properly sanitize or escape data in some of its Playlist settingsCVE-2021-24624 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Fixed in
2.4.2
What to do
Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Coming Soon, Under Construction & Maintenance Mode By Dazzler: Does not sanitise or escape its description settingCVE-2021-24539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
Coming Soon, Under Construction & Maintenance Mode By Dazzler
Fixed in
1.6.7
What to do
Update Coming Soon, Under Construction & Maintenance Mode By Dazzler to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Content text slider on post: Does not sanitise and escape the Title and Message/Content settingsCVE-2015-20019 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues
Product
Content text slider on post
Fixed in
6.9
What to do
Update Content text slider on post to 6.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org seclists.org
Oct 25, 2021YOP Poll: Does not escape the perpage parameter before outputting it back in an attributeCVE-2021-24885 · WordPress plugins & themes · reported by WPScanMedium 6.1
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
YOP Poll
Fixed in
6.1.2
What to do
Update YOP Poll to 6.1.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 25, 2021WP Debugging: Has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checksCVE-2021-24779 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.
Product
WP Debugging
Fixed in
2.11.0
What to do
Update WP Debugging to 2.11.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021WordPress Contact Forms by Cimatti: Does not sanitise and escape the Form Title before outputting it in some admin pagesCVE-2021-24744 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
WordPress Contact Forms by Cimatti
Fixed in
1.4.12
What to do
Update WordPress Contact Forms by Cimatti to 1.4.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Cookie Bar: Doesn't properly sanitise the Cookie Bar Message settingCVE-2021-24653 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cookie Bar WordPress plugin before 1.8.9 doesn't properly sanitise the Cookie Bar Message setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Cookie Bar
Fixed in
1.8.9
What to do
Update Cookie Bar to 1.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Video Gallery: Does not escape the Title and Description of the videos in a gallery before outputting them in attributesCVE-2021-24515 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues
Product
Video Gallery
Fixed in
1.1.5
What to do
Update Video Gallery to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Special Text Boxes: Does not sanitise or escape some of its settingsCVE-2021-24485 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Special Text Boxes WordPress plugin before 5.9.110 does not sanitise or escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
Special Text Boxes
Fixed in
5.9.110
What to do
Update Special Text Boxes to 5.9.110 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 21, 2021WordPress Ivory Search: Reflected Cross-Site Scripting (XSS)CVE-2021-36869 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post.
Product
WordPress Ivory Search
Affected
up to 4.6.6
What to do
Affects up to 4.6.6. Update WordPress Ivory Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Oct 21, 2021Leaky Paywall: Stored Cross-Site ScriptingCVE-2021-39357 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the ~/class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.16.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Leaky Paywall
Affected
up to 4.16.5
What to do
Affects up to 4.16.5. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 21, 2021Content Staging: Stored Cross-Site ScriptingCVE-2021-39356 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Content Staging WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via several parameters that are echo'd out via the ~/templates/settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Content Staging
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Content Staging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 21, 2021Easy Digital Downloads: Reflected Cross-Site ScriptingCVE-2021-39354 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.
Product
Easy Digital Downloads
Affected
up to 2.11.2
What to do
Affects up to 2.11.2. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 21, 2021LearnPress: Stored Cross-Site ScriptingCVE-2021-39348 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Please note that this is seperate from CVE-2021-24702.
Product
LearnPress
Affected
up to 4.1.3.1
What to do
Affects up to 4.1.3.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 21, 2021Simple Job Board: Stored Cross-Site ScriptingCVE-2021-39328 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Simple Job Board
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 19, 2021Indeed Job Importer: Stored Cross-Site ScriptingCVE-2021-39355 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Indeed Job Importer WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/indeed-job-importer/trunk/indeed-job-importer.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Indeed Job Importer
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Indeed Job Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 19, 2021MPL-Publisher: Stored Cross-Site ScriptingCVE-2021-39343 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/libs/PublisherController.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.30.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
MPL-Publisher
Affected
up to 1.30.2
What to do
Affects up to 1.30.2. Update MPL-Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 19, 2021JobBoardWP: Stored Cross-Site ScriptingCVE-2021-39329 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-metabox.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
JobBoardWP
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update JobBoardWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 19, 2021WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.CVE-2021-36832 · WordPress plugins & themes · reported by PatchstackMedium 4.8
WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Oct 18, 2021Podcast Subscribe Buttons: Allows users with any role capable of editing or adding posts to perform stored XSSCVE-2021-24743 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS.
Product
Podcast Subscribe Buttons
Fixed in
1.4.2
What to do
Update Podcast Subscribe Buttons to 1.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.