Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
145 results · page 3 of 3
Jul 10, 2024FULL – Cliente: Stored Cross-Site ScriptingCVE-2024-6447 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FULL – Cliente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the license plan parameter in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping as well as missing authorization and capability checks on the related functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrative user accesses wp-admin dashboard
- Product
- FULL – Cliente
- Affected
- up to 3.1.12
- What to do
- Affects up to 3.1.12. Update FULL – Cliente to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 14, 2024ProjectHuddle Client Site: Missing AuthorizationCVE-2023-51376 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Client Site: from n/a through 1.0.34.
- Product
- ProjectHuddle Client Site
- Affected
- up to 1.0.34
- What to do
- Affects up to 1.0.34. Update ProjectHuddle Client Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 29, 2024Site Reviews: Retrieves client IP addresses from potentially untrusted headersCVE-2024-3050 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking
- Product
- Site Reviews
- Fixed in
- 7.0.0
- What to do
- Update Site Reviews to 7.0.0 or newer.
May 17, 2024Wp Ultimate Review: Client-Side Enforcement of Server-Side SecurityCVE-2024-32685 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
- Product
- Wp Ultimate Review
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update Wp Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Zero Spam: Client-Side Enforcement of Server-Side SecurityCVE-2024-32521 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zero Spam: from n/a through 5.5.6.
- Product
- Zero Spam
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update Zero Spam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024weForms: Client-Side Enforcement of Server-Side SecurityCVE-2024-32512 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20.
- Product
- weForms
- Affected
- up to 1.6.20
- What to do
- Affects up to 1.6.20. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 29, 2024Client Dash: Missing AuthorizationCVE-2024-33652 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Real Big Plugins Client Dash.This issue affects Client Dash: from n/a through 2.2.1.
- Product
- Client Dash
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Client Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 15, 2024WP Client Reports: Cross-Site Request Forgery (CSRF)CVE-2024-32439 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SwitchWP WP Client Reports.This issue affects WP Client Reports: from n/a through 1.0.22.
- Product
- WP Client Reports
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update WP Client Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 29, 2024Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: Cross-Site Request Forgery (CSRF)CVE-2023-51530 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in GS Plugins Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation.This issue affects Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation: from n/a through 3.5.1.
- Product
- Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2024Sunshine Photo Cart: Free Client Galleries for Photographers: Sensitive Information ExposureCVE-2024-1294 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Sunshine Photo Cart: Free Client Galleries for Photographers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.24 via the 'invoice'. This makes it possible for unauthenticated attackers to extract sensitive data including customer email and physical addresses.
- Product
- Sunshine Photo Cart: Free Client Galleries for Photographers
- Affected
- up to 3.0.24
- What to do
- Affects up to 3.0.24. Update Sunshine Photo Cart: Free Client Galleries for Photographers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024InfiniteWP Client: Sensitive Information ExposureCVE-2023-6565 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process.
- Product
- InfiniteWP Client
- Affected
- up to 1.12.3
- What to do
- Affects up to 1.12.3. Update InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 20, 2023Sunshine Photo Cart: Free Client Galleries for Photographers: Authorization Bypass Through User-Controlled KeyCVE-2023-41796 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0.
- Product
- Sunshine Photo Cart: Free Client Galleries for Photographers
- Fixed in
- 3.0.0
- What to do
- Update Sunshine Photo Cart: Free Client Galleries for Photographers to 3.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023Client Dash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49165 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Real Big Plugins Client Dash allows Stored XSS.This issue affects Client Dash: from n/a through 2.2.1.
- Product
- Client Dash
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update Client Dash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 27, 2023Security & Malware scan by CleanTalk: Retrieves client IP addresses from potentially untrusted headersCVE-2023-5239 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection.
- Product
- Security & Malware scan by CleanTalk
- Fixed in
- 2.121
- What to do
- Update Security & Malware scan by CleanTalk to 2.121 or newer.
Nov 27, 2023EventPrime: Specifies the price of a booking in the client requestCVE-2023-4252 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventPrime WordPress plugin through 3.2.9 specifies the price of a booking in the client request, allowing an attacker to purchase bookings without payment.
- Product
- EventPrime
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 22, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.CVE-2023-23978 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.
- Fixed in
- 1.0.17
- What to do
- Update the plugin to 1.0.17 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 16, 2023This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate itCVE-2023-5133 · WordPress plugins & themes · reported by WPScanHigh 7.5
This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
- Fixed in
- 2.3.4
- What to do
- Update the plugin to 2.3.4 or newer.
Sep 25, 2023This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value.CVE-2023-4281 · WordPress plugins & themes · reported by WPScanMedium 5.3
This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
- Fixed in
- 2.8.8
- What to do
- Update the plugin to 2.8.8 or newer.
Sep 4, 2023This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its vaCVE-2023-4279 · WordPress plugins & themes · reported by WPScanHigh 7.5
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.
- Fixed in
- 1.6.7
- What to do
- Update the plugin to 1.6.7 or newer.
Aug 15, 2023InfiniteWP Client: Sensitive Information ExposureCVE-2023-2916 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
- Product
- InfiniteWP Client
- Affected
- up to 1.11.1
- What to do
- Affects up to 1.11.1. Update InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 18, 2023OAuth Single Sign On – SSO (OAuth Client): Improper AuthenticationCVE-2022-34155 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
- Product
- OAuth Single Sign On – SSO (OAuth Client)
- Affected
- up to 6.23.3
- What to do
- Affects up to 6.23.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codespatchstack.com
Jun 27, 2023Catalyst Connect Zoho CRM Client Portal: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2023-0588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
- Product
- Catalyst Connect Zoho CRM Client Portal
- Fixed in
- 2.1.0
- What to do
- Update Catalyst Connect Zoho CRM Client Portal to 2.1.0 or newer.
Mar 27, 2023Formidable Forms: Uses several potentially untrusted headers to determine the IP address of the clientCVE-2023-0816 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
- Product
- Formidable Forms
- Fixed in
- 6.1
- What to do
- Update Formidable Forms to 6.1 or newer.
Mar 20, 2023Responsive Clients Logo Gallery Plugin for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0175 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Clients Logo Gallery Plugin for
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Responsive Clients Logo Gallery Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 15, 2023Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8 vCVE-2023-25968 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8 versions.
- Fixed in
- 1.1.9
- What to do
- Update the plugin to 1.1.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023Client Logo Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0073 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Client Logo Carousel
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Client Logo Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 4, 2023WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes CVE-2023-22622 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddeveloper.wordpress.orggithub.com
Dec 12, 2022Cross-site Scripting (XSS) is a client-side code injection attack.CVE-2022-3853 · WordPress plugins & themes · reported by WPScanMedium 5.4
Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application.
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not sanitize and escape Client IDsCVE-2022-3892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.2.2
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.2.2 or newer.
Nov 14, 2022OAuth Client by DigitialPixies: Does not have CSRF checks in some placesCVE-2022-3632 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions.
- Product
- OAuth Client by DigitialPixies
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2022OAuth Client by DigitialPixies: Does not sanitize and escapes some of its settingsCVE-2022-3631 · WordPress plugins & themes · reported by WPScanMedium 4.8
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- OAuth Client by DigitialPixies
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022OAuth client Single Sign On: Does not have authorisation and CSRFCVE-2022-3119 · WordPress plugins & themes · reported by WPScanHigh 7.5
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address
- Product
- OAuth client Single Sign On
- Fixed in
- 3.0.4
- What to do
- Update OAuth client Single Sign On to 3.0.4 or newer.
Sep 5, 2022Simple Single Sign On: Leaks its OAuth client_secretCVE-2022-2083 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the site.
- Product
- Simple Single Sign On
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Simple Single Sign On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.CVE-2022-34858 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.
- Affected
- up to 1.11.3
- What to do
- Affects up to 1.11.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codespatchstack.com
Apr 18, 2022WP Downgrade: Only perform client side validation of its "WordPress Target Version" settingsCVE-2022-1001 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not sanitise and escape it server side, allowing high privilege users such as admin to perform Cross-Site attacks even when the unfiltered_html capability is disallowed
- Product
- WP Downgrade
- Fixed in
- 1.2.3
- What to do
- Update WP Downgrade to 1.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 17, 2021Client Invoicing by Sprout Invoices: Does not sanitise and escape some of its settingsCVE-2021-24787 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Client Invoicing by Sprout Invoices
- Fixed in
- 19.9.7
- What to do
- Update Client Invoicing by Sprout Invoices to 19.9.7 or newer.
May 6, 2021The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected CCVE-2021-24214 · WordPress plugins & themes · reported by WPScanMedium 6.1
The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration.
- What to do
- Update the plugin to the newest version.
Feb 6, 2020The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php.CVE-2020-8772 · WordPress plugins & themes · reported by MITRECritical 9.8
The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.
- Product
- InfiniteWP Client
- Fixed in
- 1.9.4.5
- What to do
- Update InfiniteWP Client to 1.9.4.5 or newer.
Full record and what to do →NVD recordwpvulndb.comwebarxsecurity.com
Oct 10, 2019The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTCVE-2015-9466 · WordPress plugins & themes · reported by MITRECritical 9.8
The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable.
- Product
- wti-like-post
- Fixed in
- 1.4.3
- What to do
- Update wti-like-post to 1.4.3 or newer.
Oct 10, 2019The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.CVE-2019-17071 · WordPress plugins & themes · reported by MITREMedium 6.1
The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.
- Affected
- 2.1.4 to 2.1.4
- What to do
- Affects 2.1.4 to 2.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comwordpress.org
Sep 20, 2019The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.CVE-2016-11005 · WordPress plugins & themes · reported by MITREMedium 6.1
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
- Product
- instalinker
- Fixed in
- 1.1.2
- What to do
- Update instalinker to 1.1.2 or newer.
Full record and what to do →NVD recordrastating.github.iowordpress.org
Oct 16, 2017Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress.CVE-2017-15375 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules. Remote attackers are able to inject malicious script code to hijack admin session credentials via the backend, or to manipulate the backend on client-side performed requests. The attack vector is non-persistent and the request method to inject is GET. The attacker does not need a privileged user account to perform a successful exploitation.
- Affected
- 4.5.1 to 4.5.1
- What to do
- Affects 4.5.1 to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Dec 2, 2014Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 aCVE-2014-9178 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jul 2, 2014Cross-site scripting (XSS) vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for WordPress allows remote CVE-2014-4522 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
- Product
- dsSearchAgent: WordPress Edition
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update dsSearchAgent: WordPress Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jul 1, 2014Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrarCVE-2014-4521 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
- Product
- Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX
- Fixed in
- 2.1.1
- What to do
- Update Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX to 2.1.1 or newer.
Full record and what to do →NVD recordcodevigilant.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.