Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,638 results · page 294 of 313
Sep 20, 2021Post Views Counter: Does not sanitise or escape its Post Views Label settingsCVE-2021-24613 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
- Product
- Post Views Counter
- Fixed in
- 1.3.5
- What to do
- Update Post Views Counter to 1.3.5 or newer.
Sep 20, 2021WP Mapa Politico Espana: Does not sanitise or escape some of its settings before outputting them in attributesCVE-2021-24609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP Mapa Politico Espana
- Fixed in
- 3.7.0
- What to do
- Update WP Mapa Politico Espana to 3.7.0 or newer.
Sep 20, 2021Availability Calendar: Does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embedCVE-2021-24604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Availability Calendar
- Fixed in
- 1.2.2
- What to do
- Update Availability Calendar to 1.2.2 or newer.
Sep 20, 2021WP Dialog: Does not sanitise and escape some of its settings before outputting them in pagesCVE-2021-24600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Dialog
- Affected
- up to 1.2.5.5
- What to do
- Affects up to 1.2.5.5. Update WP Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021You Shang: Does not escape its qrcode links settingsCVE-2021-24597 · WordPress plugins & themes · reported by WPScanMedium 5.4
The You Shang WordPress plugin through 1.0.1 does not escape its qrcode links settings, which result into Stored Cross-Site Scripting issues in frontend posts and the plugins settings page depending on the payload used
- Product
- You Shang
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update You Shang to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021Splash Header: Doesn't sanitise and escape some of its settings while outputting them in the admin dashboardCVE-2021-24587 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.
- Product
- Splash Header
- Fixed in
- 1.20.8
- What to do
- Update Splash Header to 1.20.8 or newer.
Sep 20, 2021ThinkTwit: Did not sanitise or escape its "Consumer key" setting before outputting it its settings pageCVE-2021-24582 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it its settings page, leading to a Stored Cross-Site Scripting issue.
- Product
- ThinkTwit
- Fixed in
- 1.7.1
- What to do
- Update ThinkTwit to 1.7.1 or newer.
Sep 20, 2021Alojapro Widget: Doesn't properly sanitise its Custom CSS settingsCVE-2021-24530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Alojapro Widget
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update Alojapro Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before insertinCVE-2021-24403 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
- Product
- Orders functionality in the WordPress Page Contact
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Orders functionality in the WordPress Page Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 20, 2021A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statemeCVE-2021-24396 · WordPress plugins & themes · reported by WPScanHigh 7.2
A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- GSEOR – WordPress SEO
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update GSEOR – WordPress SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 13, 2021Per page add to head: Does not properly sanitise one of its settingCVE-2021-24619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
- Product
- Per page add to head
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Per page add to head to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Book appointment online: Does not sanitise or escape Service Prices before outputting it in the ListCVE-2021-24614 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Book appointment online
- Fixed in
- 1.39
- What to do
- Update Book appointment online to 1.39 or newer.
Sep 13, 2021create_post_page AJAX action of the Custom Post View Generator: (available to authenticated user) does not sanitise or escape user input before outputting it back in the responseCVE-2021-24605 · WordPress plugins & themes · reported by WPScanMedium 5.4
The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue
- Product
- create_post_page AJAX action of the Custom Post View Generator
- Affected
- up to 0.4.6
- What to do
- Affects up to 0.4.6. Update create_post_page AJAX action of the Custom Post View Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Software License Manager: Does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboardCVE-2021-24560 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Software License Manager
- Fixed in
- 4.4.8
- What to do
- Update Software License Manager to 4.4.8 or newer.
Sep 13, 2021Daily Prayer Time: Does not sanitise or escape some of its settings before outputting them in the pageCVE-2021-24523 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.
- Product
- Daily Prayer Time
- Fixed in
- 2021.08.10
- What to do
- Update Daily Prayer Time to 2021.08.10 or newer.
Sep 13, 2021MF Gig Calendar: Does not sanitise and escape the id GET parameter before outputting back in the admin dashboardCVE-2021-24510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
- Product
- MF Gig Calendar
- Fixed in
- 1.2
- What to do
- Update MF Gig Calendar to 1.2 or newer.
Sep 13, 2021Smash Balloon Social Post Feed: Does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of iCVE-2021-24508 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 2.19.2
- What to do
- Update Smash Balloon Social Post Feed to 2.19.2 or newer.
Sep 10, 2021WordPress InviteBox Plugin for viral Refer-a-Friend Promotions: Reflected Cross-Site ScriptingCVE-2021-38359 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1.
- Product
- WordPress InviteBox Plugin for viral Refer-a-Friend Promotions
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update WordPress InviteBox Plugin for viral Refer-a-Friend Promotions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021MoolaMojo: Reflected Cross-Site ScriptingCVE-2021-38358 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1.
- Product
- MoolaMojo
- Affected
- up to 0.7.4.1
- What to do
- Affects up to 0.7.4.1. Update MoolaMojo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021SMS OVH: Reflected Cross-Site ScriptingCVE-2021-38357 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.
- Product
- SMS OVH
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update SMS OVH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Bug Library: Reflected Cross-Site ScriptingCVE-2021-38355 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3.
- Product
- Bug Library
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Bug Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021GNU-Mailman Integration: Reflected Cross-Site ScriptingCVE-2021-38354 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
- Product
- GNU-Mailman Integration
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update GNU-Mailman Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Dropdown and scrollable Text: Reflected Cross-Site ScriptingCVE-2021-38353 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.
- Product
- Dropdown and scrollable Text
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Dropdown and scrollable Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Feedify – Web Push Notifications: Reflected Cross-Site ScriptingCVE-2021-38352 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8.
- Product
- Feedify – Web Push Notifications
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021OSD Subscribe: Reflected Cross-Site ScriptingCVE-2021-38351 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe_options_subscribers.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.3.
- Product
- OSD Subscribe
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update OSD Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021spideranalyse: Reflected Cross-Site ScriptingCVE-2021-38350 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1.
- Product
- spideranalyse
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update spideranalyse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Integration of Moneybird for WooCommerce: Reflected Cross-Site ScriptingCVE-2021-38349 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1.
- Product
- Integration of Moneybird for WooCommerce
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Integration of Moneybird for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Advance Search: Reflected Cross-Site ScriptingCVE-2021-38348 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.2.
- Product
- Advance Search
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Advance Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Custom Website Data: Reflected Cross-Site ScriptingCVE-2021-38347 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.
- Product
- Custom Website Data
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Custom Website Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021WooCommerce Payment Gateway Per Category: Reflected Cross-Site ScriptingCVE-2021-38341 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10.
- Product
- WooCommerce Payment Gateway Per Category
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update WooCommerce Payment Gateway Per Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Wordpress Simple Shop: Reflected Cross-Site ScriptingCVE-2021-38340 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
- Product
- Wordpress Simple Shop
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Wordpress Simple Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Simple Matted Thumbnails: Reflected Cross-Site ScriptingCVE-2021-38339 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.01.
- Product
- Simple Matted Thumbnails
- Affected
- up to 1.01
- What to do
- Affects up to 1.01. Update Simple Matted Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Border Loading Bar: Reflected Cross-Site ScriptingCVE-2021-38338 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
- Product
- Border Loading Bar
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Border Loading Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021RSVPMaker Excel: Reflected Cross-Site ScriptingCVE-2021-38337 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.
- Product
- RSVPMaker Excel
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update RSVPMaker Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Edit Comments XT: Reflected Cross-Site ScriptingCVE-2021-38336 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
- Product
- Edit Comments XT
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Edit Comments XT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Wise Agent Capture Forms: Reflected Cross-Site ScriptingCVE-2021-38335 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
- Product
- Wise Agent Capture Forms
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Wise Agent Capture Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021WP Design Maps & Places: Reflected Cross-Site ScriptingCVE-2021-38334 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
- Product
- WP Design Maps & Places
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP Design Maps & Places to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021WP Scrippets: Reflected Cross-Site ScriptingCVE-2021-38333 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp-scrippets.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.1.
- Product
- WP Scrippets
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update WP Scrippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021On Page SEO + Whatsapp Chat Button Plugin: Reflected Cross-Site ScriptingCVE-2021-38332 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
- Product
- On Page SEO + Whatsapp Chat Button Plugin
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update On Page SEO + Whatsapp Chat Button Plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021WP-T-Wap: Reflected Cross-Site ScriptingCVE-2021-38331 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.13.2.
- Product
- WP-T-Wap
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update WP-T-Wap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Yet Another bol.com Plugin: Reflected Cross-Site ScriptingCVE-2021-38330 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/yabp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.
- Product
- Yet Another bol.com Plugin
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Yet Another bol.com Plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021DJ EmailPublish: Reflected Cross-Site ScriptingCVE-2021-38329 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2.
- Product
- DJ EmailPublish
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update DJ EmailPublish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Notices: Reflected Cross-Site ScriptingCVE-2021-38328 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/notices.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1.
- Product
- Notices
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Notices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021YouTube Video Inserter: Reflected Cross-Site ScriptingCVE-2021-38327 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0.
- Product
- YouTube Video Inserter
- Affected
- up to 1.2.1.0
- What to do
- Affects up to 1.2.1.0. Update YouTube Video Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 10, 2021Post Title Counter: Reflected Cross-Site ScriptingCVE-2021-38326 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-counter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.
- Product
- Post Title Counter
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Post Title Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021User Activation Email: Reflected Cross-Site ScriptingCVE-2021-38325 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0.
- Product
- User Activation Email
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update User Activation Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021RentPress: Reflected Cross-Site ScriptingCVE-2021-38323 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The RentPress WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the ~/src/rentPress/AjaxRequests.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.6.4.
- Product
- RentPress
- Affected
- up to 6.6.4
- What to do
- Affects up to 6.6.4. Update RentPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021Twitter Friends Widget: Reflected Cross-Site ScriptingCVE-2021-38322 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmc_TF_user and pmc_TF_password parameter found in the ~/twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1.
- Product
- Twitter Friends Widget
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Twitter Friends Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021Custom Menu Plugin: Reflected Cross-Site ScriptingCVE-2021-38321 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selected_menu parameter found in the ~/custom-menus.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.3.
- Product
- Custom Menu Plugin
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Custom Menu Plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 9, 2021simpleSAMLphp Authentication: Reflected Cross-Site ScriptingCVE-2021-38320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.0.
- Product
- simpleSAMLphp Authentication
- Affected
- up to 0.7.0
- What to do
- Affects up to 0.7.0. Update simpleSAMLphp Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.