Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
115 results · page 3 of 3
Aug 22, 2022Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPressCVE-2022-34857 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress
- Affected
- up to 4.59
- What to do
- Affects up to 4.59. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 1, 2022Project Source Code Download: Does not protect its backup generation and download functionalitiesCVE-2022-1585 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
- Product
- Project Source Code Download
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Project Source Code Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 25, 2022SP Project & Document Manager: Uses an easily guessable path to store user filesCVE-2022-1551 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.
- Product
- SP Project & Document Manager
- Fixed in
- 4.58
- What to do
- Update SP Project & Document Manager to 4.58 or newer.
Jun 13, 2022Zephyr Project Manager: Reflected Cross-Site ScriptingCVE-2022-1822 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Zephyr Project Manager
- Affected
- up to 3.2.40
- What to do
- Affects up to 3.2.40. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 25, 2022LayerSlider: Does not sanitise and escape Project's slug before outputting it back in various placeCVE-2022-1153 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- LayerSlider
- Fixed in
- 7.1.2
- What to do
- Update LayerSlider to 7.1.2 or newer.
Apr 25, 2022SP Project & Document Manager: Allows any authenticated usersCVE-2021-4225 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.
- Product
- SP Project & Document Manager
- Fixed in
- 4.24
- What to do
- Update SP Project & Document Manager to 4.24 or newer.
Apr 4, 2022Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager pluginCVE-2021-36826 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions.
- Affected
- up to 2.4.13
- What to do
- Affects up to 2.4.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2022StatCounter: Does not sanitise and escape the Project ID and Secure Code settingsCVE-2021-24920 · WordPress plugins & themes · reported by WPScanMedium 4.8
The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- StatCounter
- Fixed in
- 2.0.7
- What to do
- Update StatCounter to 2.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
- Product
- Translation Exchange
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2021pspin_duplicate_post_save_as_new_post function of the Project Status: Does not sanitiseCVE-2021-24558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue
- Product
- pspin_duplicate_post_save_as_new_post function of the Project Status
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update pspin_duplicate_post_save_as_new_post function of the Project Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 16, 2021SP Project & Document Manager: Attribute-based Reflected Cross-Site ScriptingCVE-2021-38315 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25.
- Product
- SP Project & Document Manager
- Affected
- up to 4.25
- What to do
- Affects up to 4.25. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 6, 2021Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPCVE-2021-24375 · WordPress plugins & themes · reported by WPScanCritical 9.8
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.
- Product
- Motor
- Fixed in
- 3.1.0
- What to do
- Update Motor to 3.1.0 or newer.
Jun 14, 2021The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored CrCVE-2021-24382 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.
- Fixed in
- 3.5.0.9
- What to do
- Update the plugin to 3.5.0.9 or newer.
Full record and what to do →NVD recordsmartslider.helpscoutdocs.comwpscan.com
Jun 14, 2021SP Project & Document Manager: Allows users to upload filesCVE-2021-24347 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
- Product
- SP Project & Document Manager
- Fixed in
- 4.22
- What to do
- Update SP Project & Document Manager to 4.22 or newer.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 2, 2014Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 aCVE-2014-9178 · WordPress plugins & themes · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter in the email_vendor function or id parameter in the (2) download_project, (3) download_archive, or (4) remove_cat function.
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.