Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

3,187 results · page 54 of 64

Apr 25, 2022Coming Soon by Supsystic: Does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46781 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Coming Soon by Supsystic
Fixed in
1.7.6
What to do
Update Coming Soon by Supsystic to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Easy Google Maps: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Easy Google Maps
Fixed in
1.9.32
What to do
Update Easy Google Maps to 1.9.32 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Advanced Page Visit Counter: Does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX actionCVE-2021-24957 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection
Product
Advanced Page Visit Counter
Fixed in
6.1.6
What to do
Update Advanced Page Visit Counter to 6.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Good & Bad Comments: Does not sanitise and escape its settingsCVE-2022-1090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Good & Bad Comments
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Good & Bad Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Page Security & Membership: Does not sanitise and escape some of its settingsCVE-2022-1088 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Page Security & Membership
Affected
up to 1.5.15
What to do
Affects up to 1.5.15. Update Page Security & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Thank Me Later: Does not sanitise and escape the Message Subject field before outputting it in the Messages listCVE-2022-1063 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Thank Me Later
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update Thank Me Later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Hummingbird: Does not sanitise and escape the Config NameCVE-2022-0994 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Hummingbird
Fixed in
3.3.2
What to do
Update Hummingbird to 3.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Caldera Forms: Does not validate and escape the cf-api parameter before outputting it back in the responseCVE-2022-0879 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Product
Caldera Forms
Fixed in
1.9.7
What to do
Update Caldera Forms to 1.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Daily Prayer Time: Does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users)CVE-2022-0785 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
Product
Daily Prayer Time
Fixed in
2022.03.01
What to do
Update Daily Prayer Time to 2022.03.01 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Text Hover: Does not sanitize and escape the text to hoverCVE-2022-0737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Text Hover
Fixed in
4.2
What to do
Update Text Hover to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Easy Digital Downloads: Does not sanitise and escape the Downloadable File Name in the LogsCVE-2022-0706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Product
Easy Digital Downloads
Fixed in
2.11.6
What to do
Update Easy Digital Downloads to 2.11.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Podcast Importer SecondLine: Does not sanitise and properly escape some imported dataCVE-2022-1023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
Product
Podcast Importer SecondLine
Fixed in
1.3.8
What to do
Update Podcast Importer SecondLine to 1.3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the room parameter before outputting it back in an admin pageCVE-2022-1007 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
Advanced Booking Calendar
Fixed in
1.7.1
What to do
Update Advanced Booking Calendar to 1.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the id parameterCVE-2022-1006 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks
Product
Advanced Booking Calendar
Fixed in
1.7.1
What to do
Update Advanced Booking Calendar to 1.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Image optimization & Lazy Load by Optimole: Does not sanitise and escape its "Lazyload background images for selectors" settingsCVE-2022-0969 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
Product
Image optimization & Lazy Load by Optimole
Fixed in
3.3.2
What to do
Update Image optimization & Lazy Load by Optimole to 3.3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJACVE-2022-0949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
Product
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
Fixed in
6.930
What to do
Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 6.930 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Export All URLs: Does not sanitise and escape the CSV filename before outputting it back in the pageCVE-2022-0892 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Export All URLs
Fixed in
4.2
What to do
Update Export All URLs to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Easy Social Icons: Does not properly escape the image_file fieldCVE-2022-0840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
Product
Easy Social Icons
Fixed in
3.2.1
What to do
Update Easy Social Icons to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Easy Smooth Scroll Links: Does not sanitise and escape its settingsCVE-2022-0728 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Easy Smooth Scroll Links
Fixed in
2.23.1
What to do
Update Easy Smooth Scroll Links to 2.23.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Migration, Backup, Staging: Does not sanitise and escape the sub_page parameter before outputting it back in the pageCVE-2022-0531 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting
Product
Migration, Backup, Staging
Fixed in
0.9.70
What to do
Update Migration, Backup, Staging to 0.9.70 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Favicon by RealFaviconGenerator: Does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboardCVE-2022-0471 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Favicon by RealFaviconGenerator
Fixed in
1.3.23
What to do
Update Favicon by RealFaviconGenerator to 1.3.23 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 11, 2022Post Grid: Does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX actionCVE-2022-0447 · WordPress plugins & themes · reported by WPScanMedium 6.4
The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting
Product
Post Grid
Fixed in
2.1.16
What to do
Update Post Grid to 2.1.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Nimble Page Builder: Does not sanitise and escape the preview-level-guid parameter before outputting it back in the pageCVE-2022-0314 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Nimble Page Builder
Fixed in
3.2.2
What to do
Update Nimble Page Builder to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022LearnPress: Does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX actionCVE-2022-0271 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting
Product
LearnPress
Fixed in
4.1.6
What to do
Update LearnPress to 4.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Social Share, Social Login and Social Comments: Does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it CVE-2021-24987 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.30
What to do
Update Social Share, Social Login and Social Comments to 7.13.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Post Grid: Does not escape the keyword parameter before outputting it back in an attributeCVE-2021-24986 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form
Product
Post Grid
Fixed in
2.1.16
What to do
Update Post Grid to 2.1.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022Mark Posts: Does not escape new markersCVE-2022-0958 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Mark Posts
Fixed in
2.0.1
What to do
Update Mark Posts to 2.0.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to aCVE-2022-0901 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
Fixed in
2.7.12
What to do
Update the plugin to 2.7.12 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Apr 4, 2022Profile Builder: Does not sanitise and escape Form Fields titles and descriptionCVE-2022-0884 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed
Product
Profile Builder
Fixed in
3.6.8
What to do
Update Profile Builder to 3.6.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_interval parameter before outputting it back in an admin pageCVE-2022-0864 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
Product
UpdraftPlus WordPress Backup
Fixed in
1.22.9
What to do
Update UpdraftPlus WordPress Backup to 1.22.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Apr 4, 2022Insights from Google PageSpeed: Does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboardCVE-2022-0431 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
Product
Insights from Google PageSpeed
Fixed in
4.0.4
What to do
Update Insights from Google PageSpeed to 4.0.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 28, 2022SpeakOut! Email Petitions: Does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX actionCVE-2022-0846 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Product
SpeakOut! Email Petitions
Fixed in
2.14.15.1
What to do
Update SpeakOut! Email Petitions to 2.14.15.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Limit Login Attempts (Spam Protection): Does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users)CVE-2022-0787 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections
Product
Limit Login Attempts (Spam Protection)
Fixed in
5.1
What to do
Update Limit Login Attempts (Spam Protection) to 5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Title Experiments Free: Does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users)CVE-2022-0784 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
Product
Title Experiments Free
Fixed in
9.0.1
What to do
Update Title Experiments Free to 9.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Bulk Creator: Does not sanitize and escape the post_type parameter before outputting it back in an admin pageCVE-2022-0647 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Bulk Creator
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Bulk Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Bank Mellat: Does not sanitize and escape the orderId parameter before outputting it back in an admin pageCVE-2022-0643 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Bank Mellat
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update Bank Mellat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Popup Like box: Does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin pageCVE-2022-0641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Popup Like box
Fixed in
3.6.1
What to do
Update Popup Like box to 3.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022dTabs: Does not sanitize and escape the tab parameter before outputting it back in an admin pageCVE-2022-0621 · WordPress plugins & themes · reported by WPScanMedium 6.1
The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
dTabs
Affected
up to 1.4
What to do
Affects up to 1.4. Update dTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Delete Old Orders: Does not sanitize and escape the date parameter before outputting it back in an admin pageCVE-2022-0620 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Delete Old Orders
Affected
up to 0.2
What to do
Affects up to 0.2. Update Delete Old Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Database Peek: Does not sanitize and escape the match parameter before outputting it back in an admin pageCVE-2022-0619 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Database Peek
Affected
up to 1.2
What to do
Affects up to 1.2. Update Database Peek to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Conference Scheduler: Does not sanitize and escape the tab parameter before outputting back in an admin pageCVE-2022-0600 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Conference Scheduler
Fixed in
2.4.3
What to do
Update Conference Scheduler to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Mapping Multiple URLs Redirect Same Page: Does not sanitize and escape the mmursp_id parameter before outputting it back in an admin pageCVE-2022-0599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Mapping Multiple URLs Redirect Same Page
Affected
up to 5.8
What to do
Affects up to 5.8. Update Mapping Multiple URLs Redirect Same Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Popup Builder: Does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboardCVE-2022-0479 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
Product
Popup Builder
Fixed in
4.1.1
What to do
Update Popup Builder to 4.1.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 28, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user)CVE-2022-0397 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Product
WPC Smart Wishlist for WooCommerce
Fixed in
2.9.4
What to do
Update WPC Smart Wishlist for WooCommerce to 2.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Interactive Medical Drawing of Human Body: Does not sanitise and escape the Link fieldCVE-2022-0388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Interactive Medical Drawing of Human Body
Fixed in
2.6
What to do
Update Interactive Medical Drawing of Human Body to 2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected CroCVE-2021-25071 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
WordPress
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Block Bad Bots: Does not properly sanitise and escape the User Agent before using it in a SQL statement to record logsCVE-2021-25070 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue
Product
Block Bad Bots
Fixed in
6.88
What to do
Update Block Bad Bots to 6.88 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Pz-LinkCard: Does not sanitise and escape multiple parameters before outputting them back in admin dashboard pagesCVE-2021-25012 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
Product
Pz-LinkCard
Affected
up to 2.4.4.4
What to do
Affects up to 2.4.4.4. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Social Sharing: Does not escape the viewed post URL before outputting it back in onclick attributesCVE-2021-24746 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
Product
Social Sharing
Fixed in
3.3.40
What to do
Update Social Sharing to 3.3.40 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 21, 2022Simple Link Directory: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0760 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Product
Simple Link Directory
Fixed in
7.7.2
What to do
Update Simple Link Directory to 7.7.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.