Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,857 results · page 51 of 58

Aug 15, 2022SearchWP Live Ajax Search: Does not ensure that users making a live search are limited to published posts onlyCVE-2022-2535 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink
Product
SearchWP Live Ajax Search
Fixed in
1.6.2
What to do
Update SearchWP Live Ajax Search to 1.6.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 15, 2022Duplicate Page and Post: Does not sanitise and escape its settingsCVE-2022-2152 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Duplicate Page and Post
Fixed in
2.8
What to do
Update Duplicate Page and Post to 2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022Professional Social Sharing Buttons, Icons & Related Posts: Does not have proper authorisation check in one of the AJAX actionCVE-2022-0594 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
Product
Professional Social Sharing Buttons, Icons & Related Posts
Fixed in
9.7.6
What to do
Update Professional Social Sharing Buttons, Icons & Related Posts to 9.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Simple Post Notes: Does not sanitise and escape its settingsCVE-2022-2186 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Simple Post Notes
Fixed in
1.7.6
What to do
Update Simple Post Notes to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Import Export All WordPress Images, Users & Post Types: Does not fully validate the file to be imported via an URL before making an HTTP request to itCVE-2022-1977 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
Product
Import Export All WordPress Images, Users & Post Types
Fixed in
6.5.3
What to do
Update Import Export All WordPress Images, Users & Post Types to 6.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Add Post URL: Does not have CSRF check in placeCVE-2022-1913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
Product
Add Post URL
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update Add Post URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Rotating Posts: Does not have CSRF check in placeCVE-2022-1847 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Rotating Posts
Affected
up to 1.11
What to do
Affects up to 1.11. Update Rotating Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022WP Post Styling: Does not have CSRF checks in various actionsCVE-2022-1845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks
Product
WP Post Styling
Fixed in
1.3.1
What to do
Update WP Post Styling to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 24, 2022In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WorCVE-2013-1916 · WordPress plugins & themes · reported by Red HatHigh 8.8
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.
Affected
0.9.4 to 0.9.4
What to do
Affects 0.9.4 to 0.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 20, 2022Very Simple Contact Form: Exposes the solution to the captcha in the rendered contact formCVE-2022-1801 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots.
Product
Very Simple Contact Form
Fixed in
11.6
What to do
Update Very Simple Contact Form to 11.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022Post Grid, Slider & Carousel Ultimate: Does not sanitise and escape the Header TitleCVE-2022-1266 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Post Grid, Slider & Carousel Ultimate
Fixed in
1.5.0
What to do
Update Post Grid, Slider & Carousel Ultimate to 1.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Mitsol Social Post Feed: Does not escape some of its settings before outputting them back in attributesCVE-2022-0209 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Mitsol Social Post Feed
Fixed in
1.11
What to do
Update Mitsol Social Post Feed to 1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Export any WordPress data to XML/CSV: Does not sanitize the cpt POST parameterCVE-2022-1800 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.
Product
Export any WordPress data to XML/CSV
Fixed in
1.3.5
What to do
Update Export any WordPress data to XML/CSV to 1.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022postTabs: Does not have CSRF check in placeCVE-2022-1781 · WordPress plugins & themes · reported by WPScanMedium 5.4
The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
Product
postTabs
Affected
up to 2.10.6
What to do
Affects up to 2.10.6. Update postTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Auto Delete Posts: Does not have CSRF check in placeCVE-2022-1779 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.
Product
Auto Delete Posts
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Auto Delete Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Useful Banner Manager: Does not perform CSRF checks on POST requests to its admin pageCVE-2022-1694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.
Product
Useful Banner Manager
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update Useful Banner Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022KiviCare: Does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details routeCVE-2022-0786 · WordPress plugins & themes · reported by WPScanCritical 9.8
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
Product
KiviCare
Fixed in
2.3.9
What to do
Update KiviCare to 2.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022No Future Posts: Does not escape its settingsCVE-2022-1387 · WordPress plugins & themes · reported by WPScanMedium 4.8
The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
Product
No Future Posts
Affected
up to 1.4
What to do
Affects up to 1.4. Update No Future Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
Product
JivoChat Live Chat
Fixed in
1.3.5.4
What to do
Update JivoChat Live Chat to 1.3.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022WP Contacts Manager: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1014 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.
Product
WP Contacts Manager
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update WP Contacts Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022BMI BMR Calculator: Does not sanitise and escape arbitrary POST data before outputting it back in the responseCVE-2022-1267 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Product
BMI BMR Calculator
Affected
up to 1.3
What to do
Affects up to 1.3. Update BMI BMR Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Gmedia Photo Gallery: Does not sanitise and escape the Album's name before outputting it in pages/posts with a media embedCVE-2022-0873 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed
Product
Gmedia Photo Gallery
Fixed in
1.20.0
What to do
Update Gmedia Photo Gallery to 1.20.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statemenCVE-2022-0867 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users
Product
Pricing Table
Fixed in
3.6.1
What to do
Update Pricing Table to 3.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022Vertical scroll recent post: Does not sanitise and escape a parameter before outputting it back in an attributeCVE-2022-1171 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Vertical scroll recent post
Fixed in
14.0
What to do
Update Vertical scroll recent post to 14.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022Themify Post Type Builder Search Addon: Does not properly escape the current page URL before reusing it in a HTML attributeCVE-2022-1047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability.
Product
Themify Post Type Builder Search Addon
Fixed in
1.4.0
What to do
Update Themify Post Type Builder Search Addon to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022Personal Dictionary: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1013 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability.
Product
Personal Dictionary
Fixed in
1.3.4
What to do
Update Personal Dictionary to 1.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Photo Gallery: Does not properly escape the $_POST['filter_tag'] parameterCVE-2022-1281 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
Product
Photo Gallery
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2022-27854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher role via &wpt_test_page_submit_button_caption parameter.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2021-36867 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher user rights.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocializer plugin <= 0.98.22 at WordPress possible for users with a low role like a subscriber or higher.CVE-2022-29419 · WordPress plugins & themes · reported by PatchstackMedium 6
SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocializer plugin <= 0.98.22 at WordPress possible for users with a low role like a subscriber or higher.
Affected
up to 0.98.22
What to do
Affects up to 0.98.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022Master Elements: Does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2022-0693 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection
Product
Master Elements
Affected
up to 8.0
What to do
Affects up to 8.0. Update Master Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 19, 2022Sensitive Information Exposure in E4J s.r.l.CVE-2022-27863 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Exposure in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to get the booking data by guessing / brute-forcing easy predictable booking IDs via search POST requests.
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 19, 2022The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API routeCVE-2022-1186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2022sanitisation step of the Safe SVG: Can be bypassed by spoofing the content-type in the POST request to upload a fileCVE-2022-1091 · WordPress plugins & themes · reported by WPScanMedium 6.1
The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).
Product
sanitisation step of the Safe SVG
Fixed in
1.9.10
What to do
Update sanitisation step of the Safe SVG to 1.9.10 or newer.
Full record and what to do →NVD record github.com wpscan.com
Apr 18, 2022Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).CVE-2022-23976 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 18, 2022A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts.CVE-2011-1762 · WordPress plugins & themes · reported by Red HatMedium 6.5
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 11, 2022Post Grid: Does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX actionCVE-2022-0447 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting
Product
Post Grid
Fixed in
2.1.16
What to do
Update Post Grid to 2.1.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Post Grid: Does not escape the keyword parameter before outputting it back in an attributeCVE-2021-24986 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form
Product
Post Grid
Fixed in
2.1.16
What to do
Update Post Grid to 2.1.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022Mark Posts: Does not escape new markersCVE-2022-0958 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Mark Posts
Fixed in
2.0.1
What to do
Update Mark Posts to 2.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022KingComposer: Does not have authorisationCVE-2021-25048 · WordPress plugins & themes · reported by WPScanMedium 5.4
The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them
Product
KingComposer
Affected
up to 2.9.6
What to do
Affects up to 2.9.6. Update KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Bulk Creator: Does not sanitize and escape the post_type parameter before outputting it back in an admin pageCVE-2022-0647 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Bulk Creator
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Bulk Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Sync WooCommerce Product feed to Google Shopping: Uses the 'feed_id' POST parameterCVE-2021-25068 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard
Product
Sync WooCommerce Product feed to Google Shopping
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update Sync WooCommerce Product feed to Google Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022OSMapper: Contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefixCVE-2021-24978 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete is a map one. As a result, unauthenticated user can delete arbitrary posts from the blog
Product
OSMapper
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update OSMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Social Sharing: Does not escape the viewed post URL before outputting it back in onclick attributesCVE-2021-24746 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
Product
Social Sharing
Fixed in
3.3.40
What to do
Update Social Sharing to 3.3.40 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2022Simple Link Directory: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0760 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Product
Simple Link Directory
Fixed in
7.7.2
What to do
Update Simple Link Directory to 7.7.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022Infographic Maker: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0747 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Product
Infographic Maker
Fixed in
4.3.8
What to do
Update Infographic Maker to 4.3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Product
BookingPress
Fixed in
1.0.11
What to do
Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022Pricing Table Builder: Does not sanitize and escape the postid parameter before outputting it back in an admin pageCVE-2022-0640 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Pricing Table Builder
Fixed in
1.1.5
What to do
Update Pricing Table Builder to 1.1.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022Team Circle Image Slider With Lightbox: Does not sanitize and escape the order_pos parameter before outputting it back in an admin pageCVE-2022-0648 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Team Circle Image Slider With Lightbox
Fixed in
1.0.16
What to do
Update Team Circle Image Slider With Lightbox to 1.0.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Countdown, Coming Soon, Maintenance: Does not sanitize and escape the post parameter before outputting it back in an admin pageCVE-2022-0601 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Countdown, Coming Soon, Maintenance
Fixed in
2.2.9
What to do
Update Countdown, Coming Soon, Maintenance to 2.2.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.