Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 36 of 39
Oct 4, 2021Meow Gallery: Does not sanitiseCVE-2021-24465 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available for users as low as Contributor) before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned values to be manipulated in a way that could lead to data disclosure and arbitrary objects to be deserialized.
- Product
- Meow Gallery
- Fixed in
- 4.1.9
- What to do
- Update Meow Gallery to 4.1.9 or newer.
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not properly sanitise or escape some of the properties of the Recipe Card Block (suchCVE-2021-24634 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Recipe Card Blocks by WPZOOM
- Fixed in
- 2.8.3
- What to do
- Update Recipe Card Blocks by WPZOOM to 2.8.3 or newer.
Sep 27, 2021TranslatePress: Does not implement a proper sanitisation on the translated stringsCVE-2021-24610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.
- Product
- TranslatePress
- Fixed in
- 2.0.9
- What to do
- Update TranslatePress to 2.0.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 20, 2021Google Fonts Typography: Does not escape and sanitise some of its block settingsCVE-2021-24637 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Fonts Typography WordPress plugin before 3.0.3 does not escape and sanitise some of its block settings, allowing users with as role as low as Contributor to perform Stored Cross-Site Scripting attacks via blockType (combined with content), align, color, variant and fontID argument of a Gutenberg block.
- Product
- Google Fonts Typography
- Fixed in
- 3.0.3
- What to do
- Update Google Fonts Typography to 3.0.3 or newer.
Sep 20, 2021Donate With QRCode: Does not sanitise or escape its QRCode Image settingCVE-2021-24618 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donate With QRCode WordPress plugin before 1.4.5 does not sanitise or escape its QRCode Image setting, which result into a Stored Cross-Site Scripting (XSS). Furthermore, the plugin also does not have any CSRF and capability checks in place when saving such setting, allowing any authenticated user (as low as subscriber), or unauthenticated user via a CSRF vector to update them and perform such attack.
- Product
- Donate With QRCode
- Fixed in
- 1.4.5
- What to do
- Update Donate With QRCode to 1.4.5 or newer.
Sep 20, 2021Post Views Counter: Does not sanitise or escape its Post Views Label settingsCVE-2021-24613 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
- Product
- Post Views Counter
- Fixed in
- 1.3.5
- What to do
- Update Post Views Counter to 1.3.5 or newer.
Sep 20, 2021WP Mapa Politico Espana: Does not sanitise or escape some of its settings before outputting them in attributesCVE-2021-24609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP Mapa Politico Espana
- Fixed in
- 3.7.0
- What to do
- Update WP Mapa Politico Espana to 3.7.0 or newer.
Sep 20, 2021Availability Calendar: Does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embedCVE-2021-24604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Availability Calendar
- Fixed in
- 1.2.2
- What to do
- Update Availability Calendar to 1.2.2 or newer.
Sep 20, 2021WP Dialog: Does not sanitise and escape some of its settings before outputting them in pagesCVE-2021-24600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Dialog WordPress plugin through 1.2.5.5 does not sanitise and escape some of its settings before outputting them in pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Dialog
- Affected
- up to 1.2.5.5
- What to do
- Affects up to 1.2.5.5. Update WP Dialog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021youForms for: Does not sanitise escape the Button Text field of its TemplatesCVE-2021-24596 · WordPress plugins & themes · reported by WPScanMedium 4.8
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- youForms for
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update youForms for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021Splash Header: Doesn't sanitise and escape some of its settings while outputting them in the admin dashboardCVE-2021-24587 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.
- Product
- Splash Header
- Fixed in
- 1.20.8
- What to do
- Update Splash Header to 1.20.8 or newer.
Sep 20, 2021ThinkTwit: Did not sanitise or escape its "Consumer key" setting before outputting it its settings pageCVE-2021-24582 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ThinkTwit WordPress plugin before 1.7.1 did not sanitise or escape its "Consumer key" setting before outputting it its settings page, leading to a Stored Cross-Site Scripting issue.
- Product
- ThinkTwit
- Fixed in
- 1.7.1
- What to do
- Update ThinkTwit to 1.7.1 or newer.
Sep 20, 2021Alojapro Widget: Doesn't properly sanitise its Custom CSS settingsCVE-2021-24530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Alojapro Widget
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update Alojapro Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2021The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before insertinCVE-2021-24403 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
- Product
- Orders functionality in the WordPress Page Contact
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Orders functionality in the WordPress Page Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 20, 2021A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statemeCVE-2021-24396 · WordPress plugins & themes · reported by WPScanHigh 7.2
A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- GSEOR – WordPress SEO
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update GSEOR – WordPress SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 13, 2021Membership & Content Restriction – Paid Member Subscriptions: Did not sanitiseCVE-2021-24728 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages.
- Product
- Membership & Content Restriction – Paid Member Subscriptions
- Fixed in
- 2.4.2
- What to do
- Update Membership & Content Restriction – Paid Member Subscriptions to 2.4.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 13, 2021Timetable and Event Schedule by MotoPress: Does not sanitise some of its parametersCVE-2021-24724 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
- Product
- Timetable and Event Schedule by MotoPress
- Fixed in
- 2.3.19
- What to do
- Update Timetable and Event Schedule by MotoPress to 2.3.19 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 13, 2021WP Courses LMS: Does not sanitise its Video Embed CodeCVE-2021-24621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfiltered_html capability is disallowed, which could lead to Stored Cross-Site Scripting issues
- Product
- WP Courses LMS
- Fixed in
- 2.0.44
- What to do
- Update WP Courses LMS to 2.0.44 or newer.
Sep 13, 2021Per page add to head: Does not properly sanitise one of its settingCVE-2021-24619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
- Product
- Per page add to head
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Per page add to head to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Book appointment online: Does not sanitise or escape Service Prices before outputting it in the ListCVE-2021-24614 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Book appointment online
- Fixed in
- 1.39
- What to do
- Update Book appointment online to 1.39 or newer.
Sep 13, 2021create_post_page AJAX action of the Custom Post View Generator: (available to authenticated user) does not sanitise or escape user input before outputting it back in the responseCVE-2021-24605 · WordPress plugins & themes · reported by WPScanMedium 5.4
The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue
- Product
- create_post_page AJAX action of the Custom Post View Generator
- Affected
- up to 0.4.6
- What to do
- Affects up to 0.4.6. Update create_post_page AJAX action of the Custom Post View Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Software License Manager: Does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboardCVE-2021-24560 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Software License Manager
- Fixed in
- 4.4.8
- What to do
- Update Software License Manager to 4.4.8 or newer.
Sep 13, 2021Daily Prayer Time: Does not sanitise or escape some of its settings before outputting them in the pageCVE-2021-24523 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.
- Product
- Daily Prayer Time
- Fixed in
- 2021.08.10
- What to do
- Update Daily Prayer Time to 2021.08.10 or newer.
Sep 13, 2021MF Gig Calendar: Does not sanitise and escape the id GET parameter before outputting back in the admin dashboardCVE-2021-24510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
- Product
- MF Gig Calendar
- Fixed in
- 1.2
- What to do
- Update MF Gig Calendar to 1.2 or newer.
Sep 13, 2021Smash Balloon Social Post Feed: Does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of iCVE-2021-24508 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 2.19.2
- What to do
- Update Smash Balloon Social Post Feed to 2.19.2 or newer.
Sep 6, 2021Keyword Meta: Does not sanitise of escape its settings before outputting them back in the page after they are savedCVE-2021-24611 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.
- Product
- Keyword Meta
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Keyword Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2021Site Reviews: Does not sanitise some of its Review DetailsCVE-2021-24603 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed
- Product
- Site Reviews
- Fixed in
- 5.13.1
- What to do
- Update Site Reviews to 5.13.1 or newer.
Sep 6, 2021WPFront Notification Bar: Does not properly sanitise and escape its settingsCVE-2021-24601 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WPFront Notification Bar
- Fixed in
- 2.1.0.08087
- What to do
- Update WPFront Notification Bar to 2.1.0.08087 or newer.
Sep 6, 2021Highlight: Does not sanitise its CustomCSS settingCVE-2021-24591 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Highlight
- Fixed in
- 0.9.3
- What to do
- Update Highlight to 0.9.3 or newer.
Sep 6, 2021AddToAny Share Buttons: Does not sanitise its Sharing Header settingCVE-2021-24568 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- AddToAny Share Buttons
- Fixed in
- 1.7.46
- What to do
- Update AddToAny Share Buttons to 1.7.46 or newer.
Sep 6, 2021Form Builder | Create Responsive Contact Forms: Does not sanitise or escape its Form TitleCVE-2021-24513 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
- Product
- Form Builder | Create Responsive Contact Forms
- Fixed in
- 1.9.8.4
- What to do
- Update Form Builder | Create Responsive Contact Forms to 1.9.8.4 or newer.
Sep 6, 2021editid GET parameter of the Embed Youtube Video: Is not sanitisedCVE-2021-24395 · WordPress plugins & themes · reported by WPScanHigh 7.2
The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- editid GET parameter of the Embed Youtube Video
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update editid GET parameter of the Embed Youtube Video to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, lCVE-2021-24394 · WordPress plugins & themes · reported by WPScanHigh 7.2
An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection
- Product
- Easy Testimonial Manager
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Easy Testimonial Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, CVE-2021-24393 · WordPress plugins & themes · reported by WPScanHigh 7.2
A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- Comment Highlighter
- Affected
- up to 0.13
- What to do
- Affects up to 0.13. Update Comment Highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to aCVE-2021-24392 · WordPress plugins & themes · reported by WPScanHigh 7.2
An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- WordPress Membership SwiftCloud.io
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WordPress Membership SwiftCloud.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leaCVE-2021-24391 · WordPress plugins & themes · reported by WPScanHigh 8.8
An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- Cashtomer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Cashtomer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 6, 2021A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before insCVE-2021-24390 · WordPress plugins & themes · reported by WPScanHigh 7.2
A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.
- Product
- WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 30, 2021Business Hours Indicator: Does not sanitise or escape its 'Now closed message" settingCVE-2021-24593 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue
- Product
- Business Hours Indicator
- Fixed in
- 2.3.5
- What to do
- Update Business Hours Indicator to 2.3.5 or newer.
Aug 30, 2021Sitewide Notice WP: Does not sanitise some of its settings before outputting them in frontend pagesCVE-2021-24592 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Sitewide Notice WP
- Fixed in
- 2.3
- What to do
- Update Sitewide Notice WP to 2.3 or newer.
Aug 30, 2021Blue Admin: Does not sanitise or escape its "Logo Title" setting before outputting in a pageCVE-2021-24581 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.
- Product
- Blue Admin
- Affected
- up to 21.06.01
- What to do
- Affects up to 21.06.01. Update Blue Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 30, 2021Side Menu Lite: Does not sanitise user input from the List page in the admin dashboard before using it in SQL statementCVE-2021-24580 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue
- Product
- Side Menu Lite
- Fixed in
- 2.2.6
- What to do
- Update Side Menu Lite to 2.2.6 or newer.
Aug 30, 2021bt_bb_get_grid AJAX action of the Bold Page Builder: Passes user input into the unserialize() function without any validation or sanitisationCVE-2021-24579 · WordPress plugins & themes · reported by WPScanHigh 8.8
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.
- Product
- bt_bb_get_grid AJAX action of the Bold Page Builder
- Fixed in
- 3.1.6
- What to do
- Update bt_bb_get_grid AJAX action of the Bold Page Builder to 3.1.6 or newer.
Aug 30, 2021ShareThis Dashboard for Google Analytics: Does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attributeCVE-2021-24438 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
- Product
- ShareThis Dashboard for Google Analytics
- Fixed in
- 2.5.2
- What to do
- Update ShareThis Dashboard for Google Analytics to 2.5.2 or newer.
Aug 30, 2021Favicon by RealFaviconGenerator: Does not sanitise or escape one of its parameter before outputting it back in the responseCVE-2021-24437 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin through 1.3.20 does not sanitise or escape one of its parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting (XSS) which is executed in the context of a logged administrator.
- Product
- Favicon by RealFaviconGenerator
- Affected
- up to 1.3.20
- What to do
- Affects up to 1.3.20. Update Favicon by RealFaviconGenerator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2021Erident Custom Login and Dashboard: Did not properly sanitise its settingsCVE-2021-24658 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
- Product
- Erident Custom Login and Dashboard
- Fixed in
- 3.5.9
- What to do
- Update Erident Custom Login and Dashboard to 3.5.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 23, 2021Simple Banner: Does not sanitise and escape one of its settingsCVE-2021-24574 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfiltered_html capability is disallowed.
- Product
- Simple Banner
- Fixed in
- 2.10.4
- What to do
- Update Simple Banner to 2.10.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 23, 2021WPFront Scroll Top: Does not sanitise or escape its Image ALT setting before outputting it attributesCVE-2021-24564 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
- Product
- WPFront Scroll Top
- Fixed in
- 2.0.6.07225
- What to do
- Update WPFront Scroll Top to 2.0.6.07225 or newer.
Aug 23, 2021WP SMS: Does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" pageCVE-2021-24561 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue
- Product
- WP SMS
- Fixed in
- 5.4.13
- What to do
- Update WP SMS to 5.4.13 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 23, 2021pspin_duplicate_post_save_as_new_post function of the Project Status: Does not sanitiseCVE-2021-24558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue
- Product
- pspin_duplicate_post_save_as_new_post function of the Project Status
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update pspin_duplicate_post_save_as_new_post function of the Project Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 23, 2021The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, thereCVE-2021-24557 · WordPress plugins & themes · reported by WPScanHigh 7.2
The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.