Vulnerability database

4,892 results · page 49 of 98

• Mar 18, 2022Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2).CVE-2022-25604 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2).

  Affected

  up to 0.2.2

  What to do

  Affects up to 0.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Mar 18, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).CVE-2022-25603 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).

  Affected

  6.2.5 to 6.2.5

  What to do

  Affects 6.2.5 to 6.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Mar 18, 2022Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versionsCVE-2022-25602 · WordPress plugins & themes · reported by PatchstackHigh 8.3

  Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).

  Affected

  up to 4.1.7

  What to do

  Affects up to 4.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Mar 18, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.CVE-2021-23150 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.

  Affected

  up to 1.0.77.31

  What to do

  Affects up to 1.0.77.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 14, 2022The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX actCVE-2022-0165 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users

  Product

  Page Builder KingComposer

  Affected

  up to 2.9.6

  What to do

  Affects up to 2.9.6. Update Page Builder KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 14, 2022The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leadingCVE-2021-24996 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting

  Product

  IDPay for Contact Form 7

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update IDPay for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 11, 2022Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).CVE-2022-25601 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).

  Affected

  up to 2.4

  What to do

  Affects up to 2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org

• Mar 11, 2022Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3)CVE-2022-25600 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability affecting Delete Marker Category, Delete Map, and Copy Map functions in WP Google Map plugin (versions <= 4.2.3).

  Affected

  up to 4.2.3

  What to do

  Affects up to 4.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org

• Mar 7, 2022WP Cerber Security, Anti-spam & Malware Scan: Does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboardCVE-2022-0429 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.

  Product

  WP Cerber Security, Anti-spam & Malware Scan

  Fixed in

  8.9.6

  What to do

  Update WP Cerber Security, Anti-spam & Malware Scan to 8.9.6 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 7, 2022WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro: Does not escape some of its shortcode argumentCVE-2021-24961 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks

  Product

  WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro

  Fixed in

  4.16.3

  What to do

  Update WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro to 4.16.3 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Mar 7, 2022WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro: Allows users with a roleCVE-2021-24960 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks

  Product

  WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro

  Fixed in

  4.16.3

  What to do

  Update WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro to 4.16.3 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Mar 7, 2022The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, toCVE-2021-24824 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved

  Product

  [field] shortcode included with the Custom Content Shortcode

  Fixed in

  4.0.1

  What to do

  Update [field] shortcode included with the Custom Content Shortcode to 4.0.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloaCVE-2022-23988 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission

  Fixed in

  1.8.176

  What to do

  Update the plugin to 1.8.176 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-SiCVE-2022-23987 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

  Fixed in

  1.8.176

  What to do

  Update the plugin to 1.8.176 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 28, 2022TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro: Do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpointCVE-2022-0412 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks

  Product

  TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro

  Fixed in

  1.40.1

  What to do

  Update TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro to 1.40.1 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Feb 28, 2022Asgaros Forum: Does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user)CVE-2022-0411 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection

  Product

  Asgaros Forum

  Fixed in

  2.0.0

  What to do

  Update Asgaros Forum to 2.0.0 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Feb 28, 2022Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration.CVE-2022-0377 · WordPress plugins & themes · reported by WPScanMedium 4.3

  Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.

  Product

  LearnPress

  Fixed in

  4.1.5

  What to do

  Update LearnPress to 4.1.5 or newer.

  Full record and what to do →NVD recordbozogullarindan.comgithub.com

• Feb 28, 2022The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints wCVE-2021-25118 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Yoast SEO WordPress plugin (from versions 16.7 until 17.2) discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Feb 28, 2022Maps Plugin using Google Maps for: Does not have CSRF checks in most of its AJAX actionsCVE-2021-25081 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin's settings via a CSRF attack

  Product

  Maps Plugin using Google Maps for

  Fixed in

  1.8.4

  What to do

  Update Maps Plugin using Google Maps for to 1.8.4 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Feb 28, 2022Maps Plugin using Google Maps for: Does not have proper authorisation and CSRF in most of its AJAX actionsCVE-2021-25011 · WordPress plugins & themes · reported by WPScanMedium 5.7

  The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings.

  Product

  Maps Plugin using Google Maps for

  Fixed in

  1.8.1

  What to do

  Update Maps Plugin using Google Maps for to 1.8.1 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Feb 28, 2022In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unCVE-2021-24704 · WordPress plugins & themes · reported by WPScanHigh 8.8

  In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example

  Product

  Orange Form

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 28, 2022The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server CVE-2021-24689 · WordPress plugins & themes · reported by WPScanMedium 4.9

  The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack

  Product

  Contact Forms - Drag & Drop Contact Form Builder

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update Contact Forms - Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 24, 2022Header Footer Code Manager plugin <= 1.1.16: Reflected Cross-Site Scripting (XSS)CVE-2022-0710 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter.

  Product

  Header Footer Code Manager plugin <= 1.1.16

  Affected

  up to 1.1.16

  What to do

  Affects up to 1.1.16. Update Header Footer Code Manager plugin <= 1.1.16 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordfence.comwordfence.com

• Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).CVE-2022-25599 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress plugin (versions <= 4.9.0).

  Affected

  up to 4.9.0

  What to do

  Affects up to 4.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Feb 21, 2022Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).CVE-2022-23984 · WordPress plugins & themes · reported by PatchstackLow 3.7

  Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).

  Affected

  up to 7.3.11

  What to do

  Affects up to 7.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Feb 21, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (veCVE-2022-23983 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).

  Affected

  up to 3.4.4

  What to do

  Affects up to 3.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Feb 21, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).CVE-2021-26256 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Feb 21, 2022Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro: Do not sanitise and escape the html_element_selection parameter before outputting it back in the pageCVE-2022-0288 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

  Product

  Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro

  Fixed in

  2.7.10

  What to do

  Update Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro to 2.7.10 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.

  Product

  Translation Exchange

  Affected

  up to 1.0.14

  What to do

  Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 21, 2022The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.CVE-2021-25055 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter.

  Product

  FeedWordPress

  Fixed in

  2022.0123

  What to do

  Update FeedWordPress to 2022.0123 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Feb 21, 2022Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised.CVE-2021-24867 · WordPress plugins & themes · reported by WPScanCritical 9.8

  Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordjetpack.comwpscan.com

• Feb 18, 2022The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.CVE-2022-23982 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Feb 18, 2022The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).CVE-2022-23981 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Feb 17, 2022The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nCVE-2022-0633 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.

  Fixed in

  1.22.3

  What to do

  Update the plugin to 1.22.3 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comjetpack.com

• Feb 14, 2022Permalink Manager Lite: And Permalink Manager Pro WordPress plugin before 2CVE-2022-0201 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue

  Product

  Permalink Manager Lite

  Fixed in

  2.2.15

  What to do

  Update Permalink Manager Lite to 2.2.15 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Feb 14, 2022Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themiCVE-2022-0200 · WordPress plugins & themes · reported by WPScanMedium 5.4

  Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting

  Fixed in

  1.1.7

  What to do

  Update the plugin to 1.1.7 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 7, 2022Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages: Does not check for authorisation and has a flawed CSRF logicCVE-2021-25106 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting

  Product

  Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages

  Fixed in

  2.7.1

  What to do

  Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages to 2.7.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 7, 2022The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URLCVE-2021-25096 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL

  Product

  IP2Location Country Blocker

  Fixed in

  2.26.5

  What to do

  Update IP2Location Country Blocker to 2.26.5 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Feb 7, 2022Advanced Cron Manager: And Advanced Cron Manager Pro WordPress plugin before 2CVE-2021-25084 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example

  Product

  Advanced Cron Manager

  Fixed in

  2.4.2

  What to do

  Update Advanced Cron Manager to 2.4.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 4, 2022Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'.CVE-2022-23980 · WordPress plugins & themes · reported by PatchstackMedium 4.7

  Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'.

  Affected

  up to 2.9.9

  What to do

  Affects up to 2.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Feb 4, 2022Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid).CVE-2021-44779 · WordPress plugins & themes · reported by PatchstackHigh 7.3

  Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched version available, plugin closed.

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Feb 1, 2022The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, respondsCVE-2022-0220 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)

  Product

  WordPress GDPR

  Fixed in

  1.9.27

  What to do

  Update WordPress GDPR to 1.9.27 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 1, 2022Asset CleanUp: Page Speed Booster: Does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users)CVE-2021-24983 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issue

  Product

  Asset CleanUp: Page Speed Booster

  Fixed in

  1.3.8.5

  What to do

  Update Asset CleanUp: Page Speed Booster to 1.3.8.5 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 1, 2022The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, respondsCVE-2021-24814 · WordPress plugins & themes · reported by WPScanCritical 9.6

  The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction).

  Product

  WordPress GDPR

  Fixed in

  1.9.26

  What to do

  Update WordPress GDPR to 1.9.26 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 28, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).CVE-2022-23979 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).

  Affected

  up to 3.0.15

  What to do

  Affects up to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jan 28, 2022Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6).CVE-2021-31567 · WordPress plugins & themes · reported by PatchstackMedium 6.8

  Authenticated (admin+) Arbitrary File Download vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6). The plugin allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the &downloadable_file_urls[0] parameter data. It's also possible to escape from the web server home directory and download any file within the OS.

  Affected

  up to 4.4.6

  What to do

  Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.compatchstack.com

• Jan 28, 2022Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameCVE-2021-23174 · WordPress plugins & themes · reported by PatchstackLow 3.4

  Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].

  Affected

  up to 4.4.6

  What to do

  Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jan 25, 2022The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create, edit,CVE-2021-45729 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  The Privilege Escalation vulnerability discovered in the WP Google Map WordPress plugin (versions <= 1.8.0) allows authenticated low-role users to create, edit, and delete maps.

  Product

  WP Google Map

  Affected

  up to 1.8.0

  What to do

  Affects up to 1.8.0. Update WP Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jan 24, 2022Accept Donations with PayPal: Does not have CSRF check in place and does not ensure that the post to be deleted belongs to the pluginCVE-2021-24989 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog

  Product

  Accept Donations with PayPal

  Fixed in

  1.3.4

  What to do

  Update Accept Donations with PayPal to 1.3.4 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 24, 2022Cookie Notification Plugin for: Does not sanitise or escape the id GET parameter before using it in a SQL statementCVE-2021-24858 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL statement, when retrieving the setting to edit in the admin dashboard, leading to an authenticated SQL Injection

  Product

  Cookie Notification Plugin for

  Fixed in

  1.0.9

  What to do

  Update Cookie Notification Plugin for to 1.0.9 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.