Updated 27 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

2,492 results · page 48 of 50

Apr 18, 2022Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).CVE-2022-23976 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 11, 2022Podcast Importer SecondLine: Does not sanitise and properly escape some imported dataCVE-2022-1023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
Product
Podcast Importer SecondLine
Fixed in
1.3.8
What to do
Update Podcast Importer SecondLine to 1.3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022wpDataTables: Authenticated (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-25618 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27
Product
wpDataTables
Affected
up to 2.1.27
What to do
Affects up to 2.1.27. Update wpDataTables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 28, 2022Database Peek: Does not sanitize and escape the match parameter before outputting it back in an admin pageCVE-2022-0619 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Database Peek
Affected
up to 1.2
What to do
Affects up to 1.2. Update Database Peek to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Product
BookingPress
Fixed in
1.0.11
What to do
Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022Simple Quotation: Does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user dataCVE-2022-22735 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks
Product
Simple Quotation
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Simple Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022CommonsBooking: Does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queriesCVE-2022-0658 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
Product
CommonsBooking
Fixed in
2.6.8
What to do
Update CommonsBooking to 2.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Product
Photo Gallery by 10Web
Fixed in
1.6.0
What to do
Update Photo Gallery by 10Web to 1.6.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Cookie Information | Free GDPR Consent Solution
Fixed in
2.0.8
What to do
Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022WP Email Users: Does not escape the data_raw parameter in the weu_selected_users_1 AJAX actionCVE-2021-24959 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.
Product
WP Email Users
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update WP Email Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022Custom Content Shortcode: Does not validate the data passed to its load shortcodeCVE-2021-24825 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to display arbitrary files from the filesystem (such as logs, .htaccess etc), as well as perform Local File Inclusion attacks as PHP files will be executed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when either the unfiltered_html or file_edit is disallowed)
Product
Custom Content Shortcode
Fixed in
4.0.2
What to do
Update Custom Content Shortcode to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloaCVE-2022-23988 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
Fixed in
1.8.176
What to do
Update the plugin to 1.8.176 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF check in the lswss_save_attachment_data AJAX actionCVE-2021-24913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.
Product
Logo Showcase with Slick Slider
Fixed in
2.0.1
What to do
Update Logo Showcase with Slick Slider to 2.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Security Audit: Does not sanitise and escape the Data Id settingCVE-2021-24901 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Security Audit
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Security Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022Logo Showcase with Slick Slider: Does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX actionCVE-2021-24730 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Logo Showcase with Slick Slider WordPress plugin before 1.2.5 does not have CSRF and authorisation checks in the lswss_save_attachment_data AJAX action, allowing any authenticated users, such as Subscriber, to change title, description, alt text, and URL of arbitrary uploaded media.
Product
Logo Showcase with Slick Slider
Fixed in
1.2.5
What to do
Update Logo Showcase with Slick Slider to 1.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
Product
Database Backup for
Fixed in
2.5.1
What to do
Update Database Backup for to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the POST data before outputting it back in attributes of an admin pageCVE-2021-25101 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
Product
Anti-Malware Security and Brute-Force Firewall
Fixed in
4.20.94
What to do
Update Anti-Malware Security and Brute-Force Firewall to 4.20.94 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Advanced Database Cleaner: Does not sanitise and escape $_GET keys and values before outputting them back in attributesCVE-2021-24921 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Advanced Database Cleaner
Fixed in
3.0.4
What to do
Update Advanced Database Cleaner to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Custom Popup Builder: Autoload data from its popup on every pagesCVE-2022-0214 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
Product
Custom Popup Builder
Fixed in
1.3.1
What to do
Update Custom Popup Builder to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Futurio Extra: Is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the databaseCVE-2021-25109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
Product
Futurio Extra
Fixed in
1.6.3
What to do
Update Futurio Extra to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Essential Addons for Elementor: Does not validate and sanitise some template data before it them in include statementsCVE-2022-0320 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.
Product
Essential Addons for Elementor
Fixed in
5.0.5
What to do
Update Essential Addons for Elementor to 5.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 18, 2022The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability chCVE-2022-0236 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
Affected
up to 3.9.15
What to do
Affects up to 3.9.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21664 · WordPress plugins & themes · reported by GitHubHigh 7.4
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21663 · WordPress plugins & themes · reported by GitHubMedium 6.6
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.sonarsource.com github.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21662 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21661 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record packetstormsecurity.com github.com
Dec 27, 2021WP RSS Aggregator: Does not sanitise and escape data before outputting it in the System Info admin dashboardCVE-2021-24988 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.
Product
WP RSS Aggregator
Fixed in
4.19.3
What to do
Update WP RSS Aggregator to 4.19.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021WordPress Download Manager: Does not sanitise and escape Template data before outputting it in various pages (suchCVE-2021-24969 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
Product
WordPress Download Manager
Fixed in
3.2.22
What to do
Update WordPress Download Manager to 3.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 22, 2021Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).CVE-2021-36886 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).
Affected
up to 1.2.5.9
What to do
Affects up to 1.2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 22, 2021Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).CVE-2021-36885 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
Affected
up to 1.2.6.1
What to do
Affects up to 1.2.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021Display Post Metadata: Adds a shortcode to print out custom fieldsCVE-2021-24855 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Product
Display Post Metadata
Fixed in
1.5.0
What to do
Update Display Post Metadata to 1.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021Contact Form Advanced Database: Does not have any authorisationCVE-2021-24790 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.
Product
Contact Form Advanced Database
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Contact Form Advanced Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021SEO Booster: Allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX requestCVE-2021-24747 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections.
Product
SEO Booster
Fixed in
3.8
What to do
Update SEO Booster to 3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2021browsing database which may allow a user to browse unauthorized data: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20865 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
Product
browsing database which may allow a user to browse unauthorized data
What to do
Update browsing database which may allow a user to browse unauthorized data to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 7, 2021The debug-meta-data plugin 1.1.2 for WordPress allows XSS.CVE-2020-27356 · WordPress plugins & themes · reported by MITREMedium 5.4
The debug-meta-data plugin 1.1.2 for WordPress allows XSS.
Affected
1.1.2 to 1.1.2
What to do
Affects 1.1.2 to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Dec 6, 2021WOOCS: Does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the responseCVE-2021-24938 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue
Product
WOOCS
Fixed in
1.3.7.1
What to do
Update WOOCS to 1.3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021WP Data Access: Does not properly sanitise and escape the backup_date parameter before using it a SQL statementCVE-2021-24866 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before using it a SQL statement, leading to a SQL injection issue and could allow arbitrary table deletion
Product
WP Data Access
Fixed in
5.0.0
What to do
Update WP Data Access to 5.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 18, 2021WordPress WP Reset PRO Premium: Authenticated Database ResetCVE-2021-36909 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.
Product
WordPress WP Reset PRO Premium
Affected
up to 5.98
What to do
Affects up to 5.98. Update WordPress WP Reset PRO Premium to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpCVE-2021-24731 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
Product
Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
Fixed in
3.7.1.6
What to do
Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.7.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Loco Translate: Mishandles data inputsCVE-2021-24721 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.
Product
Loco Translate
Fixed in
2.5.4
What to do
Update Loco Translate to 2.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021Export any WordPress data to XML/CSV: Does not escape its Export's Name before outputting it in Manage Exports settingsCVE-2021-24708 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Export any WordPress data to XML/CSV
Fixed in
1.3.1
What to do
Update Export any WordPress data to XML/CSV to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021MP3 Audio Player for Music, Radio & Podcast by Sonaar: Does not properly sanitize or escape data in some of its Playlist settingsCVE-2021-24624 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
Product
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Fixed in
2.4.2
What to do
Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 19, 2021WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.CVE-2021-36832 · WordPress plugins & themes · reported by PatchstackMedium 4.8
WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input.
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 13, 2021WordPress Advanced Ticket System, Elite Support Helpdesk: Does not sanitize or escape form values before saving to the database orCVE-2021-24623 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WordPress Advanced Ticket System, Elite Support Helpdesk
Fixed in
1.0.64
What to do
Update WordPress Advanced Ticket System, Elite Support Helpdesk to 1.0.64 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 10, 2021Custom Website Data: Reflected Cross-Site ScriptingCVE-2021-38347 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.
Product
Custom Website Data
Affected
up to 2.2
What to do
Affects up to 2.2. Update Custom Website Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39203 · WordPress plugins & themes · reported by GitHubMedium 6.8
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com hackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39202 · WordPress plugins & themes · reported by GitHubHigh 7.6
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com hackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39201 · WordPress plugins & themes · reported by GitHubHigh 7.6
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com hackerone.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.