Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

5,866 results · page 64 of 118

Sep 9, 2021Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11).CVE-2021-36871 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps Pro premium plugin (versions <= 8.1.11). Vulnerable parameters: &wpgmaps_marker_category_name, Value > &attributes[], Name > &attributes[], &icons[], &names[], &description, &link, &title.
Affected
up to 8.1.11
What to do
Affects up to 8.1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wpgmaps.com
Sep 9, 2021Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12).CVE-2021-36870 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in WordPress WP Google Maps plugin (versions <= 8.1.12). Vulnerable parameters: &dataset_name, &wpgmza_gdpr_retention_purpose, &wpgmza_gdpr_company_name, &name #2, &name, &polyname #2, &polyname, &address.
Affected
up to 8.1.12
What to do
Affects up to 8.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 6, 2021An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, lCVE-2021-24394 · WordPress plugins & themes · reported by WPScanHigh 7.2
An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection
Product
Easy Testimonial Manager
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update Easy Testimonial Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 6, 2021A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, CVE-2021-24393 · WordPress plugins & themes · reported by WPScanHigh 7.2
A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
Comment Highlighter
Affected
up to 0.13
What to do
Affects up to 0.13. Update Comment Highlighter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 6, 2021An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to aCVE-2021-24392 · WordPress plugins & themes · reported by WPScanHigh 7.2
An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
WordPress Membership SwiftCloud.io
Affected
up to 1.0
What to do
Affects up to 1.0. Update WordPress Membership SwiftCloud.io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 6, 2021An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leaCVE-2021-24391 · WordPress plugins & themes · reported by WPScanHigh 8.8
An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
Cashtomer
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Cashtomer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 6, 2021A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before insCVE-2021-24390 · WordPress plugins & themes · reported by WPScanHigh 7.2
A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.
Product
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
Affected
up to 3.7.2
What to do
Affects up to 3.7.2. Update WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 2, 2021The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file.CVE-2021-39322 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Social Icons plugin <= 3.0.8 for WordPress echoes out the raw value of `$_SERVER['PHP_SELF']` in its main file. On certain configurations including Apache+modPHP this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Product
Easy Social Icons
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Easy Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpvulndb.com wordfence.com
Sep 2, 2021The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `incluCVE-2021-38314 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Product
Gutenberg Template Library & Redux Framework
Affected
up to 4.2.11
What to do
Affects up to 4.2.11. Update Gutenberg Template Library & Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Sep 2, 2021The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered underCVE-2021-38312 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress used an incorrect authorization check in the REST API endpoints registered under the “redux/v1/templates/” REST Route in “redux-templates/classes/class-api.php”. The `permissions_callback` used in this file only checked for the `edit_posts` capability which is granted to lower-privileged users such as contributors, allowing such users to install arbitrary plugins from the WordPress repository and edit arbitrary posts.
Product
Gutenberg Template Library & Redux Framework
Affected
up to 4.2.11
What to do
Affects up to 4.2.11. Update Gutenberg Template Library & Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Sep 1, 2021The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file.CVE-2021-39320 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.php file. On certain configurations including Apache+modPHP, this makes it possible to use it to perform a reflected Cross-Site Scripting attack by injecting malicious code in the request path.
Product
underConstruction
Affected
up to 1.18
What to do
Affects up to 1.18. Update underConstruction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wordfence.com
Aug 31, 2021The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsCVE-2021-39316 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.
Product
Zoomsounds
Affected
up to 6.45
What to do
Affects up to 6.45. Update Zoomsounds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wordfence.com
Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSorCVE-2021-38343 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to an Open Redirect via the `page` POST parameter in the `npBulkActions`, `npBulkEdit`, `npListingSort`, and `npCategoryFilter` `admin_post` actions.
Product
Nested Pages
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which alCVE-2021-38342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changing their status, reassigning their ownership, and editing other metadata.
Product
Nested Pages
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 30, 2021WordPress Real Media Library: Stored Cross-Site ScriptingCVE-2021-34668 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1.
Product
WordPress Real Media Library
Affected
up to 4.14.1
What to do
Affects up to 4.14.1. Update WordPress Real Media Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 30, 2021Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verificationCVE-2021-34646 · WordPress plugins & themes · reported by WordfenceCritical 9.8
Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.
Product
Booster for WooCommerce
Affected
up to 5.4.3
What to do
Affects up to 5.4.3. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2021The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted CVE-2021-24556 · WordPress plugins & themes · reported by WPScanMedium 6.1
The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting them back in the Subscriber list (/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings), leading a Stored XSS issue.
Product
Email Subscriber
Affected
up to 1.1
What to do
Affects up to 1.1. Update Email Subscriber to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 19, 2021WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.CVE-2021-37597 · WordPress plugins & themes · reported by MITRECritical 9.8
WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.
Fixed in
8.9.3
What to do
Update the plugin to 8.9.3 or newer.
Full record and what to do →NVD record github.com github.com
Aug 16, 2021SEOPress: Stored Cross-Site-ScriptingCVE-2021-34641 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.
Product
SEOPress
Affected
5.0.0 to 5.0.3
What to do
Affects 5.0.0 to 5.0.3. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 16, 2021Shantz WordPress QOTD: Is lacking any CSRF checkCVE-2021-24380 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.
Product
Shantz WordPress QOTD
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update Shantz WordPress QOTD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 9, 2021The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/registCVE-2021-24522 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.
Product
User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar)
Fixed in
3.1.11
What to do
Update User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 9, 2021Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that CVE-2021-24500 · WordPress plugins & themes · reported by WPScanHigh 8.1
Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site.
Product
Workreap
Fixed in
2.2.2
What to do
Update Workreap to 2.2.2 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Aug 5, 2021Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g.CVE-2021-34639 · WordPress plugins & themes · reported by WordfenceHigh 7.5
Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Affected
up to 3.1.24
What to do
Affects up to 3.1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 5, 2021Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file inforCVE-2021-34638 · WordPress plugins & themes · reported by WordfenceMedium 6.5
Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as allowing Author+ users to perform XSS attacks, by setting Download template to a file containing configuration information or an uploaded JavaScript with an image extension This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Affected
up to 3.1.24
What to do
Affects up to 3.1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 2, 2021WP LMS – Best WordPress LMS: Does not properly sanitise or validate its User Field TitlesCVE-2021-24504 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)
Product
WP LMS – Best WordPress LMS
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP LMS – Best WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does nCVE-2021-24492 · WordPress plugins & themes · reported by WPScanHigh 8.8
The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
Product
Handsome Testimonials & Reviews
Fixed in
2.1.1
What to do
Update Handsome Testimonials & Reviews to 2.1.1 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 2, 2021OnAir2: And QT KenthaRadio WordPress plugin before 2CVE-2021-24472 · WordPress plugins & themes · reported by WPScanCritical 9.8
The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.
Product
OnAir2
Fixed in
3.9.9.2
What to do
Update OnAir2 to 3.9.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar): Did not sanitise or escape some of its settings before saving them and outputting them back in the pageCVE-2021-24450 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript payloads in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar)
Fixed in
3.1.8
What to do
Update User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) to 3.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021TaxoPress – Create and Manage Taxonomies, Tags, Categories: Does not sanitise its Taxonomy description fieldCVE-2021-24444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.
Product
TaxoPress – Create and Manage Taxonomies, Tags, Categories
Fixed in
3.0.7.2
What to do
Update TaxoPress – Create and Manage Taxonomies, Tags, Categories to 3.0.7.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
Product
About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
Fixed in
1.0.7
What to do
Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2021The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher CVE-2020-11511 · WordPress plugins & themes · reported by MITREHigh 8.1
The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.
Product
LearnPress
Fixed in
3.2.6.9
What to do
Update LearnPress to 3.2.6.9 or newer.
Full record and what to do →NVD record packetstormsecurity.com cwe.mitre.org
Jul 26, 2021Woocommerce is an open source eCommerce plugin for WordPress.CVE-2021-32790 · WordPress plugins & themes · reported by GitHubMedium 4.9
Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com woocommerce.com
Jul 19, 2021An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress.CVE-2021-3135 · WordPress plugins & themes · reported by MITREMedium 6.1
An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id parameter in a td_ajax_block API call.
Product
tagDiv Newspaper
Affected
10.3.9.1 to 10.3.9.1
What to do
Affects 10.3.9.1 to 10.3.9.1. Update tagDiv Newspaper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tagdiv.com themeforest.net
Jul 13, 2021WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8: Cross-site request forgery (CSRF)CVE-2021-20781 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8
What to do
Update WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 to the newest version.
Full record and what to do →NVD record jvn.jp wp-filter.com
Jul 13, 2021A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in thCVE-2020-26153 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Fixed in
4.10.7.p
What to do
Update the plugin to 4.10.7.p or newer.
Full record and what to do →NVD record github.com labs.nettitude.com
Jul 12, 2021In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "ShCVE-2021-24454 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.
Product
YOP Poll
Fixed in
6.2.8
What to do
Update YOP Poll to 6.2.8 or newer.
Full record and what to do →NVD record wpscan.com in-spired.xyz
Jul 12, 2021WP Reset – Most Advanced WordPress Reset Tool: Did not sanitise or escape its extra_data parameterCVE-2021-24424 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Product
WP Reset – Most Advanced WordPress Reset Tool
Fixed in
1.90
What to do
Update WP Reset – Most Advanced WordPress Reset Tool to 1.90 or newer.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jul 12, 2021The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables.CVE-2021-24365 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns.
Fixed in
4.3.2
What to do
Update the plugin to 4.3.2 or newer.
Full record and what to do →NVD record wpscan.com syss.de
Jul 7, 2021Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter inCVE-2020-24149 · WordPress plugins & themes · reported by MITREHigh 7.5
Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.
Product
Podcast Importer SecondLine (podcast-importer-secondline)
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update Podcast Importer SecondLine (podcast-importer-secondline) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml actioCVE-2020-24148 · WordPress plugins & themes · reported by MITRECritical 9.1
Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.
Product
Import XML and RSS Feeds (import-xml-feed)
Affected
2.0.1 to 2.0.1
What to do
Affects 2.0.1 to 2.0.1. Update Import XML and RSS Feeds (import-xml-feed) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.CVE-2020-24147 · WordPress plugins & themes · reported by MITRECritical 9.1
Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.
Product
WP Smart Import (wp-smart-import)
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update WP Smart Import (wp-smart-import) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibCVE-2020-24146 · WordPress plugins & themes · reported by MITREHigh 8.1
Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitrary files and possibly cause a denial of service via the fileName parameter in a deletescreenshot action.
Product
CM Download Manager (aka cm-download-manager)
Affected
2.7.0 to 2.7.0
What to do
Affects 2.7.0 to 2.7.0. Update CM Download Manager (aka cm-download-manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitCVE-2020-24145 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action.
Product
CM Download Manager (aka cm-download-manager)
Affected
2.7.0 to 2.7.0
What to do
Affects 2.7.0 to 2.7.0. Update CM Download Manager (aka cm-download-manager) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outsiCVE-2020-24144 · WordPress plugins & themes · reported by MITREHigh 8.6
Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items[] parameter in a move operation.
Product
Media File Organizer (aka media-file-organizer)
Affected
1.0.1 to 1.0.1
What to do
Affects 1.0.1 to 1.0.1. Update Media File Organizer (aka media-file-organizer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com ru.wordpress.org
Jul 7, 2021Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outCVE-2020-24143 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter.
Product
Video Downloader for TikTok (aka downloader-tiktok)
Affected
1.3 to 1.3
What to do
Affects 1.3 to 1.3. Update Video Downloader for TikTok (aka downloader-tiktok) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 7, 2021Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the CVE-2020-24142 · WordPress plugins & themes · reported by MITRECritical 9.8
Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services
Product
Video Downloader for TikTok (aka downloader-tiktok)
Affected
1.3 to 1.3
What to do
Affects 1.3 to 1.3. Update Video Downloader for TikTok (aka downloader-tiktok) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 7, 2021Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerablCVE-2020-24141 · WordPress plugins & themes · reported by MITREMedium 5.3
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
Product
WP-DownloadManager
Affected
1.68.4 to 1.68.4
What to do
Affects 1.68.4 to 1.68.4. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 7, 2021A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extCVE-2021-34627 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions CVE-2021-34626 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scriptCVE-2021-34625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.