Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

133 results · page 3 of 3

Feb 28, 2022Easy Drag And drop All Import : WP Ultimate CSV Importer: Does not sanitise and escaped imported commentsCVE-2022-0360 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
Product
Easy Drag And drop All Import : WP Ultimate CSV Importer
Fixed in
6.4.3
What to do
Update Easy Drag And drop All Import : WP Ultimate CSV Importer to 6.4.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022AnyComment: Does not have CSRF checks in the Import and Revert HyperComments featuresCVE-2022-0134 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
Product
AnyComment
Fixed in
0.2.18
What to do
Update AnyComment to 0.2.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Schreikasten: Does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actionsCVE-2021-24630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
Product
Schreikasten
Affected
up to 0.14.18
What to do
Affects up to 0.14.18. Update Schreikasten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 1, 2021Delete All Comments Easily: Is lacking Cross-Site Request Forgery (CSRF) checksCVE-2020-36505 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog.
Product
Delete All Comments Easily
Affected
up to 1.3
What to do
Affects up to 1.3. Update Delete All Comments Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com wpscan.com
Oct 11, 2021Comments – wpDiscuz: Does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the pageCVE-2021-24737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Comments – wpDiscuz
Affected
up to 7.3.0
What to do
Affects up to 7.3.0. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021Comment Link Remove and Other Comment Tools: Does not have CSRF check in its 'Delete comments easily'CVE-2021-24725 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments
Product
Comment Link Remove and Other Comment Tools
Fixed in
2.1.6
What to do
Update Comment Link Remove and Other Comment Tools to 2.1.6 or newer.
Full record and what to do →NVD record wpscan.com trustwave.com
Sep 10, 2021Edit Comments XT: Reflected Cross-Site ScriptingCVE-2021-38336 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
Edit Comments XT
Affected
up to 1.0
What to do
Affects up to 1.0. Update Edit Comments XT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2021.18
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2021.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021Edit Comments: Does not sanitiseCVE-2021-24551 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue
Product
Edit Comments
Affected
up to 0.3
What to do
Affects up to 0.3. Update Edit Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 21, 2021Comments Like Dislike: Allows users to like/dislike posted commentsCVE-2021-24379 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side
Product
Comments Like Dislike
Fixed in
1.1.4
What to do
Update Comments Like Dislike to 1.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Imagements: Allows images to be uploaded in commentsCVE-2021-24236 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE.
Product
Imagements
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update Imagements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2021The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.CVE-2021-24219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapie
Fixed in
1.4.13.3
What to do
Update the plugin to 1.4.13.3 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Sep 13, 2020In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or pCVE-2020-25286 · WordPress plugins & themes · reported by MITREMedium 5.3
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.
Fixed in
5.4.2
What to do
Update the plugin to 5.4.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org wordpress.org
Dec 27, 2019Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116CVE-2014-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Product
Video Comments Webcam Recorder
Fixed in
20140116
What to do
Update Video Comments Webcam Recorder to 20140116 or newer.
Full record and what to do →NVD record codevigilant.com plugins.trac.wordpress.org
Sep 11, 2019WordPress before 5.2.3 allows XSS in stored comments.CVE-2019-16218 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows XSS in stored comments.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record lists.debian.org seclists.org
Sep 10, 2019The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.CVE-2017-18608 · WordPress plugins & themes · reported by MITREMedium 6.1
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
Product
spotim-comments
Fixed in
4.0.4
What to do
Update spotim-comments to 4.0.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.CVE-2014-10382 · WordPress plugins & themes · reported by MITREMedium 4.3
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.
Product
feature-comments
Fixed in
1.2.5
What to do
Update feature-comments to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jun 10, 2019The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' iCVE-2019-9881 · WordPress plugins & themes · reported by MITREMedium 5.3
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
Affected
0.2.3 to 0.2.3
What to do
Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com github.com
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.CVE-2018-20153 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
Fixed in
4.9.9
What to do
Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD record securityfocus.com codex.wordpress.org
Jun 19, 2018The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.CVE-2018-11526 · WordPress plugins & themes · reported by MITREHigh 7.8
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication oCVE-2014-2550 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php.
Product
Cross-site request forgery (CSRF) vulnerability in the Disable Comments
Fixed in
1.0.4
What to do
Update Cross-site request forgery (CSRF) vulnerability in the Disable Comments to 1.0.4 or newer.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com security.dxw.com
Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the aCVE-2014-2274 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php.
Product
Subscribe To Comments Reloaded
Fixed in
140219
What to do
Update Subscribe To Comments Reloaded to 140219 or newer.
Full record and what to do →NVD record security.dxw.com wordpress.org
Oct 6, 2016Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress pluginCVE-2016-1000112 · WordPress plugins & themes · reported by MITRECritical 9.1
Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record securityfocus.com vapidlabs.com
Nov 9, 2015the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4: SQL injectionCVE-2015-2213 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
Product
the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4
Fixed in
4.2.4
What to do
Update the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD record openwall.com debian.org
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attaCVE-2014-4565 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) vp, (2) vs, (3) l, (4) vu, or (5) vm parameter.
Product
Verification Code for Comments
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Verification Code for Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Jun 16, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authenticatiCVE-2014-4163 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the (1) buried or (2) featured status of a comment via a request to wp-admin/admin-ajax.php.
Product
Featured Comments
Affected
1.2.1 to 1.2.1
What to do
Affects 1.2.1 to 1.2.1. Update Featured Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record seclists.org seclists.org
Sep 23, 2013SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via theCVE-2013-5917 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the comment_post_ID parameter.
Product
NOSpam PTI
What to do
Update NOSpam PTI to the newest version.
Full record and what to do →NVD record archives.neohapsis.com archives.neohapsis.com
Apr 21, 2012wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attaCVE-2012-2404 · WordPress plugins & themes · reported by MITREMedium 4.3
wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record core.trac.wordpress.org osvdb.org
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers CVE-2012-1068 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.
Product
Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments
Fixed in
2.0.7
What to do
Update Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments to 2.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org secunia.com
Feb 14, 2012SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter iCVE-2012-1067 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Product
WP-RecentComments
What to do
Update WP-RecentComments to the newest version.
Full record and what to do →NVD record osvdb.org secunia.com
Jan 5, 2012wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used,: Cross-site scripting (XSS)CVE-2012-0287 · WordPress plugins & themes · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.
Product
wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used,
Fixed in
3.3.1
What to do
Update wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, to 3.3.1 or newer.
Full record and what to do →NVD record oldmanlab.blogspot.com securityfocus.com
Oct 24, 2008SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to execute arbitrary SQL commCVE-2008-4732 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the p parameter.
Product
SQL injection vulnerability in ajax_comments.php in the WP Comment Remix
Fixed in
1.4.4
What to do
Update SQL injection vulnerability in ajax_comments.php in the WP Comment Remix to 1.4.4 or newer.
Full record and what to do →NVD record chxsecurity.org secunia.com
Oct 20, 2008The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.CVE-2008-4616 · WordPress plugins & themes · reported by MITREMedium 5
The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record securityreason.com securityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.