Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 32 of 39
Mar 14, 2022WP Voting Contest: Does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
- Product
- WP Voting Contest
- Fixed in
- 3.0
- What to do
- Update WP Voting Contest to 3.0 or newer.
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
- Product
- WordPress Zero Spam
- Fixed in
- 5.2.11
- What to do
- Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
- Product
- Contact Form Submissions
- Fixed in
- 1.7.3
- What to do
- Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Better WordPress Google XML Sitemaps: Does not sanitise and escape its logsCVE-2022-0230 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
- Product
- Better WordPress Google XML Sitemaps
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Better WordPress Google XML Sitemaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022ARI Fancy Lightbox: Does not sanitise and escape the msg parameter before outputting it back in an admin pageCVE-2022-0161 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- ARI Fancy Lightbox
- Fixed in
- 1.3.9
- What to do
- Update ARI Fancy Lightbox to 1.3.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Patreon: Does not sanitise and escape the field "Custom Patreon Page name"CVE-2021-25026 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Patreon
- Fixed in
- 1.8.2
- What to do
- Update Patreon to 1.8.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leadingCVE-2021-24996 · WordPress plugins & themes · reported by WPScanMedium 6.1
The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting
- Product
- IDPay for Contact Form 7
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update IDPay for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022HTML5 Responsive FAQ: Does not properly sanitise and escape some of its settingsCVE-2021-24995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HTML5 Responsive FAQ WordPress plugin through 2.8.5 does not properly sanitise and escape some of its settings, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- HTML5 Responsive FAQ
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update HTML5 Responsive FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Child Theme Generator: Does not sanitise escape the parade parameter before outputting it backCVE-2021-24982 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Child Theme Generator WordPress plugin through 2.2.7 does not sanitise escape the parade parameter before outputting it back, leading to a Reflected Cross-Site Scripting in the admin dashboard
- Product
- Child Theme Generator
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update Child Theme Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Add Subtitle: Does not sanitise or escape the sub-title field (available only with classic editor)CVE-2021-24897 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Add Subtitle
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Add Subtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Cybersoldier: Does not sanitise and escape the URL settings before outputting it in an attributeCVE-2021-24895 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Cybersoldier
- Fixed in
- 1.7.0
- What to do
- Update Cybersoldier to 1.7.0 or newer.
Mar 7, 2022E2Pdf: Does not sanitise and escape some of its settingsCVE-2022-0535 · WordPress plugins & themes · reported by WPScanMedium 4.8
The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- E2Pdf
- Fixed in
- 1.16.45
- What to do
- Update E2Pdf to 1.16.45 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022CP Blocks: Does not sanitise and escape its "License ID" settingsCVE-2022-0448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- CP Blocks
- Fixed in
- 1.0.15
- What to do
- Update CP Blocks to 1.0.15 or newer.
Mar 7, 2022Page View Count: Does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpointCVE-2022-0434 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks
- Product
- Page View Count
- Fixed in
- 2.4.15
- What to do
- Update Page View Count to 2.4.15 or newer.
Mar 7, 2022WP Cerber Security, Anti-spam & Malware Scan: Does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboardCVE-2022-0429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 8.9.6
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 8.9.6 or newer.
Mar 7, 2022White Label CMS: Does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewingCVE-2022-0422 · WordPress plugins & themes · reported by WPScanMedium 6.1
The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue
- Product
- White Label CMS
- Fixed in
- 2.2.9
- What to do
- Update White Label CMS to 2.2.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022RegistrationMagic: Does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboardCVE-2022-0420 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
- Product
- RegistrationMagic
- Fixed in
- 5.0.2.2
- What to do
- Update RegistrationMagic to 5.0.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022WP Visitor Statistics (Real Time Traffic): Does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX actionCVE-2022-0410 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 5.6
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 5.6 or newer.
Mar 7, 2022WP Time Slots Booking Form: Does not sanitise and escape Calendar namesCVE-2022-0389 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Time Slots Booking Form
- Fixed in
- 1.1.63
- What to do
- Update WP Time Slots Booking Form to 1.1.63 or newer.
Mar 7, 2022NotificationX: Does not sanitise and escape the nx_id parameter before using it in a SQL statementCVE-2022-0349 · WordPress plugins & themes · reported by WPScanCritical 9.8
The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
- Product
- NotificationX
- Fixed in
- 2.3.9
- What to do
- Update NotificationX to 2.3.9 or newer.
Mar 7, 2022AdRotate: Does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to adminsCVE-2022-0267 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
- Product
- AdRotate
- Fixed in
- 5.8.22
- What to do
- Update AdRotate to 5.8.22 or newer.
Mar 7, 2022YOP Poll: Does not sanitise and escape some of the settings (available to users with a roleCVE-2022-0205 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue
- Product
- YOP Poll
- Fixed in
- 6.3.5
- What to do
- Update YOP Poll to 6.3.5 or newer.
Mar 7, 2022WordPress Multisite Content Copier/Updater: Does not sanitise and escape the wmcc_content_typeCVE-2021-25039 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- WordPress Multisite Content Copier/Updater
- Fixed in
- 2.1.0
- What to do
- Update WordPress Multisite Content Copier/Updater to 2.1.0 or newer.
Mar 7, 2022WordPress Multisite User Sync/Unsync: Does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributesCVE-2021-25038 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- WordPress Multisite User Sync/Unsync
- Fixed in
- 2.1.2
- What to do
- Update WordPress Multisite User Sync/Unsync to 2.1.2 or newer.
Mar 7, 2022Advanced iFrame: Does not sanitise and escape the ai_config_id parameter before outputting it back in an admin pageCVE-2021-24953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- Advanced iFrame
- Fixed in
- 2022
- What to do
- Update Advanced iFrame to 2022 or newer.
Mar 7, 2022Conversios.io: Does not sanitiseCVE-2021-24952 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_wise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks.
- Product
- Conversios.io
- Fixed in
- 4.6.2
- What to do
- Update Conversios.io to 4.6.2 or newer.
Mar 7, 2022test parameter of the xmlfeed in the Tradetracker-Store: Is not sanitisedCVE-2021-24778 · WordPress plugins & themes · reported by WPScanHigh 7.2
The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- test parameter of the xmlfeed in the Tradetracker-Store
- Fixed in
- 4.6.60
- What to do
- Update test parameter of the xmlfeed in the Tradetracker-Store to 4.6.60 or newer.
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloaCVE-2022-23988 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
- Fixed in
- 1.8.176
- What to do
- Update the plugin to 1.8.176 or newer.
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-SiCVE-2022-23987 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Fixed in
- 1.8.176
- What to do
- Update the plugin to 1.8.176 or newer.
Feb 28, 2022Testimonial: Does not sanitise and escape the id parameter before outputting it back in an attributeCVE-2022-23912 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting
- Product
- Testimonial
- Fixed in
- 1.4.7
- What to do
- Update Testimonial to 1.4.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro: Do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpointCVE-2022-0412 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks
- Product
- TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro
- Fixed in
- 1.40.1
- What to do
- Update TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro to 1.40.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Asgaros Forum: Does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user)CVE-2022-0411 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection
- Product
- Asgaros Forum
- Fixed in
- 2.0.0
- What to do
- Update Asgaros Forum to 2.0.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Crazy Bone: Does not sanitise and escape the username submitted via the login fromCVE-2022-0385 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting
- Product
- Crazy Bone
- Affected
- up to 0.6.0
- What to do
- Affects up to 0.6.0. Update Crazy Bone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022WP Review Slider: Does not sanitise and escape the pid parameterCVE-2022-0383 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privilege users to perform SQL Injections attacks
- Product
- WP Review Slider
- Fixed in
- 11.0
- What to do
- Update WP Review Slider to 11.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022Easy Drag And drop All Import : WP Ultimate CSV Importer: Does not sanitise and escaped imported commentsCVE-2022-0360 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
- Product
- Easy Drag And drop All Import : WP Ultimate CSV Importer
- Fixed in
- 6.4.3
- What to do
- Update Easy Drag And drop All Import : WP Ultimate CSV Importer to 6.4.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022WP RSS Aggregator: Does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the responseCVE-2022-0189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- WP RSS Aggregator
- Fixed in
- 4.20
- What to do
- Update WP RSS Aggregator to 4.20 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022WP Accessibility Helper (WAH): Does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the pageCVE-2022-0150 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue
- Product
- WP Accessibility Helper (WAH)
- Fixed in
- 0.6.0.7
- What to do
- Update WP Accessibility Helper (WAH) to 0.6.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022WP-Paginate: Does not sanitise and escape its preset settingsCVE-2021-4222 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP-Paginate
- Fixed in
- 2.1.4
- What to do
- Update WP-Paginate to 2.1.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Feb 28, 2022WHMCS Bridge: Does not sanitise and escape the error parameter before outputting it back in admin dashboardCVE-2021-25112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- WHMCS Bridge
- Fixed in
- 6.4b
- What to do
- Update WHMCS Bridge to 6.4b or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022WP Visitor Statistics (Real Time Traffic): Does not have authorisation and CSRF checks in the updateIpAddress AJAX actionCVE-2021-25042 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 5.5
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 5.5 or newer.
Feb 28, 2022WP User: Does not sanitise and escape some parameters in pages where the [wp_user] shortcode is usedCVE-2021-25034 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues
- Product
- WP User
- Fixed in
- 7.0
- What to do
- Update WP User to 7.0 or newer.
Feb 28, 2022StatCounter: Does not sanitise and escape the Project ID and Secure Code settingsCVE-2021-24920 · WordPress plugins & themes · reported by WPScanMedium 4.8
The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- StatCounter
- Fixed in
- 2.0.7
- What to do
- Update StatCounter to 2.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022GRAND FlaGallery: Does not sanitise and escape some of its gallery settingsCVE-2021-24903 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privilege users to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- GRAND FlaGallery
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update GRAND FlaGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022Security Audit: Does not sanitise and escape the Data Id settingCVE-2021-24901 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Security Audit
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Security Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022EditableTable: Does not sanitise and escape any of the Table and Column fieldsCVE-2021-24898 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- EditableTable
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update EditableTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 202215Zine: Does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX actionCVE-2020-36510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- 15Zine
- Fixed in
- 3.3.0
- What to do
- Update 15Zine to 3.3.0 or newer.
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25307 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25306 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the browser parameter found in the ~/includes/class-wp-statistics-visitor.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Feb 24, 2022WP Statistics: Cross-Site ScriptingCVE-2022-25305 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Feb 24, 2022WP Statistics: SQL InjectionCVE-2022-25149 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
- Product
- WP Statistics
- Affected
- up to 13.1.5
- What to do
- Affects up to 13.1.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.