Updated 15 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

1,831 results · page 35 of 37

May 30, 2022Form Maker by 10Web: Does not sanitize and escape the Custom Text settingsCVE-2022-1564 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Form Maker by 10Web
Fixed in
1.14.12
What to do
Update Form Maker by 10Web to 1.14.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Custom TinyMCE Shortcode Button: Does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin pageCVE-2022-1217 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
Product
Custom TinyMCE Shortcode Button
Affected
up to 1.1
What to do
Affects up to 1.1. Update Custom TinyMCE Shortcode Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2022Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or highCVE-2021-36912 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress, attackers must have contributor or higher user role.
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 2, 2022Import and export users and customers: Does not sanitise and escaped imported CSV dataCVE-2022-1255 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
Product
Import and export users and customers
Fixed in
1.19.2.1
What to do
Update Import and export users and customers to 1.19.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2022-27854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher role via &wpt_test_page_submit_button_caption parameter.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2021-36867 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher user rights.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022Books & Papers: Does not escape its Custom DB prefix settingsCVE-2022-1156 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Books & Papers
Affected
up to 0.20210223
What to do
Affects up to 0.20210223. Update Books & Papers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022English WordPress Admin: Does not validate the admin_custom_language_return_url before redirecting users o itCVE-2021-25111 · WordPress plugins & themes · reported by WPScanMedium 6.1
The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue
Product
English WordPress Admin
Fixed in
1.5.2
What to do
Update English WordPress Admin to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Tatsu: Add_custom_font action can be used without prior authentication to upload a rogue zip fileCVE-2021-25094 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.
Product
Tatsu
Fixed in
3.3.12
What to do
Update Tatsu to 3.3.12 or newer.
Full record and what to do →NVD record packetstormsecurity.com darkpills.com
Apr 11, 2022The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to aCVE-2022-0920 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data
Fixed in
7.6.3
What to do
Update the plugin to 7.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 31, 2022Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1: Missing authorizationCVE-2022-23183 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
Product
Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1
What to do
Update Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Mar 14, 2022Patreon: Does not sanitise and escape the field "Custom Patreon Page name"CVE-2021-25026 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Patreon
Fixed in
1.8.2
What to do
Update Patreon to 1.8.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022Insight Core: Does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user)CVE-2021-24950 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user), does not validate user input before passing it to unserialize(), nor sanitise and escape it before outputting it in the response. As a result, it could allow users with a role as low as Subscriber to perform PHP Object Injection, as well as Stored Cross-Site Scripting attacks
Product
Insight Core
Affected
up to 1.0
What to do
Affects up to 1.0. Update Insight Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022White Label CMS: Does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewingCVE-2022-0422 · WordPress plugins & themes · reported by WPScanMedium 6.1
The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue
Product
White Label CMS
Fixed in
2.2.9
What to do
Update White Label CMS to 2.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022LoginPress | Custom Login Page Customizer: Does not escape the redirect-page parameter before outputting it back in an attributeCVE-2022-0347 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
LoginPress | Custom Login Page Customizer
Fixed in
1.5.12
What to do
Update LoginPress | Custom Login Page Customizer to 1.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022Custom Content Shortcode: Does not escape custom fields before outputting themCVE-2021-24826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)
Product
Custom Content Shortcode
Fixed in
4.0.2
What to do
Update Custom Content Shortcode to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022Custom Content Shortcode: Does not validate the data passed to its load shortcodeCVE-2021-24825 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to display arbitrary files from the filesystem (such as logs, .htaccess etc), as well as perform Local File Inclusion attacks as PHP files will be executed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when either the unfiltered_html or file_edit is disallowed)
Product
Custom Content Shortcode
Fixed in
4.0.2
What to do
Update Custom Content Shortcode to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, toCVE-2021-24824 · WordPress plugins & themes · reported by WPScanMedium 4.3
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
Product
[field] shortcode included with the Custom Content Shortcode
Fixed in
4.0.1
What to do
Update [field] shortcode included with the Custom Content Shortcode to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022Customize WordPress Emails and Alerts: Does not have authorisation and CSRF check in its bnfw_search_users AJAX actionCVE-2022-0345 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
Product
Customize WordPress Emails and Alerts
Fixed in
1.8.7
What to do
Update Customize WordPress Emails and Alerts to 1.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022Use Any Font | Custom Font Uploader: Does not have any authorisation checksCVE-2021-24977 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues
Product
Use Any Font | Custom Font Uploader
Fixed in
6.2.1
What to do
Update Use Any Font | Custom Font Uploader to 6.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Custom Popup Builder: Autoload data from its popup on every pagesCVE-2022-0214 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
Product
Custom Popup Builder
Fixed in
1.3.1
What to do
Update Custom Popup Builder to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Custom Dashboard & Login Page: Does not sanitise some of its settingsCVE-2021-24944 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Custom Dashboard & Login Page
Fixed in
7.0
What to do
Update Custom Dashboard & Login Page to 7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Advanced Custom Fields: Extended: Does not validate the order and orderby parameters before using them in a SQL statementCVE-2021-24865 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
Product
Advanced Custom Fields: Extended
Fixed in
0.8.8.7
What to do
Update Advanced Custom Fields: Extended to 0.8.8.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 17, 2022Smash Balloon Social Post Feed: Was affected by a reflected XSS in custom-facebook-feed in cff-top admin pageCVE-2021-25065 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.
Product
Smash Balloon Social Post Feed
Fixed in
4.1.1
What to do
Update Smash Balloon Social Post Feed to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 10, 2022WOOCS: Does not sanitise and escape the custom_prices parameter before outputting it back in the responseCVE-2021-25043 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.3 does not sanitise and escape the custom_prices parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
WOOCS
Fixed in
1.3.7.3
What to do
Update WOOCS to 1.3.7.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 21, 2021The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenCVE-2021-24846 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber
Product
Ni WooCommerce Custom Order Status
Fixed in
1.9.7
What to do
Update Ni WooCommerce Custom Order Status to 1.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Get Custom Field Values: Allows users with a roleCVE-2021-24872 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.
Product
Get Custom Field Values
Fixed in
4.0
What to do
Update Get Custom Field Values to 4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Get Custom Field Values: Does not escape custom fields before outputting them in the pageCVE-2021-24871 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
Get Custom Field Values
Fixed in
4.0.1
What to do
Update Get Custom Field Values to 4.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Display Post Metadata: Adds a shortcode to print out custom fieldsCVE-2021-24855 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Product
Display Post Metadata
Fixed in
1.5.0
What to do
Update Display Post Metadata to 1.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021moving the field group which may allow a user to move the unauthorized field group: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20867 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
Product
moving the field group which may allow a user to move the unauthorized field group
What to do
Update moving the field group which may allow a user to move the unauthorized field group to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 13, 2021obtaining the user list which may allow a user to obtain the unauthorized information: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20866 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
Product
obtaining the user list which may allow a user to obtain the unauthorized information
What to do
Update obtaining the user list which may allow a user to obtain the unauthorized information to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 13, 2021browsing database which may allow a user to browse unauthorized data: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20865 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
Product
browsing database which may allow a user to browse unauthorized data
What to do
Update browsing database which may allow a user to browse unauthorized data to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Nov 17, 2021Insert Pages: Adds a shortcode that prints out other pages' content and custom fieldsCVE-2021-24850 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields.
Product
Insert Pages
Fixed in
3.7.0
What to do
Update Insert Pages to 3.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Batch Cat: Defines 3 custom AJAX actionsCVE-2021-24788 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any authenticated user (including simple subscribers) can add/set/delete arbitrary categories to posts.
Product
Batch Cat
Affected
up to 0.3
What to do
Affects up to 0.3. Update Batch Cat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Redirect 404 Error Page to Homepage or Custom Page with Logs: Does not check for CSRFCVE-2021-24767 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
Product
Redirect 404 Error Page to Homepage or Custom Page with Logs
Fixed in
1.7.9
What to do
Update Redirect 404 Error Page to Homepage or Custom Page with Logs to 1.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Events Made Easy: Does not sanitise and escape Custom Field NamesCVE-2021-24813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Events Made Easy
Fixed in
2.2.24
What to do
Update Events Made Easy to 2.2.24 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 1, 2021Modern Events Calendar Lite: Does not properly sanitize or escape values set by users with access to adjust settings withing wp-adminCVE-2021-24716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users with access to adjust settings withing wp-admin.
Product
Modern Events Calendar Lite
Fixed in
5.22.3
What to do
Update Modern Events Calendar Lite to 5.22.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Ninja Forms Contact Form
Fixed in
3.5.8.2
What to do
Update Ninja Forms Contact Form to 3.5.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Customer Service Software & Support Ticket System: Does not sanitize or escape form fields before outputting it in the ListCVE-2021-24622 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Customer Service Software & Support Ticket System
Fixed in
5.10.4
What to do
Update Customer Service Software & Support Ticket System to 5.10.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Gutenberg Block Editor Toolkit – EditorsKit: Does not sanitise and validate the Conditional Logic of the Custom Visibility settingsCVE-2021-24546 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code
Product
Gutenberg Block Editor Toolkit – EditorsKit
Fixed in
1.31.6
What to do
Update Gutenberg Block Editor Toolkit – EditorsKit to 1.31.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2021AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-36823 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) allows Stored XSS.This issue affects AGCA - Absolutely Glamorous Custom Admin (WordPress plugin): from n/a through 6.8.
Product
AGCA - Absolutely Glamorous Custom Admin (WordPress plugin)
Affected
up to 6.8
What to do
Affects up to 6.8. Update AGCA - Absolutely Glamorous Custom Admin (WordPress plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 20, 2021Alojapro Widget: Doesn't properly sanitise its Custom CSS settingsCVE-2021-24530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Alojapro Widget
Affected
up to 1.1.15
What to do
Affects up to 1.1.15. Update Alojapro Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021create_post_page AJAX action of the Custom Post View Generator: (available to authenticated user) does not sanitise or escape user input before outputting it back in the responseCVE-2021-24605 · WordPress plugins & themes · reported by WPScanMedium 5.4
The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue
Product
create_post_page AJAX action of the Custom Post View Generator
Affected
up to 0.4.6
What to do
Affects up to 0.4.6. Update create_post_page AJAX action of the Custom Post View Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 10, 2021Custom Website Data: Reflected Cross-Site ScriptingCVE-2021-38347 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.
Product
Custom Website Data
Affected
up to 2.2
What to do
Affects up to 2.2. Update Custom Website Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 9, 2021Custom Menu Plugin: Reflected Cross-Site ScriptingCVE-2021-38321 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selected_menu parameter found in the ~/custom-menus.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.3.
Product
Custom Menu Plugin
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Custom Menu Plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 6, 2021Highlight: Does not sanitise its CustomCSS settingCVE-2021-24591 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Highlight
Fixed in
0.9.3
What to do
Update Highlight to 0.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2021Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization optionsCVE-2021-24590 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.
Product
Cookie Notice & Consent Banner for GDPR & CCPA Compliance
Fixed in
1.7.2
What to do
Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to 1.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021Erident Custom Login and Dashboard: Did not properly sanitise its settingsCVE-2021-24658 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
Product
Erident Custom Login and Dashboard
Fixed in
3.5.9
What to do
Update Erident Custom Login and Dashboard to 3.5.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Aug 16, 2021Custom Post Type Relations: Reflected Cross-Site ScriptingCVE-2021-34654 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptr[name] parameter found in the ~/pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
Custom Post Type Relations
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Post Type Relations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 16, 2021Custom Login Redirect: Does not have CSRF check in placeCVE-2021-24536 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue
Product
Custom Login Redirect
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Custom Login Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.