Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

2,857 results · page 53 of 58

Oct 15, 2021MyBB Cross-Poster: Stored Cross-Site ScriptingCVE-2021-39338 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
MyBB Cross-Poster
Affected
up to 1.0
What to do
Affects up to 1.0. Update MyBB Cross-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 11, 2021Duplicate Page: Does not sanitise or escape the Duplicate Post Suffix settings before outputting itCVE-2021-24681 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Duplicate Page
Affected
up to 4.4.2
What to do
Affects up to 4.4.2. Update Duplicate Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Simple Social Media Share Buttons: Does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used)CVE-2021-24656 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Simple Social Media Share Buttons
Fixed in
3.2.4
What to do
Update Simple Social Media Share Buttons to 3.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to CVE-2021-24661 · WordPress plugins & themes · reported by WPScanMedium 4.3
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with Contributor roles or higher to read password-protected or private post contents the user is otherwise unable to read, given the post ID.
Product
PostX – Gutenberg Blocks for Post Grid
Fixed in
2.4.10
What to do
Update PostX – Gutenberg Blocks for Post Grid to 2.4.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor toCVE-2021-24660 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's shortcode.
Product
PostX – Gutenberg Blocks for Post Grid
Fixed in
2.4.10
What to do
Update PostX – Gutenberg Blocks for Post Grid to 2.4.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021PostX – Gutenberg Blocks for Post Grid: Allows users with a roleCVE-2021-24659 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block.
Product
PostX – Gutenberg Blocks for Post Grid
Fixed in
2.4.10
What to do
Update PostX – Gutenberg Blocks for Post Grid to 2.4.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021PostX – Gutenberg Blocks for Post Grid: Performs incorrect checks before allowing any logged in user to perform some ajax based requestsCVE-2021-24652 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values.
Product
PostX – Gutenberg Blocks for Post Grid
Fixed in
2.4.10
What to do
Update PostX – Gutenberg Blocks for Post Grid to 2.4.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2021WordPress Popular Posts: Authenticated Persistent Cross-Site Scripting (XSS)CVE-2021-36872 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type].
Product
WordPress Popular Posts
Affected
up to 5.3.3
What to do
Affects up to 5.3.3. Update WordPress Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com patchstack.com
Sep 20, 2021Support Board: Does not escape multiple POST parameters (suchCVE-2021-24741 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
Product
Support Board
Fixed in
3.3.4
What to do
Update Support Board to 3.3.4 or newer.
Full record and what to do →NVD record board.support medium.com
Sep 20, 2021Post Views Counter: Does not sanitise or escape its Post Views Label settingsCVE-2021-24613 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Views Counter WordPress plugin before 1.3.5 does not sanitise or escape its Post Views Label settings, which could allow high privilege users to perform Cross-Site Scripting attacks in the frontend even when the unfiltered_html capability is disallowed
Product
Post Views Counter
Fixed in
1.3.5
What to do
Update Post Views Counter to 1.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Availability Calendar: Does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embedCVE-2021-24604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Availability Calendar
Fixed in
1.2.2
What to do
Update Availability Calendar to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021fetch_product_ajax functionality in the Product Feed on WooCommerce: Uses a `product_id` POST parameterCVE-2021-24511 · WordPress plugins & themes · reported by WPScanHigh 7.2
The fetch_product_ajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a `product_id` POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
fetch_product_ajax functionality in the Product Feed on WooCommerce
Fixed in
3.3.1.0
What to do
Update fetch_product_ajax functionality in the Product Feed on WooCommerce to 3.3.1.0 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 20, 2021options.php file of the WP-Board: Beta accepts a postid parameterCVE-2021-24404 · WordPress plugins & themes · reported by WPScanHigh 8.8
The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query ran twice.
Product
options.php file of the WP-Board
Affected
up to 1.1
What to do
Affects up to 1.1. Update options.php file of the WP-Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 13, 2021create_post_page AJAX action of the Custom Post View Generator: (available to authenticated user) does not sanitise or escape user input before outputting it back in the responseCVE-2021-24605 · WordPress plugins & themes · reported by WPScanMedium 5.4
The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue
Product
create_post_page AJAX action of the Custom Post View Generator
Affected
up to 0.4.6
What to do
Affects up to 0.4.6. Update create_post_page AJAX action of the Custom Post View Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021Smash Balloon Social Post Feed: Does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of iCVE-2021-24508 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
Product
Smash Balloon Social Post Feed
Fixed in
2.19.2
What to do
Update Smash Balloon Social Post Feed to 2.19.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 10, 2021Post Title Counter: Reflected Cross-Site ScriptingCVE-2021-38326 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-counter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.
Product
Post Title Counter
Affected
up to 1.1
What to do
Affects up to 1.1. Update Post Title Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSorCVE-2021-38343 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions.
Product
Nested Pages
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which alCVE-2021-38342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changing their status, reassigning their ownership, and editing other metadata.
Product
Nested Pages
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 23, 2021pspin_duplicate_post_save_as_new_post function of the Project Status: Does not sanitiseCVE-2021-24558 · WordPress plugins & themes · reported by WPScanMedium 5.4
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue
Product
pspin_duplicate_post_save_as_new_post function of the Project Status
Affected
up to 1.6
What to do
Affects up to 1.6. Update pspin_duplicate_post_save_as_new_post function of the Project Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, thereCVE-2021-24557 · WordPress plugins & themes · reported by WPScanHigh 7.2
The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 23, 2021The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement witCVE-2021-24555 · WordPress plugins & themes · reported by WPScanHigh 8.8
The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and capability check, making it available to any authenticated user.
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 16, 2021Custom Post Type Relations: Reflected Cross-Site ScriptingCVE-2021-34654 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptr[name] parameter found in the ~/pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
Custom Post Type Relations
Affected
up to 1.0
What to do
Affects up to 1.0. Update Custom Post Type Relations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 16, 2021Video Posts Webcam Recorder: Has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videosCVE-2021-24512 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
Product
Video Posts Webcam Recorder
Fixed in
3.2.4
What to do
Update Video Posts Webcam Recorder to 3.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 9, 2021Page View Count: Does not escape the postid parameter of pvc_stats shortcodeCVE-2021-24509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
Product
Page View Count
Fixed in
2.4.9
What to do
Update Page View Count to 2.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 9, 2021Astra Pro Addon: Did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated userCVE-2021-24507 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues
Product
Astra Pro Addon
Fixed in
3.5.2
What to do
Update Astra Pro Addon to 3.5.2 or newer.
Full record and what to do →NVD record wpastra.com wpscan.com
Aug 2, 2021Post Index: Cross-Site Request ForgeryCVE-2021-34637 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.5.
Product
Post Index
Affected
up to 0.7.5
What to do
Affects up to 0.7.5. Update Post Index to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2021slider import search feature and tab parameter of the Post Grid: Settings are not properly sanitised before being output back in the pagesCVE-2021-24488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues
Product
slider import search feature and tab parameter of the Post Grid
Fixed in
2.1.8
What to do
Update slider import search feature and tab parameter of the Post Grid to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 19, 2021Related Posts for: Does not sanitise its heading_text and CSS settingsCVE-2021-24482 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text and CSS settings, allowing high privilege users (admin) to set XSS payloads in them, leading to Stored Cross-Site Scripting issues.
Product
Related Posts for
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Related Posts for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jul 12, 2021Smooth Scroll Page Up/Down Buttons: Does not properly sanitise and validate its psb_positioning settingsCVE-2021-24418 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_positioning settings, allowing high privilege users such as admin to set an XSS payload in it, which will be executed in all pages of the blog
Product
Smooth Scroll Page Up/Down Buttons
Affected
up to 1.4
What to do
Affects up to 1.4. Update Smooth Scroll Page Up/Down Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jul 12, 2021The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request.CVE-2021-24385 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.
Affected
4.7.3 to 4.7.3
What to do
Affects 4.7.3 to 4.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record 10up.com wpscan.com
Jul 7, 2021Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibCVE-2020-24146 · WordPress plugins & themes · reported by MITREHigh 8.1
Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action.
Product
CM Download Manager (aka cm-download-manager)
Affected
2.7.0 to 2.7.0
What to do
Affects 2.7.0 to 2.7.0. Update CM Download Manager (aka cm-download-manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users CVE-2021-34624 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for userCVE-2021-34623 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible fCVE-2021-34622 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible foCVE-2021-34621 · WordPress plugins & themes · reported by WordfenceCritical 9.8
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
Product
ProfilePress
Affected
3.0.0 to 3.1.3
What to do
Affects 3.0.0 to 3.1.3. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
Jul 6, 2021Jannah: Did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX actionCVE-2021-24407 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tie_ajax_search AJAX action, leading to a Reflected Cross-site Scripting (XSS) vulnerability.
Product
Jannah
Fixed in
5.4.5
What to do
Update Jannah to 5.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2021WordPress Popular Posts 5.3.2 and earlier: Cross-site scriptingCVE-2021-20746 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors.
Product
WordPress Popular Posts 5.3.2 and earlier
Affected
up to 5.3.2
What to do
Affects up to 5.3.2. Update WordPress Popular Posts 5.3.2 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cabrerahector.com cabrerahector.com
Jun 21, 2021Comments Like Dislike: Allows users to like/dislike posted commentsCVE-2021-24379 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user (even unauthenticated) to add unlimited like/dislike to any comment. The plugin appears to have some Restriction modes, such as Cookie Restriction, IP Restrictions, Logged In User Restriction, however, they do not prevent such attack as they only check client side
Product
Comments Like Dislike
Fixed in
1.1.4
What to do
Update Comments Like Dislike to 1.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameCVE-2021-24361 · WordPress plugins & themes · reported by WPScanCritical 9.8
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.
Product
Location Manager
Fixed in
2.1.0.10
What to do
Update Location Manager to 2.1.0.10 or newer.
Full record and what to do →NVD record wpgeodirectory.com wpscan.com
Jun 14, 2021import_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirectsCVE-2021-24353 · WordPress plugins & themes · reported by WPScanHigh 8.8
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
Product
import_data function of the Simple 301 Redirects by BetterLinks
Fixed in
2.0.4
What to do
Update import_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 14, 2021export_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to export a site's redirectsCVE-2021-24352 · WordPress plugins & themes · reported by WPScanHigh 8.8
The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.
Product
export_data function of the Simple 301 Redirects by BetterLinks
Fixed in
2.0.4
What to do
Update export_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 14, 2021theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder: Did not properly sanitise some of its fieldsCVE-2021-24351 · WordPress plugins & themes · reported by WPScanMedium 6.1
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
Product
theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder
Fixed in
4.1.12
What to do
Update theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder to 4.1.12 or newer.
Full record and what to do →NVD record theplusaddons.com wpscan.com
Jun 14, 2021When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitisedCVE-2021-24341 · WordPress plugins & themes · reported by WPScanHigh 8.8
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
Product
Xllentech English Islamic Calendar
Fixed in
2.6.8
What to do
Update Xllentech English Islamic Calendar to 2.6.8 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jun 7, 2021JNews: Did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*)CVE-2021-24342 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.
Product
JNews
Fixed in
8.0.6
What to do
Update JNews to 8.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 1, 2021Database Backup for: Did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tagCVE-2021-24322 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.4 did not escape the backup_recipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue.
Product
Database Backup for
Fixed in
2.4
What to do
Update Database Backup for to 2.4 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Bello - Directory & Listing: Did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ pageCVE-2021-24319 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise its post_excerpt parameter before outputting it back in the shop/my-account/bello-listing-endpoint/ page, leading to a Cross-Site Scripting issue
Product
Bello - Directory & Listing
Fixed in
1.6.0
What to do
Update Bello - Directory & Listing to 1.6.0 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jun 1, 2021Listeo: Did not ensure that the Post/Page and Booking to delete belong to the user making the requestCVE-2021-24318 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Listeo WordPress theme before 1.6.11 did not ensure that the Post/Page and Booking to delete belong to the user making the request, allowing any authenticated users to delete arbitrary page/post and booking via an IDOR vector.
Product
Listeo
Fixed in
1.6.11
What to do
Update Listeo to 1.6.11 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
May 24, 2021Goto: Did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX actionCVE-2021-24297 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Goto WordPress theme before 2.1 did not properly sanitize the formvalue JSON POST parameter in its tl_filter AJAX action, leading to an unauthenticated Reflected Cross-site Scripting (XSS) vulnerability.
Product
Goto
Fixed in
2.1
What to do
Update Goto to 2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021dsgvoaio_write_log AJAX action of the DSGVO All in one for WP: Did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/adminCVE-2021-24294 · WordPress plugins & themes · reported by WPScanMedium 6.1
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
Product
dsgvoaio_write_log AJAX action of the DSGVO All in one for WP
Fixed in
4.0
What to do
Update dsgvoaio_write_log AJAX action of the DSGVO All in one for WP to 4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress PluCVE-2021-24295 · WordPress plugins & themes · reported by WPScanHigh 7.5
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
Product
Spam protection, AntiSpam, FireWall by CleanTalk
Fixed in
5.153.4
What to do
Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.153.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.