Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

2,154 results · page 39 of 44

May 5, 2021JetWidgets For Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24268 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “JetWidgets For Elementor” WordPress Plugin before 1.0.9 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
JetWidgets For Elementor
Fixed in
1.0.9
What to do
Update JetWidgets For Elementor to 1.0.9 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021All-in-One Addons for Elementor – WidgetKit: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24267 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
All-in-One Addons for Elementor – WidgetKit
Fixed in
2.3.10
What to do
Update All-in-One Addons for Elementor – WidgetKit to 2.3.10 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021The Plus Addons for Elementor Page Builder Lite: Has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24266 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “The Plus Addons for Elementor Page Builder Lite” WordPress Plugin before 2.0.6 has four widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
The Plus Addons for Elementor Page Builder Lite
Fixed in
2.0.6
What to do
Update The Plus Addons for Elementor Page Builder Lite to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Rife Elementor Extensions & Templates: Has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24265 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Rife Elementor Extensions & Templates
Fixed in
1.1.6
What to do
Update Rife Elementor Extensions & Templates to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Image Hover Effects – Elementor Addon: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24264 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Image Hover Effects – Elementor Addon” WordPress Plugin before 1.3.4 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Image Hover Effects – Elementor Addon
Fixed in
1.3.4
What to do
Update Image Hover Effects – Elementor Addon to 1.3.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor Addons – PowerPack Addons for Elementor: For WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24263 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addons – PowerPack Addons for Elementor” WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addons – PowerPack Addons for Elementor
Fixed in
2.3.2
What to do
Update Elementor Addons – PowerPack Addons for Elementor to 2.3.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021WooLentor – WooCommerce Elementor Addons + Builder: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24262 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “WooLentor – WooCommerce Elementor Addons + Builder” WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
WooLentor – WooCommerce Elementor Addons + Builder
Fixed in
1.8.6
What to do
Update WooLentor – WooCommerce Elementor Addons + Builder to 1.8.6 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021HT Mega – Absolute Addons for Elementor Page Builder: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24261 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “HT Mega – Absolute Addons for Elementor Page Builder” WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
HT Mega – Absolute Addons for Elementor Page Builder
Fixed in
1.5.7
What to do
Update HT Mega – Absolute Addons for Elementor Page Builder to 1.5.7 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Livemesh Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24260 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Livemesh Addons for Elementor” WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Livemesh Addons for Elementor
Fixed in
6.8
What to do
Update Livemesh Addons for Elementor to 6.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor Addon Elements: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24259 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor Addon Elements” WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor Addon Elements
Fixed in
1.11.2
What to do
Update Elementor Addon Elements to 1.11.2 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Premium Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24257 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Premium Addons for Elementor” WordPress Plugin before 4.2.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Premium Addons for Elementor
Fixed in
4.2.8
What to do
Update Premium Addons for Elementor to 4.2.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Elementor – Header, Footer & Blocks Template: Has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24256 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Elementor – Header, Footer & Blocks Template” WordPress Plugin before 1.5.8 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
Product
Elementor – Header, Footer & Blocks Template
Fixed in
1.5.8
What to do
Update Elementor – Header, Footer & Blocks Template to 1.5.8 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 5, 2021Essential Addons for Elementor Lite: Has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24255 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Addons for Elementor Lite WordPress Plugin before 4.5.4 has two widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, both via a similar method.
Product
Essential Addons for Elementor Lite
Fixed in
4.5.4
What to do
Update Essential Addons for Elementor Lite to 4.5.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 22, 2021Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments: Does not sanitise the invitaion_code GET parameterCVE-2021-24239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaion_code GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue.
Product
Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments
Fixed in
3.7.0.1
What to do
Update Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments to 3.7.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 22, 2021The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the requCVE-2021-24238 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.
Product
Realteo
Fixed in
1.2.4
What to do
Update Realteo to 1.2.4 or newer.
Full record and what to do →NVD record m0ze.ru m0ze.ru
Apr 12, 2021The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in pCVE-2021-24224 · WordPress plugins & themes · reported by WPScanHigh 8.8
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
Product
Easy Form Builder
Affected
up to 1.0
What to do
Affects up to 1.0. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
Apr 12, 2021run_action function of the Facebook for: Deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerabilityCVE-2021-24217 · WordPress plugins & themes · reported by WPScanHigh 8.1
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
Product
run_action function of the Facebook for
Fixed in
3.0.0
What to do
Update run_action function of the Facebook for to 3.0.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 12, 2021wpDataTables – Tables & Table Charts premium: Allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajaxCVE-2021-24200 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'length' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
Product
wpDataTables – Tables & Table Charts premium
Fixed in
3.4.2
What to do
Update wpDataTables – Tables & Table Charts premium to 3.4.2 or newer.
Full record and what to do →NVD record n4nj0.github.io wpdatatables.com
Apr 12, 2021wpDataTables – Tables & Table Charts premium: Allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajaxCVE-2021-24199 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.
Product
wpDataTables – Tables & Table Charts premium
Fixed in
3.4.2
What to do
Update wpDataTables – Tables & Table Charts premium to 3.4.2 or newer.
Full record and what to do →NVD record n4nj0.github.io wpdatatables.com
Apr 5, 2021editor of the WP Page Builder: Allows lower-privileged users to insert unfiltered HTMLCVE-2021-24208 · WordPress plugins & themes · reported by WPScanMedium 5.4
The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via the “Raw HTML” widget and the “Custom HTML” widgets (though the custom HTML widget requires sending a crafted request - it appears that this widget uses some form of client side validation but not server side validation), all of which are added via the “page_builder_data” parameter when performing the “wppb_page_save” AJAX action. It is also possible to insert malicious JavaScript via the “wppb_page_css” parameter (this can be done by closing out the style tag and opening a script tag) when performing the “wppb_page_save” AJAX action.
Product
editor of the WP Page Builder
Fixed in
1.2.4
What to do
Update editor of the WP Page Builder to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com themeum.com
Apr 5, 2021By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles musCVE-2021-24207 · WordPress plugins & themes · reported by WPScanMedium 4.3
By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages.
Fixed in
1.2.4
What to do
Update the plugin to 1.2.4 or newer.
Full record and what to do →NVD record wpscan.com themeum.com
Apr 5, 2021REST API endpoint get_users in the User Profile Picture: Returned more information than was required for its functionality to users with the upload_files capabilityCVE-2021-24170 · WordPress plugins & themes · reported by WPScanHigh 7.5
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
Product
REST API endpoint get_users in the User Profile Picture
Fixed in
2.5.0
What to do
Update REST API endpoint get_users in the User Profile Picture to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and rCVE-2021-24164 · WordPress plugins & themes · reported by WPScanMedium 4.3
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
Product
Ninja Forms Contact Form
Fixed in
3.4.34.1
What to do
Update Ninja Forms Contact Form to 3.4.34.1 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML wiCVE-2021-24156 · WordPress plugins & themes · reported by WPScanMedium 5.4
Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation
Affected
3.0.3 to 3.0.3
What to do
Affects 3.0.3 to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record mega.nz wpscan.com
Mar 18, 2021Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL atCVE-2021-24141 · WordPress plugins & themes · reported by WPScanHigh 7.2
Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks.
Fixed in
3.0.2
What to do
Update the plugin to 3.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users CVE-2021-24137 · WordPress plugins & themes · reported by WPScanHigh 8.8
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands.
Product
Blog2Social
Fixed in
6.3.1
What to do
Update Blog2Social to 6.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles.CVE-2020-36157 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a WordPress capability (or any custom Ultimate Member role) and effectively be granted those privileges.
Product
An issue was discovered in the Ultimate Member
Fixed in
2.1.12
What to do
Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD record wordpress.org wpscan.com
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.CVE-2020-36155 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user meta that defines a user's role. During the registration process, submitted registration details were passed to the update_profile function, and any metadata was accepted, e.g., wp_capabilities[administrator] for Administrator access.
Product
An issue was discovered in the Ultimate Member
Fixed in
2.1.12
What to do
Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD record wordpress.org wpscan.com
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple RCVE-2020-35935 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)
Product
Advanced Access Manager
Fixed in
6.6.2
What to do
Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/aCVE-2020-35934 · WordPress plugins & themes · reported by MITREMedium 4.3
The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).
Product
Advanced Access Manager
Fixed in
6.6.2
What to do
Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 8, 2020The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via tCVE-2020-14207 · WordPress plugins & themes · reported by MITREMedium 5.3
The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via the divelog.php filter_diver parameter.
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org hooperlabs.xyz
Nov 4, 2020Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.CVE-2020-22277 · WordPress plugins & themes · reported by MITREHigh 8
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Affected
up to 1.15.5.11
What to do
Affects up to 1.15.5.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.ikiu.ac.ir mega.nz
Oct 7, 2020The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the EdiCVE-2020-26596 · WordPress plugins & themes · reported by MITREHigh 8.8
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.
Product
Dynamic OOO widget for the Elementor Pro
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update Dynamic OOO widget for the Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record elementor.com ww2.compunet.cl
Sep 3, 2020The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege userCVE-2020-24948 · WordPress plugins & themes · reported by MITREHigh 7.2
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
Fixed in
2.7.7
What to do
Update the plugin to 2.7.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Aug 26, 2020WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user.CVE-2020-24316 · WordPress plugins & themes · reported by MITREMedium 6.1
WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org zeroaptitude.com
Aug 26, 2020Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping.CVE-2020-24315 · WordPress plugins & themes · reported by MITREHigh 7.5
Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database.
Affected
up to 36.0
What to do
Affects up to 36.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org zeroaptitude.com
Aug 24, 2020A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any tCVE-2020-24186 · WordPress plugins & themes · reported by MITRECritical 10
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
Product
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0
Affected
up to 7.0.4
What to do
Affects up to 7.0.4. Update A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 21, 2020Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature.CVE-2020-20634 · WordPress plugins & themes · reported by MITREMedium 6.5
Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog.
Affected
up to 2.9.5
What to do
Affects up to 2.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 9, 2020In TimelineJS before version 3.7.0, some user data renders as HTML.CVE-2020-15092 · WordPress plugins & themes · reported by GitHubHigh 7.2
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most TimelineJS users configure their timeline with a Google Sheets document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if they grant public write access to the document. Some TimelineJS users configure their timeline with a JSON document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker, if the access of a trusted user is compromised, or if write access to the system hosting that document is otherwise compromised. Version 3.7.0 of TimelineJS addresses this in two ways. For content which is intended to support limited HTML markup for styling and linking, that content is "sanitized" before being added to the DOM. For content intended for simple text display, all markup is stripped. Very few users
Product
code. Some users of TimelineJS use it as a part of a
What to do
Update code. Some users of TimelineJS use it as a part of a to the newest version.
Full record and what to do →NVD record github.com knightlab.northwestern.edu
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.CVE-2019-19109 · WordPress plugins & themes · reported by MITREHigh 8.8
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
Jun 12, 2020In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved.CVE-2020-4050 · WordPress plugins & themes · reported by GitHubLow 3.5
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 12, 2020In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pageCVE-2020-4047 · WordPress plugins & themes · reported by GitHubMedium 6.8
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 12, 2020In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML CVE-2020-4046 · WordPress plugins & themes · reported by GitHubMedium 5.4
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Jun 2, 2020common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_usCVE-2020-13764 · WordPress plugins & themes · reported by MITREHigh 7.5
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
Product
common.php in the Gravity Forms
Fixed in
2.4.9
What to do
Update common.php in the Gravity Forms to 2.4.9 or newer.
Full record and what to do →NVD record docs.gravityforms.com github.com
May 28, 2020An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.CVE-2020-13693 · WordPress plugins & themes · reported by MITRECritical 9.8
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
Product
An unauthenticated privilege-escalation issue exists in the bbPress
Fixed in
2.6.5
What to do
Update An unauthenticated privilege-escalation issue exists in the bbPress to 2.6.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com bbpress.org
Apr 30, 2020In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password.CVE-2020-11027 · WordPress plugins & themes · reported by GitHubMedium 6.1
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com github.com
Apr 22, 2020The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.CVE-2020-12074 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.
Product
users-customers-import-export-for-wp-woocommerce
Fixed in
1.3.9
What to do
Update users-customers-import-export-for-wp-woocommerce to 1.3.9 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 7, 2020An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pagesCVE-2020-11508 · WordPress plugins & themes · reported by MITREMedium 5.4
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pages with a malicious page containing arbitrary JavaScript via the wp_ajax_core37_lp_save_page (aka core37_lp_save_page) AJAX action.
Product
An XSS vulnerability in the WP Lead Plus X
Affected
up to 0.98
What to do
Affects up to 0.98. Update An XSS vulnerability in the WP Lead Plus X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Apr 4, 2020The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula.CVE-2020-11548 · WordPress plugins & themes · reported by MITRECritical 9.8
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
Product
Search Meter
Affected
up to 2.13.2
What to do
Affects up to 2.13.2. Update Search Meter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org exploit-db.com
Mar 16, 2020be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role viCVE-2020-7916 · WordPress plugins & themes · reported by MITREMedium 6.5
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any additional permission checks. Therefore, any user can change its role to an instructor/teacher and gain access to otherwise restricted data.
Product
LearnPress
Affected
up to 3.2.6.5
What to do
Affects up to 3.2.6.5. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.