Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
178 results · page 3 of 4
Jun 30, 2026Fluent Booking: Does not verify ownership of the requested group_id before exporting attendee data via the export endpointCVE-2026-9576 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via the export endpoint, allowing users with at least the Calendar Manager role to retrieve attendees' PII (name, email, phone, address, payment information) from calendar groups they do not own.
- Product
- Fluent Booking
- Fixed in
- 2.1.2
- What to do
- Update Fluent Booking to 2.1.2 or newer.
Jun 26, 2026YMC Filter: Does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameterCVE-2026-10823 · WordPress plugins & themes · reported by WPScanHigh 7.5
The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.
- Product
- YMC Filter
- Fixed in
- 3.11.3
- What to do
- Update YMC Filter to 3.11.3 or newer.
Jun 24, 2026Site Kit by Google: Does not properly restrict a REST API write endpoint to administratorsCVE-2026-10753 · WordPress plugins & themes · reported by WPScanLow 2.7
The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users who have been granted dashboard sharing access (such as Editors) to modify a site-wide Site Kit by Google WordPress plugin before 1.176.0 setting that should only be modifiable by administrators.
- Product
- Site Kit by Google
- Fixed in
- 1.176.0
- What to do
- Update Site Kit by Google to 1.176.0 or newer.
Jun 23, 2026Frontend File Manager: Does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing itCVE-2026-8378 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.
- Product
- Frontend File Manager
- Affected
- up to 23.6
- What to do
- Affects up to 23.6. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2026SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager: Reflected Cross-Site ScriptingCVE-2026-12137 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Because the vulnerable plugin_options_page() function is only rendered within the WordPress admin dashboard, successful exploitation requires the targeted victim to be logged in with Shop Manager-level access or higher.
- Product
- SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager
- Affected
- up to 4.3.6
- What to do
- Affects up to 4.3.6. Update SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 17, 2026LearnPress: Does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capabilityCVE-2026-8383 · WordPress plugins & themes · reported by WPScanMedium 5.3
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request
- Product
- LearnPress
- Fixed in
- 4.3.7
- What to do
- Update LearnPress to 4.3.7 or newer.
Jun 15, 2026WP Go Maps: Does not perform any approval-state filtering on its public single-marker REST endpointCVE-2026-8386 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address and description fields and the marker's geographic coordinates.
- Product
- WP Go Maps
- Fixed in
- 10.0.10
- What to do
- Update WP Go Maps to 10.0.10 or newer.
Jun 10, 2026Schema & Structured Data for WP & AMP: Does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media typeCVE-2026-9067 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
- Product
- Schema & Structured Data for WP & AMP
- Fixed in
- 1.60
- What to do
- Update Schema & Structured Data for WP & AMP to 1.60 or newer.
Jun 2, 2026Really Simple Security: Does not enforce the second-factor challenge in two of its two-factor authentication REST endpointsCVE-2026-8293 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.
- Product
- Really Simple Security
- Fixed in
- 9.5.10.1
- What to do
- Update Really Simple Security to 9.5.10.1 or newer.
May 20, 2026Decent Comments: Does not restrict access to comment author email addresses and post author email addresses via its REST API endpointCVE-2026-7385 · WordPress plugins & themes · reported by WPScanMedium 5.8
The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.
- Product
- Decent Comments
- Fixed in
- 3.0.2
- What to do
- Update Decent Comments to 3.0.2 or newer.
May 19, 2026the public checkout endpoint that: Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorizationCVE-2026-47100 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.
- Product
- the public checkout endpoint that
- What to do
- Update the public checkout endpoint that to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgsansec.io
May 4, 2026The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that CVE-2026-41471 · WordPress plugins & themes · reported by VulnCheckHigh 8.2
The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress post IDs through the scan_qr.php endpoint to harvest the complete set of orders stored in the database without requiring authentication or prior knowledge of specific order identifiers.
- Product
- Easy PayPal Events & Tickets
- What to do
- Update Easy PayPal Events & Tickets to the newest version.
Full record and what to do →NVD recordgist.github.comwordpress.org
Apr 7, 2026Link Whisper Free: Has a publicly accessible REST endpoint that allows unauthenticated settings updatesCVE-2026-1900 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.
- Product
- Link Whisper Free
- Fixed in
- 0.9.1
- What to do
- Update Link Whisper Free to 0.9.1 or newer.
Mar 12, 2026Timetics: Does not have authorization in a REST endpointCVE-2025-15473 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.
- Product
- Timetics
- Fixed in
- 1.0.52
- What to do
- Update Timetics to 1.0.52 or newer.
Mar 11, 2026Datalogics Ecommerce Delivery: Exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verificationCVE-2026-2631 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator.
- Product
- Datalogics Ecommerce Delivery
- Fixed in
- 2.6.60
- What to do
- Update Datalogics Ecommerce Delivery to 2.6.60 or newer.
Mar 4, 2026Mail Mint: Does not have authorization in one of its REST API endpointCVE-2026-2025 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog
- Product
- Mail Mint
- Fixed in
- 1.19.5
- What to do
- Update Mail Mint to 1.19.5 or newer.
Jan 16, 2026the bundled plupload example endpoint: Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file uploadCVE-2012-10064 · WordPress plugins & themes · reported by VulnCheckCritical 9.3
Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without enforcing safe file type restrictions, enabling an attacker to place attacker-controlled files under the plugin's uploads directory. This can lead to remote code execution if a server-executable file type is uploaded and subsequently accessed.
- Product
- the bundled plupload example endpoint
- What to do
- Update the bundled plupload example endpoint to the newest version.
Full record and what to do →NVD recordpacketstorm.newsweb.archive.org
Dec 31, 2025Ultimate Post Kit Addons for Elementor: Exposes multiple AJAX “load more” endpoints suchCVE-2025-14434 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and retrieve rendered HTML content of private and unpublished ones.
- Product
- Ultimate Post Kit Addons for Elementor
- Fixed in
- 4.0.16
- What to do
- Update Ultimate Post Kit Addons for Elementor to 4.0.16 or newer.
Dec 12, 2025Bookit: Has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment optionsCVE-2025-12841 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
- Product
- Bookit
- Fixed in
- 2.5.1
- What to do
- Update Bookit to 2.5.1 or newer.
Sep 8, 2025Ditty: Lacks authorization and authentication for requests to its displayItems endpointCVE-2025-8085 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs.
- Product
- Ditty
- Fixed in
- 3.1.58
- What to do
- Update Ditty to 3.1.58 or newer.
Apr 17, 2025Klarna Checkout for WooCommerce: Exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per requestCVE-2024-13925 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.
- Product
- Klarna Checkout for WooCommerce
- Fixed in
- 2.13.5
- What to do
- Update Klarna Checkout for WooCommerce to 2.13.5 or newer.
Dec 31, 2024Hunk Companion: Does not correctly authorize some REST API endpointsCVE-2024-11972 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
- Product
- Hunk Companion
- Fixed in
- 1.9.0
- What to do
- Update Hunk Companion to 1.9.0 or newer.
Dec 12, 2024AI Engine: Does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statementCVE-2024-10499 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- AI Engine
- Fixed in
- 2.6.5
- What to do
- Update AI Engine to 2.6.5 or newer.
Dec 11, 2024Ultimate Endpoints With Rest Api: Reflected Cross-Site ScriptingCVE-2024-12260 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Ultimate Endpoints With Rest Api
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Ultimate Endpoints With Rest Api to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 7, 2024The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrCVE-2024-9926 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
- What to do
- Update the plugin to the newest version.
Sep 25, 2024Chatbot with ChatGPT: Does not have proper authorization in one of its REST endpointCVE-2024-6845 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key
- Product
- Chatbot with ChatGPT
- Fixed in
- 2.4.6
- What to do
- Update Chatbot with ChatGPT to 2.4.6 or newer.
Jan 17, 2024Track The Click: Does not properly sanitize query parameters to the stats REST endpoint before using them in a database queryCVE-2023-5041 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
- Product
- Track The Click
- Fixed in
- 0.3.12
- What to do
- Update Track The Click to 0.3.12 or newer.
Jan 16, 2024Royal Elementor Addons and Templates: Does not ensure that users accessing posts via an AJAX action (and REST endpointCVE-2023-5922 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content
- Product
- Royal Elementor Addons and Templates
- Fixed in
- 1.3.81
- What to do
- Update Royal Elementor Addons and Templates to 1.3.81 or newer.
Dec 26, 2023WP Mail Log: Does not correctly authorize its REST API endpointsCVE-2023-5644 · WordPress plugins & themes · reported by WPScanHigh 7.6
The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.
- Product
- WP Mail Log
- Fixed in
- 1.1.3
- What to do
- Update WP Mail Log to 1.1.3 or newer.
Oct 31, 2023WP Meta and Date Remover: Provides an AJAX endpoint for configuring the plugin settingsCVE-2023-4823 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.
- Product
- WP Meta and Date Remover
- Fixed in
- 2.2.0
- What to do
- Update WP Meta and Date Remover to 2.2.0 or newer.
Jul 31, 2023LMS by Masteriyo: Does not have proper authorization in one some of its REST API endpointsCVE-2023-3345 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students
- Product
- LMS by Masteriyo
- Fixed in
- 1.6.8
- What to do
- Update LMS by Masteriyo to 1.6.8 or newer.
Jul 10, 2023MStore API: Does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpointCVE-2023-3076 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
- Product
- MStore API
- Fixed in
- 3.9.9
- What to do
- Update MStore API to 3.9.9 or newer.
Jul 4, 2023Tutor LMS: Does not implement adequate permission checks for REST API endpointsCVE-2023-3133 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
- Product
- Tutor LMS
- Fixed in
- 2.2.1
- What to do
- Update Tutor LMS to 2.2.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 27, 2023ERP: Does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statementCVE-2023-2744 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- ERP
- Fixed in
- 1.12.4
- What to do
- Update ERP to 1.12.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 6, 2023uListing: Authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validatedCVE-2021-4370 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to conduct numerous administrative actions, including those less critical than the explicitly outlined ones in our detection.
- Product
- uListing
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
May 30, 2023Fast & Effective Popups & Lead-Generation for: Concatenates user input into an SQL query without escaping it first in the plugin's report API endpointCVE-2023-2111 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL query without escaping it first in the plugin's report API endpoint, which could allow administrators in multi-site configuration to leak sensitive information from the site's database.
- Product
- Fast & Effective Popups & Lead-Generation for
- Fixed in
- 2.1.4
- What to do
- Update Fast & Effective Popups & Lead-Generation for to 2.1.4 or newer.
May 15, 2023RapidExpCart: Does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the pageCVE-2023-0520 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection means an attacker can trick a logged in admin to perform the attack by submitting a hidden form.
- Product
- RapidExpCart
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update RapidExpCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023Gallery Blocks with Lightbox: Has an AJAX endpoint that can be accessed by any authenticated usersCVE-2023-0441 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.
- Product
- Gallery Blocks with Lightbox
- Fixed in
- 3.0.8
- What to do
- Update Gallery Blocks with Lightbox to 3.0.8 or newer.
Mar 20, 2023ProfileGrid: Provides an AJAX endpoint for resetting a user password but does not implement proper authorizationCVE-2023-0940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
- Product
- ProfileGrid
- Fixed in
- 5.3.1
- What to do
- Update ProfileGrid to 5.3.1 or newer.
Mar 13, 2023Auto Featured Image (Auto Post Thumbnail): Includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary filesCVE-2023-0477 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.
- Product
- Auto Featured Image (Auto Post Thumbnail)
- Fixed in
- 3.9.16
- What to do
- Update Auto Featured Image (Auto Post Thumbnail) to 3.9.16 or newer.
Jan 2, 2023WP Cerber Security, Anti-spam & Malware Scan: Does not properly block access to the REST API users endpointCVE-2022-4417 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 9.3.3
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 9.3.3 or newer.
Nov 7, 2022WooCommerce Dropshipping: Does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated usersCVE-2022-3481 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
- Product
- WooCommerce Dropshipping
- Fixed in
- 4.4
- What to do
- Update WooCommerce Dropshipping to 4.4 or newer.
Oct 31, 2022LearnPress: Unserialises user input in a REST API endpoint available to unauthenticated usersCVE-2022-3360 · WordPress plugins & themes · reported by WPScanHigh 8.1
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution (RCE). To successfully exploit this vulnerability attackers must have knowledge of the site secrets, allowing them to generate a valid hash via the wp_hash() function.
- Product
- LearnPress
- Fixed in
- 4.1.7.2
- What to do
- Update LearnPress to 4.1.7.2 or newer.
Sep 5, 2022Visual Portfolio, Photo Gallery & Post Grid: Does not have proper authorisation checks in some of its REST endpointsCVE-2022-2597 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts
- Product
- Visual Portfolio, Photo Gallery & Post Grid
- Fixed in
- 2.19.0
- What to do
- Update Visual Portfolio, Photo Gallery & Post Grid to 2.19.0 or newer.
Sep 5, 2022Visual Portfolio, Photo Gallery & Post Grid: Does not have proper authorisation checks in some of its REST endpointsCVE-2022-2543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts
- Product
- Visual Portfolio, Photo Gallery & Post Grid
- Fixed in
- 2.18.0
- What to do
- Update Visual Portfolio, Photo Gallery & Post Grid to 2.18.0 or newer.
Aug 29, 2022Simply Schedule Appointments: Is missing authorisation in a REST endpointCVE-2022-2373 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address
- Product
- Simply Schedule Appointments
- Fixed in
- 1.5.7.7
- What to do
- Update Simply Schedule Appointments to 1.5.7.7 or newer.
Aug 29, 2022Sensei LMS: Does not have proper permissions set in one of its REST endpointCVE-2022-2034 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
- Product
- Sensei LMS
- Fixed in
- 4.5.0
- What to do
- Update Sensei LMS to 4.5.0 or newer.
Full record and what to do →NVD recordhackerone.comwpscan.com
Aug 22, 2022Duplicator: Discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the pluginCVE-2022-2551 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
- Product
- Duplicator
- Fixed in
- 1.4.7
- What to do
- Update Duplicator to 1.4.7 or newer.
Jun 27, 2022Social Share Buttons by Supsystic: Does not perform CSRF checks in it's ajax endpoints and admin pagesCVE-2022-1653 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks.
- Product
- Social Share Buttons by Supsystic
- Fixed in
- 2.2.4
- What to do
- Update Social Share Buttons by Supsystic to 2.2.4 or newer.
May 9, 2022MapSVG: Does not validate and escape a parameter via a REST endpoint before using it in a SQL statementCVE-2022-0592 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.
- Product
- MapSVG
- Fixed in
- 6.2.20
- What to do
- Update MapSVG to 6.2.20 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.