Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,200 results · page 35 of 44
Aug 22, 2022WP Edit Menu: Does not have authorisation and CSRF in an AJAX actionCVE-2022-2276 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog
- Product
- WP Edit Menu
- Fixed in
- 1.5.0
- What to do
- Update WP Edit Menu to 1.5.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 22, 2022WP Edit Menu: Does not have CSRF in an AJAX actionCVE-2022-2275 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary posts/pages from the blog via a CSRF attack
- Product
- WP Edit Menu
- Fixed in
- 1.5.0
- What to do
- Update WP Edit Menu to 1.5.0 or newer.
Aug 22, 2022Transposh WordPress Translation: Exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/adminCVE-2022-25810 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and backup/restore operations.
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Transposh WordPress Translation: Does not have CSRF check in its tp_translation AJAX actionCVE-2021-24912 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in admin
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the tk0 parameter from the tp_translation AJAX actionCVE-2021-24911 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated usersCVE-2021-24910 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 15, 2022Contact Form DB: Does not sanitise and escape some parameters before outputting them back in attributesCVE-2022-2116 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Contact Form DB
- Fixed in
- 1.8.0
- What to do
- Update Contact Form DB to 1.8.0 or newer.
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
- Product
- Website File Changes Monitor
- Fixed in
- 1.8.3
- What to do
- Update Website File Changes Monitor to 1.8.3 or newer.
Aug 8, 2022Discy: Lacks authorization checks then processing ajax requests to the discy_update_options actionCVE-2022-1323 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.
- Product
- Discy
- Fixed in
- 5.0
- What to do
- Update Discy to 5.0 or newer.
Aug 1, 2022YaySMTP: Does not have capability check in an AJAX actionCVE-2022-2369 · WordPress plugins & themes · reported by WPScanMedium 4.3
The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 1, 2022Youzify: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1950 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- Youzify
- Fixed in
- 1.2.0
- What to do
- Update Youzify to 1.2.0 or newer.
Aug 1, 2022Copyright Proof: Does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-1906 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
- Product
- Copyright Proof
- Affected
- up to 4.16
- What to do
- Affects up to 4.16. Update Copyright Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 25, 2022Professional Social Sharing Buttons, Icons & Related Posts: Does not have proper authorisation check in one of the AJAX actionCVE-2022-0594 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
- Product
- Professional Social Sharing Buttons, Icons & Related Posts
- Fixed in
- 9.7.6
- What to do
- Update Professional Social Sharing Buttons, Icons & Related Posts to 9.7.6 or newer.
Jul 17, 2022Contact Form 7 Captcha: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- Contact Form 7 Captcha
- Fixed in
- 0.1.2
- What to do
- Update Contact Form 7 Captcha to 0.1.2 or newer.
Jul 17, 2022Best Contact Management Software: Does not sanitise and escape its settingsCVE-2022-2151 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Best Contact Management Software
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Best Contact Management Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2022Jquery Validation For Contact Form 7: Does not have CSRF check in placeCVE-2022-2144 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog options like default_role, users_can_register via a CSRF attack
- Product
- Jquery Validation For Contact Form 7
- Fixed in
- 5.3
- What to do
- Update Jquery Validation For Contact Form 7 to 5.3 or newer.
Jul 17, 2022CDI: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1933 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
- Product
- CDI
- Fixed in
- 5.1.9
- What to do
- Update CDI to 5.1.9 or newer.
Jul 17, 2022Insights from Google PageSpeed: Does not verify for CSRF before doing various actions suchCVE-2022-1672 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks
- Product
- Insights from Google PageSpeed
- Fixed in
- 4.0.7
- What to do
- Update Insights from Google PageSpeed to 4.0.7 or newer.
Jul 11, 2022core plugin for kitestudio: Does not sanitise and escape some parameters before outputting them back in a response of an AJAX actionCVE-2022-1951 · WordPress plugins & themes · reported by WPScanMedium 6.1
The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting.
- Product
- core plugin for kitestudio
- Fixed in
- 2.3.1
- What to do
- Update core plugin for kitestudio to 2.3.1 or newer.
Jul 11, 2022Awin Data Feed: Does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
- Product
- Awin Data Feed
- Fixed in
- 1.8
- What to do
- Update Awin Data Feed to 1.8 or newer.
Jul 11, 2022Admin Management Xtended: Does not have CSRF checks in some of its AJAX actionsCVE-2022-1599 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.
- Product
- Admin Management Xtended
- Fixed in
- 2.4.5
- What to do
- Update Admin Management Xtended to 2.4.5 or newer.
Jul 11, 2022Pricing Deals for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1057 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- Pricing Deals for WooCommerce
- Affected
- up to 2.0.2.02
- What to do
- Affects up to 2.0.2.02. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2022Import any XML or CSV File to: Accepts all zip files and automatically extracts the zip file without validating the extracted file typeCVE-2022-2268 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.8
- What to do
- Update Import any XML or CSV File to to 3.6.8 or newer.
Jul 4, 2022Gallery: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1946 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
- Product
- Gallery
- Fixed in
- 2.0.0
- What to do
- Update Gallery to 2.0.0 or newer.
Jul 4, 2022WP Contact Slider: Does not sanitize and escape the Text to Display settings of slidersCVE-2022-1301 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP Contact Slider
- Fixed in
- 2.4.7
- What to do
- Update WP Contact Slider to 2.4.7 or newer.
Jul 4, 2022Redirection for Contact Form 7: Does not escape a link generated before outputting it in an attributeCVE-2022-0250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.5.0
- What to do
- Update Redirection for Contact Form 7 to 2.5.0 or newer.
Jul 4, 2022Ninja Forms Contact Form: Does not sanitize and escape some imported dataCVE-2021-25066 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.10
- What to do
- Update Ninja Forms Contact Form to 3.6.10 or newer.
Jul 4, 2022Ninja Forms Contact Form: Does not sanitise and escape field labelsCVE-2021-25056 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.10
- What to do
- Update Ninja Forms Contact Form to 3.6.10 or newer.
Jun 27, 2022Product Configurator for WooCommerce: Suffers from an arbitrary file deletion vulnerability via an AJAX actionCVE-2022-1953 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first
- Product
- Product Configurator for WooCommerce
- Fixed in
- 1.2.32
- What to do
- Update Product Configurator for WooCommerce to 1.2.32 or newer.
Jun 27, 2022Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenCVE-2022-1916 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting
- Product
- Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
- Fixed in
- 1.0.5
- What to do
- Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to 1.0.5 or newer.
Jun 27, 2022Clean-Contact: Does not have CSRF check in placeCVE-2022-1914 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS due to the lack of sanitisation and escaping as well
- Product
- Clean-Contact
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Clean-Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022ARMember: Is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated usersCVE-2022-1903 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
- Product
- ARMember
- Fixed in
- 3.4.8
- What to do
- Update ARMember to 3.4.8 or newer.
Jun 27, 2022Tiny Contact Form: Does not have CSRF check in placeCVE-2022-1846 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Tiny Contact Form
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Tiny Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022WP Post Styling: Does not have CSRF checks in various actionsCVE-2022-1845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks
- Product
- WP Post Styling
- Fixed in
- 1.3.1
- What to do
- Update WP Post Styling to 1.3.1 or newer.
Jun 27, 2022HTML2WP: Does not have authorisation and CSRF checks in an AJAX actionCVE-2022-1572 · WordPress plugins & themes · reported by WPScanHigh 8.1
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Form - Contact Form: Does not sanitize and escape Custom text fieldsCVE-2022-1326 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Form - Contact Form
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Form - Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Events Made Easy: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1905 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Events Made Easy
- Fixed in
- 2.2.81
- What to do
- Update Events Made Easy to 2.2.81 or newer.
Jun 20, 2022Very Simple Contact Form: Exposes the solution to the captcha in the rendered contact formCVE-2022-1801 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.
- Product
- Very Simple Contact Form
- Fixed in
- 11.6
- What to do
- Update Very Simple Contact Form to 11.6 or newer.
Jun 16, 2022Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36827 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
- Product
- Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at
- Affected
- up to 3.6.9
- What to do
- Affects up to 3.6.9. Update Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 13, 2022Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the inCVE-2022-1659 · WordPress plugins & themes · reported by WordfenceMedium 5.4
Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022Filr: Does not have authorisation check in two of its AJAX actionsCVE-2022-1777 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
- Product
- Filr
- Fixed in
- 1.2.2.1
- What to do
- Update Filr to 1.2.2.1 or newer.
Jun 13, 2022Simple Membership: Does not properly sanitise and escape parameters before outputting them back in AJAX actionsCVE-2022-1724 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
- Product
- Simple Membership
- Fixed in
- 4.1.1
- What to do
- Update Simple Membership to 4.1.1 or newer.
Jun 13, 2022Bestbooks: Does not sanitise and escape some parameters before using them in a SQL statement via an AJAX actionCVE-2022-0827 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- Bestbooks
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update Bestbooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022KiviCare: Does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details routeCVE-2022-0786 · WordPress plugins & themes · reported by WPScanCritical 9.8
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
- Product
- KiviCare
- Fixed in
- 2.3.9
- What to do
- Update KiviCare to 2.3.9 or newer.
Jun 13, 2022Enqueue Anything: Does not have authorisation and CSRF checks in the remove_asset AJAX actionCVE-2021-25116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
- Product
- Enqueue Anything
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Enqueue Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Note Press: Does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin pageCVE-2022-1690 · WordPress plugins & themes · reported by WPScanLow 2.7
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection
- Product
- Note Press
- Affected
- up to 0.1.10
- What to do
- Affects up to 0.1.10. Update Note Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Ask me: Does not perform CSRF checks for any of its AJAX actionsCVE-2022-1424 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform various actions on their behalf on the site.
- Product
- Ask me
- Fixed in
- 6.8.2
- What to do
- Update Ask me to 6.8.2 or newer.
Jun 8, 2022Discy: Does not check for CSRF tokens in the AJAX action discy_reset_optionsCVE-2022-1422 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetting the site settings back to defaults.
- Product
- Discy
- Fixed in
- 5.2
- What to do
- Update Discy to 5.2 or newer.
Jun 8, 2022Discy: Lacks CSRF checks in some AJAX actionsCVE-2022-1421 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack
- Product
- Discy
- Fixed in
- 5.2
- What to do
- Update Discy to 5.2 or newer.
Jun 8, 2022User Meta: Does not validate the filepath parameter of its um_show_uploaded_file AJAX actionCVE-2022-0779 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads
- Product
- User Meta
- Fixed in
- 2.4.4
- What to do
- Update User Meta to 2.4.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.