Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

3,187 results · page 56 of 64

Mar 7, 2022NotificationX: Does not sanitise and escape the nx_id parameter before using it in a SQL statementCVE-2022-0349 · WordPress plugins & themes · reported by WPScanCritical 9.8
The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
Product
NotificationX
Fixed in
2.3.9
What to do
Update NotificationX to 2.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022LoginPress | Custom Login Page Customizer: Does not escape the redirect-page parameter before outputting it back in an attributeCVE-2022-0347 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
LoginPress | Custom Login Page Customizer
Fixed in
1.5.12
What to do
Update LoginPress | Custom Login Page Customizer to 1.5.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022AdRotate: Does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to adminsCVE-2022-0267 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
Product
AdRotate
Fixed in
5.8.22
What to do
Update AdRotate to 5.8.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022YOP Poll: Does not sanitise and escape some of the settings (available to users with a roleCVE-2022-0205 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue
Product
YOP Poll
Fixed in
6.3.5
What to do
Update YOP Poll to 6.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022WordPress Multisite Content Copier/Updater: Does not sanitise and escape the wmcc_content_typeCVE-2021-25039 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.0 does not sanitise and escape the wmcc_content_type, wmcc_source_blog and wmcc_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
WordPress Multisite Content Copier/Updater
Fixed in
2.1.0
What to do
Update WordPress Multisite Content Copier/Updater to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022WordPress Multisite User Sync/Unsync: Does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributesCVE-2021-25038 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite User Sync/Unsync WordPress plugin before 2.1.2 does not sanitise and escape the wmus_source_blog and wmus_record_per_page parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
WordPress Multisite User Sync/Unsync
Fixed in
2.1.2
What to do
Update WordPress Multisite User Sync/Unsync to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro: Does not escape some of its shortcode argumentCVE-2021-24961 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Product
WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro
Fixed in
4.16.3
What to do
Update WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro to 4.16.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022Advanced iFrame: Does not sanitise and escape the ai_config_id parameter before outputting it back in an admin pageCVE-2021-24953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Product
Advanced iFrame
Fixed in
2022
What to do
Update Advanced iFrame to 2022 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022Custom Content Shortcode: Does not escape custom fields before outputting themCVE-2021-24826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)
Product
Custom Content Shortcode
Fixed in
4.0.2
What to do
Update Custom Content Shortcode to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022WP Event Manager: Does not escape some of its Field Editor settingsCVE-2021-24810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
WP Event Manager
Fixed in
3.1.23
What to do
Update WP Event Manager to 3.1.23 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloaCVE-2022-23988 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
Fixed in
1.8.176
What to do
Update the plugin to 1.8.176 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-SiCVE-2022-23987 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Fixed in
1.8.176
What to do
Update the plugin to 1.8.176 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022Testimonial: Does not sanitise and escape the id parameter before outputting it back in an attributeCVE-2022-23912 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting
Product
Testimonial
Fixed in
1.4.7
What to do
Update Testimonial to 1.4.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Testimonial: Does not validate and escape the id parameter before using it in a SQL statementCVE-2022-23911 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection
Product
Testimonial
Fixed in
1.4.7
What to do
Update Testimonial to 1.4.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro: Do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpointCVE-2022-0412 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks
Product
TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro
Fixed in
1.40.1
What to do
Update TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro to 1.40.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Asgaros Forum: Does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user)CVE-2022-0411 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection
Product
Asgaros Forum
Fixed in
2.0.0
What to do
Update Asgaros Forum to 2.0.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Crazy Bone: Does not sanitise and escape the username submitted via the login fromCVE-2022-0385 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting
Product
Crazy Bone
Affected
up to 0.6.0
What to do
Affects up to 0.6.0. Update Crazy Bone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WP Review Slider: Does not sanitise and escape the pid parameterCVE-2022-0383 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privilege users to perform SQL Injections attacks
Product
WP Review Slider
Fixed in
11.0
What to do
Update WP Review Slider to 11.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Easy Drag And drop All Import : WP Ultimate CSV Importer: Does not sanitise and escaped imported commentsCVE-2022-0360 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
Product
Easy Drag And drop All Import : WP Ultimate CSV Importer
Fixed in
6.4.3
What to do
Update Easy Drag And drop All Import : WP Ultimate CSV Importer to 6.4.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022WP RSS Aggregator: Does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the responseCVE-2022-0189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Product
WP RSS Aggregator
Fixed in
4.20
What to do
Update WP RSS Aggregator to 4.20 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022WP Accessibility Helper (WAH): Does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the pageCVE-2022-0150 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue
Product
WP Accessibility Helper (WAH)
Fixed in
0.6.0.7
What to do
Update WP Accessibility Helper (WAH) to 0.6.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022WP-Paginate: Does not sanitise and escape its preset settingsCVE-2021-4222 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
WP-Paginate
Fixed in
2.1.4
What to do
Update WP-Paginate to 2.1.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Feb 28, 2022WHMCS Bridge: Does not sanitise and escape the error parameter before outputting it back in admin dashboardCVE-2021-25112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
Product
WHMCS Bridge
Fixed in
6.4b
What to do
Update WHMCS Bridge to 6.4b or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022WP User: Does not sanitise and escape some parameters in pages where the [wp_user] shortcode is usedCVE-2021-25034 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues
Product
WP User
Fixed in
7.0
What to do
Update WP User to 7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WP Responsive Menu: Does not have capability and CSRF checks in the wpr_live_update AJAX actionCVE-2021-24971 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin's settings and perform Cross-Site Scripting attacks against all visitor and users on the frontend
Product
WP Responsive Menu
Fixed in
3.1.7.1
What to do
Update WP Responsive Menu to 3.1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022Dynamic Widgets: Does not escape the prefix parameter before outputting it back in an attributeCVE-2021-24933 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting issue
Product
Dynamic Widgets
Affected
up to 1.5.16
What to do
Affects up to 1.5.16. Update Dynamic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022StatCounter: Does not sanitise and escape the Project ID and Secure Code settingsCVE-2021-24920 · WordPress plugins & themes · reported by WPScanMedium 4.8
The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
StatCounter
Fixed in
2.0.7
What to do
Update StatCounter to 2.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022GRAND FlaGallery: Does not sanitise and escape some of its gallery settingsCVE-2021-24903 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privilege users to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
Product
GRAND FlaGallery
Affected
up to 6.1.2
What to do
Affects up to 6.1.2. Update GRAND FlaGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022Security Audit: Does not sanitise and escape the Data Id settingCVE-2021-24901 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Security Audit
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Security Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022EditableTable: Does not sanitise and escape any of the Table and Column fieldsCVE-2021-24898 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
EditableTable
Affected
up to 0.1.4
What to do
Affects up to 0.1.4. Update EditableTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WP Cloudy, weather: Does not escape the post_id parameter before using it in a SQL statement in the admin dashboardCVE-2021-24864 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue
Product
WP Cloudy, weather
Fixed in
4.4.9
What to do
Update WP Cloudy, weather to 4.4.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 202215Zine: Does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX actionCVE-2020-36510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting
Product
15Zine
Fixed in
3.3.0
What to do
Update 15Zine to 3.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro: Do not sanitise and escape the html_element_selection parameter before outputting it back in the pageCVE-2022-0288 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro
Fixed in
2.7.10
What to do
Update Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro to 2.7.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
Product
Database Backup for
Fixed in
2.5.1
What to do
Update Database Backup for to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022GiveWP: Does not escape the json parameter before outputting it back in an attribute in the Import admin dashboardCVE-2022-0252 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
Product
GiveWP
Fixed in
2.17.3
What to do
Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022WOOCS: Does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the respCVE-2022-0234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Product
WOOCS
Fixed in
1.3.7.5
What to do
Update WOOCS to 1.3.7.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Product
Popup Builder
Fixed in
4.0.7
What to do
Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Shield Security: Does not sanitise and escape admin notesCVE-2022-0211 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
Shield Security
Fixed in
13.0.6
What to do
Update Shield Security to 13.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Image Photo Gallery Final Tiles Grid: Does not sanitise and escape the Description fieldCVE-2022-0186 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
Product
Image Photo Gallery Final Tiles Grid
Fixed in
3.5.3
What to do
Update Image Photo Gallery Final Tiles Grid to 3.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022ExportFeed: Does not sanitise and escape the product_id POST parameter before using it in a SQL statementCVE-2021-4208 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users
Product
ExportFeed
Affected
up to 2.0.1.0
What to do
Affects up to 2.0.1.0. Update ExportFeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the POST data before outputting it back in attributes of an admin pageCVE-2021-25101 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
Product
Anti-Malware Security and Brute-Force Firewall
Fixed in
4.20.94
What to do
Update Anti-Malware Security and Brute-Force Firewall to 4.20.94 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
Product
GiveWP
Fixed in
2.17.3
What to do
Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022GiveWP: Does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX actionCVE-2021-25099 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
Product
GiveWP
Fixed in
2.17.3
What to do
Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Download Manager: Does not sanitise and escape the package_ids parameter before using it in a SQL statementCVE-2021-25069 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue
Product
Download Manager
Fixed in
3.2.34
What to do
Update Download Manager to 3.2.34 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Advanced Database Cleaner: Does not sanitise and escape $_GET keys and values before outputting them back in attributesCVE-2021-24921 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Advanced Database Cleaner
Fixed in
3.0.4
What to do
Update Advanced Database Cleaner to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022SpiderCalendar: Does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0212 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
Product
SpiderCalendar
Affected
up to 1.5.65
What to do
Affects up to 1.5.65. Update SpiderCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022MapPress Maps for: Does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error messageCVE-2022-0208 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
Product
MapPress Maps for
Fixed in
2.73.4
What to do
Update MapPress Maps for to 2.73.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022NewStatPress: Does not properly escape the whatX parameters before outputting them back in attributesCVE-2022-0206 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
NewStatPress
Fixed in
1.3.6
What to do
Update NewStatPress to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themiCVE-2022-0200 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Fixed in
1.1.7
What to do
Update the plugin to 1.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Complianz: Does not escape the s parameter before outputting it back in an attribute in an admin pageCVE-2022-0193 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Complianz
Fixed in
6.0.0
What to do
Update Complianz to 6.0.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.