Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,638 results · page 297 of 313
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameterCVE-2021-24339 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameterCVE-2021-24338 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 14, 2021The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored CrCVE-2021-24382 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.
- Fixed in
- 3.5.0.9
- What to do
- Update the plugin to 3.5.0.9 or newer.
Full record and what to do →NVD recordsmartslider.helpscoutdocs.comwpscan.com
Jun 14, 2021Plus Addons for Elementor Page Builder: Did not properly check that a user requesting a password reset was the legitimate userCVE-2021-24359 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. Such issue could be chained with an open redirect (CVE-2021-24358) in version below 4.1.10, to include a crafted password reset link in the email, which would lead to an account takeover.
- Product
- Plus Addons for Elementor Page Builder
- Fixed in
- 4.1.11
- What to do
- Update Plus Addons for Elementor Page Builder to 4.1.11 or newer.
Full record and what to do →NVD recordtheplusaddons.comwpscan.com
Jun 14, 2021Plus Addons for Elementor Page Builder: Did not validate a redirect parameter on a specifically crafted URL before redirecting the user to itCVE-2021-24358 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue.
- Product
- Plus Addons for Elementor Page Builder
- Fixed in
- 4.1.10
- What to do
- Update Plus Addons for Elementor Page Builder to 4.1.10 or newer.
Full record and what to do →NVD recordtheplusaddons.comwpscan.com
Jun 14, 2021Visitors: Is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2021-24350 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.
- Product
- Visitors
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Visitors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2021When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitisedCVE-2021-24341 · WordPress plugins & themes · reported by WPScanHigh 8.8
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
- Product
- Xllentech English Islamic Calendar
- Fixed in
- 2.6.8
- What to do
- Update Xllentech English Islamic Calendar to 2.6.8 or newer.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Jun 7, 2021Easy Preloader: Does not sanitise its setting fieldsCVE-2021-24344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues
- Product
- Easy Preloader
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Easy Preloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2021iFlyChat: Does not sanitise its APP ID setting before outputting it back in the pageCVE-2021-24343 · WordPress plugins & themes · reported by WPScanMedium 4.8
The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- iFlyChat
- Fixed in
- 4.7.0
- What to do
- Update iFlyChat to 4.7.0 or newer.
Jun 1, 2021Car Repair Services & Auto Mechanic: Did not properly sanitise its serviceestimatekey search parameter before outputting it back in the pageCVE-2021-24335 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Car Repair Services & Auto Mechanic WordPress theme before 4.0 did not properly sanitise its serviceestimatekey search parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
- Product
- Car Repair Services & Auto Mechanic
- Fixed in
- 4.0
- What to do
- Update Car Repair Services & Auto Mechanic to 4.0 or newer.
Full record and what to do →NVD recordm0ze.ruthemeforest.net
Jun 1, 2021Instant Images – One Click Unsplash Uploads: Did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/uploadCVE-2021-24334 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Instant Images – One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Stored Cross-Site Scripting issue.
- Product
- Instant Images – One Click Unsplash Uploads
- Fixed in
- 4.4.0.1
- What to do
- Update Instant Images – One Click Unsplash Uploads to 4.4.0.1 or newer.
Jun 1, 2021Smooth Scroll Page Up/Down Buttons: Did not properly sanitise and validate its settingsCVE-2021-24331 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psb_distance, psb_buttonsize, psb_speed, only validating them client side. This could allow high privilege users (such as admin) to set XSS payloads in them
- Product
- Smooth Scroll Page Up/Down Buttons
- Fixed in
- 1.4
- What to do
- Update Smooth Scroll Page Up/Down Buttons to 1.4 or newer.
Jun 1, 2021Funnel Builder by CartFlows – Create High Converting Sales Funnels For: Did not sanitise its facebook_pixel_id and google_analytics_id settingsCVE-2021-24330 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.
- Product
- Funnel Builder by CartFlows – Create High Converting Sales Funnels For
- Fixed in
- 1.6.13
- What to do
- Update Funnel Builder by CartFlows – Create High Converting Sales Funnels For to 1.6.13 or newer.
Jun 1, 2021WP Super Cache: Did not properly sanitise its wp_cache_location parameter in its settingsCVE-2021-24329 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Super Cache WordPress plugin before 1.7.3 did not properly sanitise its wp_cache_location parameter in its settings, which could lead to a Stored Cross-Site Scripting issue.
- Product
- WP Super Cache
- Fixed in
- 1.7.3
- What to do
- Update WP Super Cache to 1.7.3 or newer.
Jun 1, 2021Bello - Directory & Listing: Did not sanitise the bt_bb_listing_field_price_range_toCVE-2021-24321 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issues
- Product
- Bello - Directory & Listing
- Fixed in
- 1.6.0
- What to do
- Update Bello - Directory & Listing to 1.6.0 or newer.
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise and escape its listing_list_viewCVE-2021-24320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listing_list_view, bt_bb_listing_field_my_lat, bt_bb_listing_field_my_lng, bt_bb_listing_field_distance_value, bt_bb_listing_field_my_lat_default, bt_bb_listing_field_keyword, bt_bb_listing_field_location_autocomplete, bt_bb_listing_field_price_range_from and bt_bb_listing_field_price_range_to parameter in ints listing page, leading to reflected Cross-Site Scripting issues.
- Product
- Bello - Directory & Listing
- Fixed in
- 1.6.0
- What to do
- Update Bello - Directory & Listing to 1.6.0 or newer.
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ pageCVE-2021-24319 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue
- Product
- Bello - Directory & Listing
- Fixed in
- 1.6.0
- What to do
- Update Bello - Directory & Listing to 1.6.0 or newer.
Jun 1, 2021The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super CaCVE-2021-24312 · WordPress plugins & themes · reported by WPScanHigh 7.2
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
- Fixed in
- 1.7.3
- What to do
- Update the plugin to 1.7.3 or newer.
May 24, 2021Autoptimize: Was missing proper escaping and sanitisation in some of its settingsCVE-2021-24332 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
- Product
- Autoptimize
- Fixed in
- 2.8.4
- What to do
- Update Autoptimize to 2.8.4 or newer.
May 24, 2021The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilCVE-2021-24307 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. Users can restore plugin's configuration by uploading a backup .ini file in the section "Tool > Import/Export". However, the plugin attempts to unserialize values of the .ini file. Moreover, the plugin embeds Monolog library which can be used to craft a gadget chain and thus trigger system command execution.
- Fixed in
- 4.1.0.2
- What to do
- Update the plugin to 4.1.0.2 or newer.
May 24, 2021Hana Flv Player: Is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' fieldCVE-2021-24302 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field.
- Product
- Hana Flv Player
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Hana Flv Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 24, 2021Hotjar Connecticator: Is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textareaCVE-2021-24301 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users.
- Product
- Hotjar Connecticator
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Hotjar Connecticator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 24, 2021WP Customer Reviews: Did not sanitise some of its settingsCVE-2021-24296 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
- Product
- WP Customer Reviews
- Fixed in
- 3.5.6
- What to do
- Update WP Customer Reviews to 3.5.6 or newer.
May 24, 2021dsgvoaio_write_log AJAX action of the DSGVO All in one for WP: Did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/adminCVE-2021-24294 · WordPress plugins & themes · reported by WPScanMedium 6.1
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
- Product
- dsgvoaio_write_log AJAX action of the DSGVO All in one for WP
- Fixed in
- 4.0
- What to do
- Update dsgvoaio_write_log AJAX action of the DSGVO All in one for WP to 4.0 or newer.
May 17, 2021tab parameter of the settings page of the All 404 Redirect to Homepage: Was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issueCVE-2021-24326 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute.
- Product
- tab parameter of the settings page of the All 404 Redirect to Homepage
- Fixed in
- 1.21
- What to do
- Update tab parameter of the settings page of the All 404 Redirect to Homepage to 1.21 or newer.
May 17, 2021tab parameter of the settings page of the 404 SEO Redirection: Is vulnerable to a reflected Cross-Site Scripting (XSS) issueCVE-2021-24325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or escaped before being output in an attribute.
- Product
- tab parameter of the settings page of the 404 SEO Redirection
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update tab parameter of the settings page of the 404 SEO Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2021404 SEO Redirection: Is lacking CSRF checks in all its settingsCVE-2021-24324 · WordPress plugins & themes · reported by WPScanMedium 6.5
The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues
- Product
- 404 SEO Redirection
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update 404 SEO Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.4
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
May 17, 2021Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor: Have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.
- Product
- Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor
- Fixed in
- 2.24.0
- What to do
- Update Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor to 2.24.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 14, 2021Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_idCVE-2021-24291 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
- Product
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Fixed in
- 1.5.69
- What to do
- Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to 1.5.69 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 14, 2021settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24287 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
- Product
- settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
- Fixed in
- 1.3.2
- What to do
- Update settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons to 1.3.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 14, 2021settings page of the Redirect 404 to parent: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24286 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
- Product
- settings page of the Redirect 404 to parent
- Fixed in
- 1.3.1
- What to do
- Update settings page of the Redirect 404 to parent to 1.3.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 14, 2021The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.CVE-2021-24283 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.
- Fixed in
- 2.2.30
- What to do
- Update the plugin to 2.2.30 or newer.
May 14, 2021RSS for Yandex Turbo: Did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the pageCVE-2021-24277 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues
- Product
- RSS for Yandex Turbo
- Fixed in
- 1.30
- What to do
- Update RSS for Yandex Turbo to 1.30 or newer.
May 14, 2021Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1CVE-2021-24190 · WordPress plugins & themes · reported by WPScanHigh 8.8
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
- Product
- WooCommerce Conditional Marketing Mailer
- Fixed in
- 1.5.2
- What to do
- Update WooCommerce Conditional Marketing Mailer to 1.5.2 or newer.
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from a Cross-Site Request Forgery issueCVE-2021-24251 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status (from pending to completed to example)
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11.2
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from lack of sanitisation in the label of the Form FieldsCVE-2021-24250 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in the label of the Form Fields, leading to Authenticated Stored Cross-Site Scripting issues across various pages of the plugin.
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11.2
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from a Cross-Site Request Forgery issueCVE-2021-24249 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator export files, which could then be downloaded by the attacker to get access to PII, such as email, home addresses etc
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11.2
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Did not properly check for imported filesCVE-2021-24248 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11.1
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11.1 or newer.
May 6, 2021Contact Form Check Tester: Settings are visible to all registered users in the dashboard and are lacking any sanitisationCVE-2021-24247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
- Product
- Contact Form Check Tester
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Contact Form Check Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from a Cross-Site Request Forgery issueCVE-2021-24179 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE.
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11 or newer.
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from Cross-Site Request Forgery issuesCVE-2021-24178 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing an attacker to make a logged in administrator add, edit or delete form fields, which could also lead to Stored Cross-Site Scripting issues.
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11.1
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11.1 or newer.
May 5, 2021Contact Form by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24276 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Contact Form by Supsystic
- Fixed in
- 1.7.15
- What to do
- Update Contact Form by Supsystic to 1.7.15 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Popup by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24275 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Popup by Supsystic
- Fixed in
- 1.10.5
- What to do
- Update Popup by Supsystic to 1.10.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Ultimate Maps by Supsystic: Did not sanitise the tab parameter of its options page before outputting it in an attributeCVE-2021-24274 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Ultimate Maps by Supsystic
- Fixed in
- 1.2.5
- What to do
- Update Ultimate Maps by Supsystic to 1.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 5, 2021Clever Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- Clever Addons for Elementor
- Fixed in
- 2.1.0
- What to do
- Update Clever Addons for Elementor to 2.1.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021Ultimate Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- Ultimate Addons for Elementor
- Fixed in
- 1.30.0
- What to do
- Update Ultimate Addons for Elementor to 1.30.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021DeTheme Kit for Elementor: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24270 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- DeTheme Kit for Elementor
- Fixed in
- 1.5.5.5
- What to do
- Update DeTheme Kit for Elementor to 1.5.5.5 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021Sina Extension for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24269 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Sina Extension for Elementor” WordPress Plugin before 3.3.12 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- Sina Extension for Elementor
- Fixed in
- 3.3.12
- What to do
- Update Sina Extension for Elementor to 3.3.12 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021JetWidgets For Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24268 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- JetWidgets For Elementor
- Fixed in
- 1.0.9
- What to do
- Update JetWidgets For Elementor to 1.0.9 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.