Updated 36 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

3,808 results · page 71 of 77

Jun 21, 2021Autoptimize: Attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' featureCVE-2021-24377 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
Product
Autoptimize
Fixed in
2.7.8
What to do
Update Autoptimize to 2.7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021Autoptimize: Attempts to delete malicious files (suchCVE-2021-24376 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.
Product
Autoptimize
Fixed in
2.7.8
What to do
Update Autoptimize to 2.7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021Fancy Product Designer: Allows unauthenticated attackers to upload arbitrary filesCVE-2021-24370 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
Product
Fancy Product Designer
Fixed in
4.6.9
What to do
Update Fancy Product Designer to 4.6.9 or newer.
Full record and what to do →NVD record lists.openwall.net seclists.org
Jun 21, 2021WP Config File Editor: Was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2021-24367 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability.
Product
WP Config File Editor
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update WP Config File Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server.CVE-2021-24349 · WordPress plugins & themes · reported by WPScanMedium 6.1
This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.
Affected
up to 1.6.0
What to do
Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 14, 2021SP Project & Document Manager: Allows users to upload filesCVE-2021-24347 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
Product
SP Project & Document Manager
Fixed in
4.22
What to do
Update SP Project & Document Manager to 4.22 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Jun 1, 2021wp_ajax_upload-remote-file AJAX action of the External Media: Was vulnerable to arbitrary file uploads via any authenticated usersCVE-2021-24311 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.
Product
wp_ajax_upload-remote-file AJAX action of the External Media
Fixed in
1.0.34
What to do
Update wp_ajax_upload-remote-file AJAX action of the External Media to 1.0.34 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
Fixed in
4.21.1
What to do
Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
May 24, 2021Ultimate Member – User Profile, User Registration, Login & Membership: Did not properly sanitiseCVE-2021-24306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin before 2.1.20 did not properly sanitise, validate or encode the query string when generating a link to edit user's own profile, leading to an authenticated reflected Cross-Site Scripting issue. Knowledge of the targeted username is required to exploit this, and attackers would then need to make the related logged in user open a malicious link.
Product
Ultimate Member – User Profile, User Registration, Login & Membership
Fixed in
2.1.20
What to do
Update Ultimate Member – User Profile, User Registration, Login & Membership to 2.1.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2021Kaswara Modern VC Addons: Allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX actionCVE-2021-24284 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
Product
Kaswara Modern VC Addons
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Kaswara Modern VC Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com codecanyon.net
May 6, 2021College publisher Import: Does not check for the uploaded CSV file to importCVE-2021-24254 · WordPress plugins & themes · reported by WPScanHigh 7.2
The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.
Product
College publisher Import
Affected
up to 0.1
What to do
Affects up to 0.1. Update College publisher Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
May 6, 2021Classyfrieds: Does not properly check the uploaded fileCVE-2021-24253 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.
Product
Classyfrieds
Affected
up to 3.8
What to do
Affects up to 3.8. Update Classyfrieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
May 6, 2021Event Banner: Does not verify the uploaded image fileCVE-2021-24252 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)
Product
Event Banner
Affected
up to 1.3
What to do
Affects up to 1.3. Update Event Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Did not properly check for imported filesCVE-2021-24248 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11.1
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · WordPress plugins & themes · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Product
Tutor LMS – eLearning and online course solution
Fixed in
1.8.8
What to do
Update Tutor LMS – eLearning and online course solution to 1.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 22, 2021Business Hours Pro: Allows a remote attacker to upload arbitrary files using its manual update functionalityCVE-2021-24240 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.
Product
Business Hours Pro
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update Business Hours Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wpscan.com
Apr 12, 2021Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon: That could be abused by anyone visiting the siteCVE-2021-24227 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
Product
Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon
Fixed in
1.7.0
What to do
Update Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon to 1.7.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcodCVE-2021-24226 · WordPress plugins & themes · reported by WPScanHigh 7.5
In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.
Product
AccessAlly
Fixed in
3.5.7
What to do
Update AccessAlly to 3.5.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2021The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in pCVE-2021-24224 · WordPress plugins & themes · reported by WPScanHigh 8.8
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
Product
Easy Form Builder
Affected
up to 1.0
What to do
Affects up to 1.0. Update Easy Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
Apr 12, 2021N5 Upload Form: Suffers from an arbitrary file upload issue in page where a Form from the plugin is embedCVE-2021-24223 · WordPress plugins & themes · reported by WPScanCritical 9.8
The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be uploaded. The uploaded filename might be hard to guess as it's generated with md5(uniqid(rand())), however, in the case of misconfigured servers with Directory listing enabled, accessing it is trivial.
Product
N5 Upload Form
Affected
up to 1.0
What to do
Affects up to 1.0. Update N5 Upload Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
Apr 12, 2021WP-Curriculo Vitae Free: Suffers from an arbitrary file upload issue in page where the [formCadastro] is embedCVE-2021-24222 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.
Product
WP-Curriculo Vitae Free
Affected
up to 6.3
What to do
Affects up to 6.3. Update WP-Curriculo Vitae Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
Apr 5, 2021In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_managerCVE-2021-24177 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wp_file_manager_properties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response.
Product
File Manager
Fixed in
7.1
What to do
Update File Manager to 7.1 or newer.
Full record and what to do →NVD record n4nj0.github.io plugins.trac.wordpress.org
Apr 5, 2021WooCommerce Upload Files: Ran a single sanitization pass to remove blocked extensions suchCVE-2021-24171 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter.
Product
WooCommerce Upload Files
Fixed in
59.4
What to do
Update WooCommerce Upload Files to 59.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021REST API endpoint get_users in the User Profile Picture: Returned more information than was required for its functionality to users with the upload_files capabilityCVE-2021-24170 · WordPress plugins & themes · reported by WPScanHigh 7.5
The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
Product
REST API endpoint get_users in the User Profile Picture
Fixed in
2.5.0
What to do
Update REST API endpoint get_users in the User Profile Picture to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extractCVE-2021-24160 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4, subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.
Fixed in
4.0.4
What to do
Update the plugin to 4.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021WordPress Backup and Migrate Plugin – Backup Guard: Did not ensure that the imported files are of the SGBP format and extensionCVE-2021-24155 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
Product
WordPress Backup and Migrate Plugin – Backup Guard
Fixed in
1.6.0
What to do
Update WordPress Backup and Migrate Plugin – Backup Guard to 1.6.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Apr 5, 2021Theme Editor: Did not validate the GET file parameter before passing it to the download_file() functionCVE-2021-24154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd
Product
Theme Editor
Fixed in
2.6
What to do
Update Theme Editor to 2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, CVE-2021-24146 · WordPress plugins & themes · reported by WPScanHigh 7.5
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format for example.
Product
Modern Events Calendar Lite
Fixed in
5.16.5
What to do
Update Modern Events Calendar Lite to 5.16.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Mar 18, 2021Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones tCVE-2021-24145 · WordPress plugins & themes · reported by WPScanHigh 7.2
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.
Product
Modern Events Calendar Lite
Fixed in
5.16.5
What to do
Update Modern Events Calendar Lite to 5.16.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Mar 18, 2021Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast CVE-2021-24123 · WordPress plugins & themes · reported by WPScanHigh 7.2
Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), allowing high privilege accounts (admin+) being able to upload arbitrary files, such as php, leading to RCE.
Product
PowerPress
Fixed in
8.3.8
What to do
Update PowerPress to 8.3.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 22, 2021An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote coCVE-2021-3120 · WordPress plugins & themes · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability, an attacker must be able to place a valid Gift Card product into the shopping cart. An uploaded file is placed at a predetermined path on the web server with a user-specified filename and extension. This occurs because the ywgc-upload-picture parameter can have a .php value even though the intention was to only allow uploads of Gift Card images.
Product
An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium
Fixed in
3.3.1
What to do
Update An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium to 3.3.1 or newer.
Full record and what to do →NVD record github.com yithemes.com
Feb 9, 2021A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload.CVE-2020-35943 · WordPress plugins & themes · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
Product
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery
Fixed in
3.5.0
What to do
Update A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery to 3.5.0 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Feb 9, 2021A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modiCVE-2020-35942 · WordPress plugins & themes · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
Product
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery
Fixed in
3.5.0
What to do
Update A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery to 3.5.0 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Jan 4, 2021An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update.CVE-2020-36156 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges.
Product
An issue was discovered in the Ultimate Member
Fixed in
2.1.12
What to do
Update An issue was discovered in the Ultimate Member to 2.1.12 or newer.
Full record and what to do →NVD record wordpress.org wpscan.com
Dec 31, 2020The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple RCVE-2020-35935 · WordPress plugins & themes · reported by MITREHigh 7.5
The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)
Product
Advanced Access Manager
Fixed in
6.6.2
What to do
Update Advanced Access Manager to 6.6.2 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Dec 28, 2020the Custom GiftCard Template that can remotely execute arbitrary code: Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file uploadCVE-2020-35627 · WordPress plugins & themes · reported by MITREHigh 8.8
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute arbitrary code. Once it contains the function "Custom Gift Card Template", the function of uploading a custom image is used, changing the name of the image extension to PHP and executing PHP code on the server.
Product
the Custom GiftCard Template that can remotely execute arbitrary code
What to do
Update the Custom GiftCard Template that can remotely execute arbitrary code to the newest version.
Full record and what to do →NVD record gist.github.com makewebbetter.com
Dec 17, 2020The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contaCVE-2020-35489 · WordPress plugins & themes · reported by MITRECritical 10
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
Product
contact-form-7 (aka Contact Form 7)
Fixed in
5.3.2
What to do
Update contact-form-7 (aka Contact Form 7) to 5.3.2 or newer.
Full record and what to do →NVD record contactform7.com wordpress.org
Dec 13, 2020vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control.CVE-2020-35235 · WordPress plugins & themes · reported by MITREHigh 8.8
vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Product
vendor/elfinder/php/connector.minimal.php in the secure-file-manager
Affected
up to 2.5
What to do
Affects up to 2.5. Update vendor/elfinder/php/connector.minimal.php in the secure-file-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Nov 15, 2020The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file.CVE-2020-28649 · WordPress plugins & themes · reported by MITREHigh 8.8
The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file.
Product
orbisius-child-theme-creator
Fixed in
1.5.2
What to do
Update orbisius-child-theme-creator to 1.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordfence.com
Nov 4, 2020Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.CVE-2020-22277 · WordPress plugins & themes · reported by MITREHigh 8
Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
Affected
up to 1.15.5.11
What to do
Affects up to 1.15.5.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.ikiu.ac.ir mega.nz
Nov 2, 2020is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is CVE-2020-28039 · WordPress plugins & themes · reported by MITRECritical 9.1
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
Fixed in
5.5.2
What to do
Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD record github.com lists.debian.org
Sep 9, 2020WordPress File Manager Plugin Remote Code Execution VulnerabilityCVE-2020-25213 · WordPress plugins & themes · reported by MITREExploitedCritical 10
WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Product
File Manager Plugin
Fixed in
6.9
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Sep 3, 2020The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege userCVE-2020-24948 · WordPress plugins & themes · reported by MITREHigh 7.2
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
Fixed in
2.7.7
What to do
Update the plugin to 2.7.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpvulndb.com
Jun 12, 2020In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pageCVE-2020-4047 · WordPress plugins & themes · reported by GitHubMedium 6.8
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Jun 8, 2020The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting sCVE-2020-12800 · WordPress plugins & themes · reported by MITRECritical 9.8
The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.
Product
drag-and-drop-multiple-file-upload-contact-form-7
Fixed in
1.3.3.3
What to do
Update drag-and-drop-multiple-file-upload-contact-form-7 to 1.3.3.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com wordpress.org
May 13, 2020WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly CVE-2020-12832 · WordPress plugins & themes · reported by MITRECritical 9.8
WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
Fixed in
4.2.8
What to do
Update the plugin to 4.2.8 or newer.
Full record and what to do →NVD record ctulhu.me plugins.trac.wordpress.org
Apr 30, 2020In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file.CVE-2020-11026 · WordPress plugins & themes · reported by GitHubHigh 8.7
In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com lists.debian.org
Apr 13, 2020WordPress Snap Creek Duplicator Plugin File Download VulnerabilityCVE-2020-11738 · WordPress plugins & themes · reported by MITREExploitedHigh 7.5
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Product
Snap Creek Duplicator Plugin
Fixed in
1.3.28
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 12, 2020The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.CVE-2020-11732 · WordPress plugins & themes · reported by MITREHigh 7.5
The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.
Product
Media Library Assistant
Fixed in
2.82
What to do
Update Media Library Assistant to 2.82 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Mar 31, 2020LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code executionCVE-2020-6008 · WordPress plugins & themes · reported by cve@checkpoint.comCritical 9.8
LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution
Fixed in
3.37.15
What to do
Update the plugin to 3.37.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.