Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,546 results · page 31 of 51

Apr 25, 2022Donations: Does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated usersCVE-2022-0782 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Product
Donations
Affected
up to 1.8
What to do
Affects up to 1.8. Update Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts.CVE-2011-1762 · WordPress plugins & themes · reported by Red HatMedium 6.5
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 11, 2022Download Manager: Uses the uniqid php function to generate the master key for a downloadCVE-2022-0828 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.
Product
Download Manager
Fixed in
3.2.34
What to do
Update Download Manager to 3.2.34 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess fCVE-2022-1166 · WordPress plugins & themes · reported by WPScanMedium 5.3
The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.
Fixed in
4.6.6.1
What to do
Update the plugin to 4.6.6.1 or newer.
Full record and what to do →NVD record themeforest.net wpscan.com
Feb 28, 2022In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unCVE-2021-24704 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
Product
Orange Form
Affected
up to 1.0
What to do
Affects up to 1.0. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts.CVE-2022-24665 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit posts.
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to editCVE-2022-24664 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Feb 16, 2022PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated userCVE-2022-24663 · WordPress plugins & themes · reported by WordfenceCritical 9.9
PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress shortcodes, which can be used by any authenticated user.
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Feb 7, 2022SEUR Oficial: Creates a PHP file with a random nameCVE-2021-25004 · WordPress plugins & themes · reported by WPScanMedium 4.9
The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.
Product
SEUR Oficial
Fixed in
1.7.2
What to do
Update SEUR Oficial to 1.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 13, 2022Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.CVE-2021-23227 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 10, 2022WP Coder: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25053 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
Product
WP Coder
Fixed in
2.5.2
What to do
Update WP Coder to 2.5.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 10, 2022Button Generator: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25052 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
Product
Button Generator
Fixed in
2.3.3
What to do
Update Button Generator to 2.3.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 10, 2022Modal Window: Within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as wellCVE-2021-25051 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.
Product
Modal Window
Fixed in
5.2.2
What to do
Update Modal Window to 5.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21664 · WordPress plugins & themes · reported by GitHubHigh 7.4
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21663 · WordPress plugins & themes · reported by GitHubMedium 6.6
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.sonarsource.com github.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21662 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21661 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com github.com
Dec 21, 2021Directorist: Was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directoryCVE-2021-24981 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.
Product
Directorist
Fixed in
7.0.6.2
What to do
Update Directorist to 7.0.6.2 or newer.
Full record and what to do →NVD record blog.sucuri.net wpscan.com
Dec 14, 2021The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src CVE-2021-39312 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.
Product
True Ranker
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update True Ranker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Dec 13, 2021ToTop Link: Passes base64 encoded user input to the unserialize() PHP functionCVE-2021-24857 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain.
Product
ToTop Link
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update ToTop Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 15, 2021plugins/wordpress_sso/pages/index.php: ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site ScriptingCVE-2021-41951 · WordPress plugins & themes · reported by MITREMedium 6.1
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.
Product
plugins/wordpress_sso/pages/index.php
Fixed in
9.6
What to do
Update plugins/wordpress_sso/pages/index.php to 9.6 or newer.
Full record and what to do →NVD record horizon3.ai horizon3.ai
Nov 8, 2021Similar Posts: Allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDITCVE-2021-24537 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML set to true) via the 'widget_rrm_similar_posts_condition' widget setting of the plugin.
Product
Similar Posts
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Similar Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 21, 2021Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to desCVE-2021-39321 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_sss_import_config AJAX action due to deserialization of unvalidated user supplied inputs via the import_config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users due to a missing capability check on the import_config function.
Product
Sassy Social Share
Affected
3.3.23 to 3.3.23
What to do
Affects 3.3.23 to 3.3.23. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 20, 2021options.php file of the WP-Board: Beta accepts a postid parameterCVE-2021-24404 · WordPress plugins & themes · reported by WPScanHigh 8.8
The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query ran twice.
Product
options.php file of the WP-Board
Affected
up to 1.1
What to do
Affects up to 1.1. Update options.php file of the WP-Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39203 · WordPress plugins & themes · reported by GitHubMedium 6.8
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com hackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39202 · WordPress plugins & themes · reported by GitHubHigh 7.6
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com hackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39201 · WordPress plugins & themes · reported by GitHubHigh 7.6
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com hackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39200 · WordPress plugins & themes · reported by GitHubMedium 5.3
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com hackerone.com
Sep 9, 2021simpleSAMLphp Authentication: Reflected Cross-Site ScriptingCVE-2021-38320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.0.
Product
simpleSAMLphp Authentication
Affected
up to 0.7.0
What to do
Affects up to 0.7.0. Update simpleSAMLphp Authentication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 6, 2021The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in aCVE-2021-24435 · WordPress plugins & themes · reported by WPScanMedium 6.1
The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues
Affected
up to 1.12.1
What to do
Affects up to 1.12.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 2, 2021The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file.CVE-2021-39322 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Product
Easy Social Icons
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Easy Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Sep 1, 2021The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file.CVE-2021-39320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Product
underConstruction
Affected
up to 1.18
What to do
Affects up to 1.18. Update underConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
Aug 31, 2021The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsCVE-2021-39316 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.
Product
Zoomsounds
Affected
up to 6.45
What to do
Affects up to 6.45. Update Zoomsounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
Aug 16, 2021PhoneTrack Meu Site Manager: Does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the pageCVE-2021-24534 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
Product
PhoneTrack Meu Site Manager
Affected
up to 0.1
What to do
Affects up to 0.1. Update PhoneTrack Meu Site Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021Calendar Event Multi View: Does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/editCVE-2021-24498 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.
Product
Calendar Event Multi View
Fixed in
1.4.01
What to do
Update Calendar Event Multi View to 1.4.01 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-atCVE-2021-24457 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_portfolios() and get_portfolio_attributes() functions in the class-portfolio-responsive-gallery-list-table.php and class-portfolio-responsive-gallery-attributes-list-table.php files of the Portfolio Responsive Gallery WordPress plugin before 1.1.8 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Fixed in
1.1.8
What to do
Update the plugin to 1.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021Speed Booster Pack ⚡ PageSpeed Optimization Suite: Did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP fileCVE-2021-24430 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Speed Booster Pack ⚡ PageSpeed Optimization Suite WordPress plugin before 4.2.0 did not validate its caching_exclude_urls and caching_include_query_strings settings before outputting them in a PHP file, which could lead to RCE
Product
Speed Booster Pack ⚡ PageSpeed Optimization Suite
Fixed in
4.2.0
What to do
Update Speed Booster Pack ⚡ PageSpeed Optimization Suite to 4.2.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jul 13, 2021A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in thCVE-2020-26153 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Fixed in
4.10.7.p
What to do
Update the plugin to 4.10.7.p or newer.
Full record and what to do →NVD record github.com labs.nettitude.com
Jul 7, 2021A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users CVE-2021-34624 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for userCVE-2021-34623 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible fCVE-2021-34622 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible foCVE-2021-34621 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
May 5, 2021EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHPCVE-2016-20010 · WordPress plugins & themes · reported by MITRECritical 10
EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5.
Fixed in
2.8.5
What to do
Update the plugin to 2.8.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 27, 2021Requests is a HTTP library written in PHP.CVE-2021-29476 · WordPress plugins & themes · reported by GitHubCritical 9.8
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
Product
Requests
What to do
Update Requests to the newest version.
Full record and what to do →NVD record github.com github.com
Apr 12, 2021In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcodCVE-2021-24226 · WordPress plugins & themes · reported by WPScanHigh 7.5
In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.
Product
AccessAlly
Fixed in
3.5.7
What to do
Update AccessAlly to 3.5.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2021run_action function of the Facebook for: Deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerabilityCVE-2021-24217 · WordPress plugins & themes · reported by WPScanHigh 8.1
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
Product
run_action function of the Facebook for
Fixed in
3.0.0
What to do
Update run_action function of the Facebook for to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter.CVE-2021-24206 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the image box widget (includes/widgets/image-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter.CVE-2021-24205 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget (includes/widgets/icon-box.php) accepts a ‘title_size’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_size’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter.CVE-2021-24204 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the accordion widget (includes/widgets/accordion.php) accepts a ‘title_html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request containing JavaScript in the ‘title_html_tag’ parameter, which is not filtered and is output without escaping. This JavaScript will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter.CVE-2021-24203 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget (includes/widgets/divider.php) accepts an ‘html_tag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified ‘save_builder’ request with this parameter set to ‘script’ and combined with a ‘text’ parameter containing JavaScript, which will then be executed when the saved page is viewed or previewed.
Product
Elementor Website Builder
Fixed in
3.1.4
What to do
Update Elementor Website Builder to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.