Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
217 results · page 4 of 5
Jul 11, 2022Comment License: Does not have CSRF check in placeCVE-2022-1957 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Comment License
- Fixed in
- 1.4.0
- What to do
- Update Comment License to 1.4.0 or newer.
May 23, 2022Turn off all comments: Does not sanitise and escape the rows parameter before outputting it back in an admin pageCVE-2022-1192 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Turn off all comments
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Turn off all comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 29, 2022Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clCVE-2022-29414 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system info file, plugin system settings, plugin options settings, generate a new key, reset all options, change notifications settings, management page settings, comment form settings, manage subscriptions > mass update settings, manage subscriptions > add a new subscription, update subscription, delete Subscription.
- Affected
- up to 211130
- What to do
- Affects up to 211130. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 25, 2022Social comments by WpDevArt: Does not sanitise and escape its settingsCVE-2022-0876 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Social comments by WpDevArt
- Fixed in
- 2.5.0
- What to do
- Update Social comments by WpDevArt to 2.5.0 or newer.
Apr 25, 2022DW Question & Answer Pro: Does not check that the comment to edit belongs to the user making the requestCVE-2021-24800 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
- Product
- DW Question & Answer Pro
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update DW Question & Answer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Good & Bad Comments: Does not sanitise and escape its settingsCVE-2022-1090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Good & Bad Comments
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Good & Bad Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2022Social Share, Social Login and Social Comments: Does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it CVE-2021-24987 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.30
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.30 or newer.
Feb 28, 2022Easy Drag And drop All Import : WP Ultimate CSV Importer: Does not sanitise and escaped imported commentsCVE-2022-0360 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
- Product
- Easy Drag And drop All Import : WP Ultimate CSV Importer
- Fixed in
- 6.4.3
- What to do
- Update Easy Drag And drop All Import : WP Ultimate CSV Importer to 6.4.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022AnyComment: Is affected by a race conditionCVE-2022-0279 · WordPress plugins & themes · reported by WPScanLow 3.1
The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Feb 21, 2022AnyComment: Does not have CSRF checks in the Import and Revert HyperComments featuresCVE-2022-0134 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Jan 17, 2022AnyComment: Has an API endpointCVE-2021-24838 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature.
- Product
- AnyComment
- Fixed in
- 0.3.5
- What to do
- Update AnyComment to 0.3.5 or newer.
Dec 10, 2021Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or CVE-2021-36911 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 8, 2021Schreikasten: Does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actionsCVE-2021-24630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
- Product
- Schreikasten
- Affected
- up to 0.14.18
- What to do
- Affects up to 0.14.18. Update Schreikasten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 1, 2021Delete All Comments Easily: Is lacking Cross-Site Request Forgery (CSRF) checksCVE-2020-36505 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog.
- Product
- Delete All Comments Easily
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Delete All Comments Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021jQuery Reply to Comment: Does not have any CSRF checkCVE-2021-24543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
- Product
- jQuery Reply to Comment
- Affected
- up to 1.31
- What to do
- Affects up to 1.31. Update jQuery Reply to Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2021Comments – wpDiscuz: Does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the pageCVE-2021-24737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Comments – wpDiscuz
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Comment Link Remove and Other Comment Tools: Does not have CSRF check in its 'Delete comments easily'CVE-2021-24725 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments
- Product
- Comment Link Remove and Other Comment Tools
- Fixed in
- 2.1.6
- What to do
- Update Comment Link Remove and Other Comment Tools to 2.1.6 or newer.
Full record and what to do →NVD recordwpscan.comtrustwave.com
Sep 10, 2021Edit Comments XT: Reflected Cross-Site ScriptingCVE-2021-38336 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
- Product
- Edit Comments XT
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Edit Comments XT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2021Stop Spammers Security | Block Spam Users, Comments, Forms: Does not escape some of its settingsCVE-2021-24517 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2021.18
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2021.18 or newer.
Sep 6, 2021A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, CVE-2021-24393 · WordPress plugins & themes · reported by WPScanHigh 7.2
A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- Comment Highlighter
- Affected
- up to 0.13
- What to do
- Affects up to 0.13. Update Comment Highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Aug 23, 2021Edit Comments: Does not sanitiseCVE-2021-24551 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue
- Product
- Edit Comments
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Edit Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Jun 21, 2021Comments Like Dislike: Allows users to like/dislike posted commentsCVE-2021-24379 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side
- Product
- Comments Like Dislike
- Fixed in
- 1.1.4
- What to do
- Update Comments Like Dislike to 1.1.4 or newer.
Jun 21, 2021Jetpack Carousel module of the JetPack: Allows users to create a "carousel" type image gallery and allows users to comment on the imagesCVE-2021-24374 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Jetpack Carousel module of the JetPack WordPress plugin before 9.8 allows users to create a "carousel" type image gallery and allows users to comment on the images. A security vulnerability was found within the Jetpack Carousel module by nguyenhg_vcs that allowed the comments of non-published page/posts to be leaked.
- Product
- Jetpack Carousel module of the JetPack
- Fixed in
- 9.8
- What to do
- Update Jetpack Carousel module of the JetPack to 9.8 or newer.
May 6, 2021Imagements: Allows images to be uploaded in commentsCVE-2021-24236 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE.
- Product
- Imagements
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Imagements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 12, 2021The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.CVE-2021-24219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin before 2.3.9.4, Thrive Apprentice WordPress plugin before 2.3.9.4, Thrive Visual Editor WordPress plugin before 2.6.7.4, Thrive Dashboard WordPress plugin before 2.3.9.3, Thrive Ovation WordPress plugin before 2.4.5, Thrive Clever Widgets WordPress plugin before 1.57.1 and Rise by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0, Thrive Themes Builder WordPress theme before 2.2.4 register a REST API endpoint associated with Zapie
- Fixed in
- 1.4.13.3
- What to do
- Update the plugin to 1.4.13.3 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Mar 18, 2021Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment fielCVE-2021-24147 · WordPress plugins & themes · reported by WPScanMedium 5.4
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the mic_comment field (Notes on time) when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting payload in them, which will be triggered in the frontend when viewing the event.
- Product
- Modern Events Calendar Lite
- Fixed in
- 5.16.5
- What to do
- Update Modern Events Calendar Lite to 5.16.5 or newer.
Nov 2, 2020wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.CVE-2020-28036 · WordPress plugins & themes · reported by MITRECritical 9.8
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 13, 2020In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or pCVE-2020-25286 · WordPress plugins & themes · reported by MITREMedium 5.3
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.
- Fixed in
- 5.4.2
- What to do
- Update the plugin to 5.4.2 or newer.
Full record and what to do →NVD recordcore.trac.wordpress.orgwordpress.org
Dec 27, 2019Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116CVE-2014-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
- Product
- Video Comments Webcam Recorder
- Fixed in
- 20140116
- What to do
- Update Video Comments Webcam Recorder to 20140116 or newer.
Full record and what to do →NVD recordcodevigilant.complugins.trac.wordpress.org
Sep 11, 2019WordPress before 5.2.3 allows XSS in stored comments.CVE-2019-16218 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows XSS in stored comments.
- Fixed in
- 5.2.3
- What to do
- Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD recordlists.debian.orgseclists.org
Sep 10, 2019The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.CVE-2017-18608 · WordPress plugins & themes · reported by MITREMedium 6.1
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
- Product
- spotim-comments
- Fixed in
- 4.0.4
- What to do
- Update spotim-comments to 4.0.4 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 27, 2019The anycomment plugin before 0.0.33 for WordPress has XSS.CVE-2018-21001 · WordPress plugins & themes · reported by MITREMedium 6.1
The anycomment plugin before 0.0.33 for WordPress has XSS.
- Product
- anycomment
- Fixed in
- 0.0.33
- What to do
- Update anycomment to 0.0.33 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.CVE-2014-10382 · WordPress plugins & themes · reported by MITREMedium 4.3
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.
- Product
- feature-comments
- Fixed in
- 1.2.5
- What to do
- Update feature-comments to 1.2.5 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 21, 2019The embed-comment-images plugin before 0.6 for WordPress has XSS.CVE-2017-18561 · WordPress plugins & themes · reported by MITREMedium 6.1
The embed-comment-images plugin before 0.6 for WordPress has XSS.
- Product
- embed-comment-images
- Fixed in
- 0.6
- What to do
- Update embed-comment-images to 0.6 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jun 10, 2019The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' iCVE-2019-9881 · WordPress plugins & themes · reported by MITREMedium 5.3
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
- Affected
- 0.2.3 to 0.2.3
- What to do
- Affects 0.2.3 to 0.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 14, 2019WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration.CVE-2019-9787 · WordPress plugins & themes · reported by MITREHigh 8.8
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.
- Fixed in
- 5.1.1
- What to do
- Update the plugin to 5.1.1 or newer.
Full record and what to do →NVD recordsecurityfocus.comblog.ripstech.com
Dec 14, 2018In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.CVE-2018-20153 · WordPress plugins & themes · reported by MITREMedium 5.4
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
- Fixed in
- 4.9.9
- What to do
- Update the plugin to 4.9.9 or newer.
Full record and what to do →NVD recordsecurityfocus.comcodex.wordpress.org
Nov 4, 2018The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.CVE-2018-18919 · WordPress plugins & themes · reported by MITREMedium 4.8
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.
- Affected
- 10.0.1 to 10.0.1
- What to do
- Affects 10.0.1 to 10.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2018The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.CVE-2018-11526 · WordPress plugins & themes · reported by MITREHigh 7.8
The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication oCVE-2014-2550 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disable_comments_settings page to wp-admin/options-general.php.
- Product
- Cross-site request forgery (CSRF) vulnerability in the Disable Comments
- Fixed in
- 1.0.4
- What to do
- Update Cross-site request forgery (CSRF) vulnerability in the Disable Comments to 1.0.4 or newer.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.dxw.com
Mar 19, 2018Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the aCVE-2014-2274 · WordPress plugins & themes · reported by MITREHigh 8.8
Cross-site request forgery (CSRF) vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via a request to the subscribe-to-comments-reloaded/options/index.php page to wp-admin/admin.php.
- Product
- Subscribe To Comments Reloaded
- Fixed in
- 140219
- What to do
- Update Subscribe To Comments Reloaded to 140219 or newer.
Full record and what to do →NVD recordsecurity.dxw.comwordpress.org
Oct 6, 2016Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress pluginCVE-2016-1000112 · WordPress plugins & themes · reported by MITRECritical 9.1
Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Nov 9, 2015the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4: SQL injectionCVE-2015-2213 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.
- Product
- the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4
- Fixed in
- 4.2.4
- What to do
- Update the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 to 4.2.4 or newer.
Full record and what to do →NVD recordopenwall.comdebian.org
Dec 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authenCVE-2014-9340 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the wpCommentTwit plugin 0.5 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) username or (2) password parameter in the wpCommentTwit.php page to wp-admin/options-general.php.
- Product
- wpCommentTwit
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update wpCommentTwit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Aug 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the auCVE-2014-5347 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.
- Product
- Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System
- Fixed in
- 2.76
- What to do
- Update Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System to 2.76 or newer.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Aug 19, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authenticCVE-2014-5346 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) activate or (2) deactivate the plugin via the active parameter to wp-admin/edit-comments.php, (3) import comments via an import_comments action, or (4) export comments via an export_comments action to wp-admin/index.php.
- Product
- Disqus Comment System
- Affected
- 2.77 to 2.77
- What to do
- Affects 2.77 to 2.77. Update Disqus Comment System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseclists.orgvexatioustendencies.com
Aug 19, 2014Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrarCVE-2014-5345 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter.
- Product
- Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System
- Fixed in
- 2.76
- What to do
- Update Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System to 2.76 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attaCVE-2014-4565 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) vp, (2) vs, (3) l, (4) vu, or (5) vm parameter.
- Product
- Verification Code for Comments
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Verification Code for Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Jun 16, 2014Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authenticatiCVE-2014-4163 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the (1) buried or (2) featured status of a comment via a request to wp-admin/admin-ajax.php.
- Product
- Featured Comments
- Affected
- 1.2.1 to 1.2.1
- What to do
- Affects 1.2.1 to 1.2.1. Update Featured Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseclists.orgseclists.org
Mar 3, 2014Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2013-1409 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.
- Product
- Cross-site scripting (XSS) vulnerability in the CommentLuv
- Fixed in
- 2.92.4
- What to do
- Update Cross-site scripting (XSS) vulnerability in the CommentLuv to 2.92.4 or newer.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.