Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

3,808 results · page 68 of 77

Sep 6, 2022Download Manager: Arbitrary file deletionCVE-2022-2431 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server.
Product
Download Manager
Affected
up to 3.2.50
What to do
Affects up to 3.2.50. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Aug 29, 2022Export All URLs: Does not validate the path of the file to be removed on the systemCVE-2022-2638 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server
Product
Export All URLs
Fixed in
4.4
What to do
Update Export All URLs to 4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022WPIDE: Does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboardCVE-2022-2261 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue.
Product
WPIDE
Fixed in
3.0
What to do
Update WPIDE to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2022Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.CVE-2022-36285 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 23, 2022Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.CVE-2022-35235 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.
Affected
up to 2.6
What to do
Affects up to 2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 23, 2022Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.CVE-2022-34648 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
Product
Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro
Fixed in
5.12.3
What to do
Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.
Full record and what to do →NVD record wpscan.com pritect.net
Aug 22, 2022Team: Contains a fileCVE-2022-2557 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user
Product
Team
Fixed in
4.1.2
What to do
Update Team to 4.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Lana Downloads Manager: Is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higherCVE-2022-2392 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher.
Product
Lana Downloads Manager
Fixed in
1.8.0
What to do
Update Lana Downloads Manager to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022WSM Downloader: Allows only specific popular websites to download images/files fromCVE-2022-2367 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation
Product
WSM Downloader
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update WSM Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022WSM Downloader: Allows any visitor to use its remote file download feature to download any local filesCVE-2022-2357 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php.
Product
WSM Downloader
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update WSM Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022Frontend File Manager & Sharing: Does not filter file extensionsCVE-2022-2356 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.
Product
Frontend File Manager & Sharing
Fixed in
1.1.3
What to do
Update Frontend File Manager & Sharing to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
Product
Website File Changes Monitor
Fixed in
1.8.3
What to do
Update Website File Changes Monitor to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.CVE-2022-34154 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 28, 2022WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnCVE-2016-0796 · WordPress plugins & themes · reported by Red HatHigh 7.5
WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacker may leverage these issues to hide attacks directed at a target site from behind vulnerable website or to perform otherwise restricted actions and subsequently download files with the extension mp3, mp4a, wav and ogg from anywhere the web server application has read access to the system. WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files version 1.7.6 is vulnerable; prior versions may also be affected.
Affected
up to 1.7.6
What to do
Affects up to 1.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record vapidlabs.com acunetix.com
Jul 25, 2022Allow SVG Files: Does not sanitise uploaded SVG filesCVE-2022-2299 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
Product
Allow SVG Files
Affected
up to 1.1
What to do
Affects up to 1.1. Update Allow SVG Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022Request a Quote: Does not validate uploaded CSV filesCVE-2022-2240 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it
Product
Request a Quote
Affected
up to 2.3.7
What to do
Affects up to 2.3.7. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022SP Project & Document Manager: Uses an easily guessable path to store user filesCVE-2022-1551 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.
Product
SP Project & Document Manager
Fixed in
4.58
What to do
Update SP Project & Document Manager to 4.58 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 22, 2022Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.CVE-2022-33901 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 21, 2022Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-31475 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
Affected
up to 2.20.2
What to do
Affects up to 2.20.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 21, 2022Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-28700 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
Affected
up to 2.20.2
What to do
Affects up to 2.20.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 18, 2022The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, anCVE-2022-1565 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 17, 2022Download Monitor: Does not ensure that files to be downloaded are inside the blog foldersCVE-2022-2222 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
Product
Download Monitor
Fixed in
4.5.91
What to do
Update Download Monitor to 4.5.91 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Import CSV Files: Does not sanitise and escaped imported data before outputting them back in a pageCVE-2022-2146 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting
Product
Import CSV Files
Affected
up to 1.0
What to do
Affects up to 1.0. Update Import CSV Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2022Import any XML or CSV File to: Accepts all zip files and automatically extracts the zip file without validating the extracted file typeCVE-2022-2268 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
Product
Import any XML or CSV File to
Fixed in
3.6.8
What to do
Update Import any XML or CSV File to to 3.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Import Export All WordPress Images, Users & Post Types: Does not fully validate the file to be imported via an URL before making an HTTP request to itCVE-2022-1977 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
Product
Import Export All WordPress Images, Users & Post Types
Fixed in
6.5.3
What to do
Update Import Export All WordPress Images, Users & Post Types to 6.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Easy SVG Support: Does not sanitise uploaded SVG filesCVE-2022-1964 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
Product
Easy SVG Support
Fixed in
3.3.0
What to do
Update Easy SVG Support to 3.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Product Configurator for WooCommerce: Suffers from an arbitrary file deletion vulnerability via an AJAX actionCVE-2022-1953 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first
Product
Product Configurator for WooCommerce
Fixed in
1.2.32
What to do
Update Product Configurator for WooCommerce to 1.2.32 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022Allow svg files: Does not properly validate uploaded filesCVE-2022-1939 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to
Product
Allow svg files
Fixed in
1.1
What to do
Update Allow svg files to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Private Files: Is missing CSRF checkCVE-2022-1793 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public
Product
Private Files
Affected
up to 0.40
What to do
Affects up to 0.40. Update Private Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.CVE-2022-1788 · WordPress plugins & themes · reported by WPScanMedium 6.5
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Log WP_Mail: Saves sent email in a publicly accessible directory using predictable filenamesCVE-2022-1412 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visitor to obtain potentially sensitive information like generated passwords.
Product
Log WP_Mail
Affected
up to 0.1
What to do
Affects up to 0.1. Update Log WP_Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022Files Download Delay: Does not have authorisation and CSRF checksCVE-2022-1570 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.
Product
Files Download Delay
Fixed in
1.0.7
What to do
Update Files Download Delay to 1.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022Ask me: Does not properly sanitise and escape several of the fields in the Edit Profile pageCVE-2022-1241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues
Product
Ask me
Fixed in
6.8.2
What to do
Update Ask me to 6.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022User Meta: Does not validate the filepath parameter of its um_show_uploaded_file AJAX actionCVE-2022-0779 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads
Product
User Meta
Fixed in
2.4.4
What to do
Update User Meta to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022Enable SVG: Does not sanitise uploaded SVG filesCVE-2022-1562 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
Product
Enable SVG
Fixed in
1.4.0
What to do
Update Enable SVG to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 20, 2022Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.CVE-2022-29447 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
Affected
up to 2.1
What to do
Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 20, 2022Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.CVE-2022-29448 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.
Affected
up to 5.2
What to do
Affects up to 5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 20, 2022Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress.CVE-2022-29425 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress.
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 19, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.CVE-2022-29446 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 18, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.CVE-2022-29445 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 16, 2022Advanced Uploader: Allows any authenticated users like subscriber to upload arbitrary filesCVE-2022-1103 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE
Product
Advanced Uploader
Affected
up to 4.2
What to do
Affects up to 4.2. Update Advanced Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Bulk Edit and Create User Profiles: Does not sanitise and escape the Users LoginCVE-2022-1089 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Bulk Edit and Create User Profiles
Fixed in
1.5.14
What to do
Update Bulk Edit and Create User Profiles to 1.5.14 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022AGIL: Accepts all zip files and automatically extracts the zip file without validating the extracted file typeCVE-2021-25119 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE
Product
AGIL
Affected
up to 1.0
What to do
Affects up to 1.0. Update AGIL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 10, 2022All-in-One WP Migration: Arbitrary file deletionCVE-2022-1476 · WordPress plugins & themes · reported by WordfenceMedium 6.6
The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. This can be exploited by administrative users, and users who have access to the site's secret key.
Product
All-in-One WP Migration
Affected
up to 7.58
What to do
Affects up to 7.58. Update All-in-One WP Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 2, 2022Import WP: Does not validate the imported file in some casesCVE-2022-1273 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE
Product
Import WP
Fixed in
2.4.6
What to do
Update Import WP to 2.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 29, 2022Rara One Click Demo Import plugin <= 1.2.9 on: Cross-Site Request Forgery (CSRF) leading to Arbitrary File UploadCVE-2022-29451 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory.
Product
Rara One Click Demo Import plugin <= 1.2.9 on
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Rara One Click Demo Import plugin <= 1.2.9 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022Admin Word Count Column: Does not validate the path parameter given to readfile()CVE-2022-1390 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique
Product
Admin Word Count Column
Affected
up to 2.2
What to do
Affects up to 2.2. Update Admin Word Count Column to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Apr 25, 2022Web To Print Shop : uDraw: Does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function CVE-2022-0656 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
Product
Web To Print Shop : uDraw
Fixed in
3.3.3
What to do
Update Web To Print Shop : uDraw to 3.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Tatsu: Add_custom_font action can be used without prior authentication to upload a rogue zip fileCVE-2021-25094 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.
Product
Tatsu
Fixed in
3.3.12
What to do
Update Tatsu to 3.3.12 or newer.
Full record and what to do →NVD record packetstormsecurity.com darkpills.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.