Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

223 results · page 5 of 5

Feb 1, 2022Perfect Survey: Does not have proper authorisation nor CSRF checks in the save_global_setting AJAX actionCVE-2021-24763 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey
Product
Perfect Survey
Fixed in
1.5.2
What to do
Update Perfect Survey to 1.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Perfect Survey: Does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX actionCVE-2021-24762 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
Product
Perfect Survey
Fixed in
1.5.2
What to do
Update Perfect Survey to 1.5.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Stored cross-site scriptingCVE-2022-0182 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Reflected cross-site scriptingCVE-2022-0181 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Cross-site request forgery (CSRF)CVE-2022-0180 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Dec 6, 2021Contact Form, Survey & Popup Form Plugin for: Does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-24718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Contact Form, Survey & Popup Form Plugin for
Fixed in
1.5
What to do
Update Contact Form, Survey & Popup Form Plugin for to 1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021WP Survey Plus: Does not have any authorisation and CSRF checks in place in its AJAX actionsCVE-2021-24801 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues
Product
WP Survey Plus
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Survey Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for: Does not sanitise and escape its Form's LabelsCVE-2021-24608 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for
Fixed in
5.0.07
What to do
Update Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for to 5.0.07 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 11, 2021Quiz And Survey Master: Does not escape the Quiz Url Slug setting before outputting it in some pagesCVE-2021-24691 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Quiz And Survey Master
Fixed in
7.3.2
What to do
Update Quiz And Survey Master to 7.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 18, 2021Quiz And Survey Master versions prior to 7.1.14: Cross-site scriptingCVE-2021-20792 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.
Product
Quiz And Survey Master versions prior to 7.1.14
Fixed in
7.1.14
What to do
Update Quiz And Survey Master versions prior to 7.1.14 to 7.1.14 or newer.
Full record and what to do →NVD record jvn.jp plugins.trac.wordpress.org
Aug 2, 2021get_results() and get_items() functions in the Survey Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24459 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
Product
get_results() and get_items() functions in the Survey Maker
Fixed in
1.5.6
What to do
Update get_results() and get_items() functions in the Survey Maker to 1.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2021Poll, Survey, Questionnaire and Voting system: Did not sanitiseCVE-2021-24442 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks
Product
Poll, Survey, Questionnaire and Voting system
Fixed in
1.5.3
What to do
Update Poll, Survey, Questionnaire and Voting system to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com in-spired.xyz
Jun 20, 2021Quiz And Survey Master – Best Quiz, Exam and Survey: Did not sanitise or escape its result_id parameterCVE-2021-24368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This could allow for privilege escalation by inducing a logged in admin to open a malicious link
Product
Quiz And Survey Master – Best Quiz, Exam and Survey
Fixed in
7.1.18
What to do
Update Quiz And Survey Master – Best Quiz, Exam and Survey to 7.1.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2021Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for: Did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attributeCVE-2021-24221 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.
Product
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for
Fixed in
7.1.12
What to do
Update Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for to 7.1.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 31, 2020An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.CVE-2020-35951 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).
Product
An issue was discovered in the Quiz and Survey Master
Fixed in
7.0.1
What to do
Update An issue was discovered in the Quiz and Survey Master to 7.0.1 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Dec 31, 2020An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress.CVE-2020-35949 · WordPress plugins & themes · reported by MITRECritical 10
An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the upload, and thus the attacker could use text/plain for a .php file.
Product
An issue was discovered in the Quiz and Survey Master
Fixed in
7.0.1
What to do
Update An issue was discovered in the Quiz and Survey Master to 7.0.1 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Dec 13, 2019The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS).CVE-2019-17599 · WordPress plugins & themes · reported by MITREMedium 6.1
The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.
Product
quiz-master-next (aka Quiz And Survey Master)
Fixed in
6.3.5
What to do
Update quiz-master-next (aka Quiz And Survey Master) to 6.3.5 or newer.
Full record and what to do →NVD record github.com github.com
Mar 5, 2019The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.CVE-2019-9575 · WordPress plugins & themes · reported by MITREMedium 6.1
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.
Affected
6.0.4 to 6.0.4
What to do
Affects 6.0.4 to 6.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com lists.openwall.net
Sep 14, 2017Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.CVE-2017-1002022 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.
Affected
1.01.8 to 1.01.8
What to do
Affects 1.01.8 to 1.01.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an CVE-2017-1002021 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query.
Affected
1.01.8 to 1.01.8
What to do
Affects 1.01.8 to 1.01.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Sep 14, 2017Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.CVE-2017-1002020 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.
Affected
1.01.8 to 1.01.8
What to do
Affects 1.01.8 to 1.01.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com wordpress.org
Feb 26, 2015SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to eCVE-2015-2090 · WordPress plugins & themes · reported by MITREHigh 7.5
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.
Product
WordPress Survey and Poll
Affected
1.1.7 to 1.1.7
What to do
Affects 1.1.7 to 1.1.7. Update WordPress Survey and Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record osvdb.org packetstormsecurity.com
Dec 30, 2010Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to CVE-2010-4630 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Product
WP Survey And Quiz Tool
What to do
Update WP Survey And Quiz Tool to the newest version.
Full record and what to do →NVD record osvdb.org packetstormsecurity.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.