Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,905 results · page 72 of 79
Mar 23, 2022Ninja Forms - File Uploads Extension: Arbitrary file uploadsCVE-2022-0888 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0
- Product
- Ninja Forms - File Uploads Extension
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Ninja Forms - File Uploads Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comwordfence.com
Mar 21, 2022FormCraft: Does not validate the URL parameter in the formcraft3_get AJAX actionCVE-2022-0591 · WordPress plugins & themes · reported by WPScanCritical 9.1
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
- Product
- FormCraft
- Fixed in
- 3.8.28
- What to do
- Update FormCraft to 3.8.28 or newer.
Mar 21, 2022Advanced Contact form 7 DB: Does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX actionCVE-2021-24905 · WordPress plugins & themes · reported by WPScanHigh 8
The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.
- Product
- Advanced Contact form 7 DB
- Fixed in
- 1.8.7
- What to do
- Update Advanced Contact form 7 DB to 1.8.7 or newer.
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
- Product
- Contact Form Submissions
- Fixed in
- 1.7.3
- What to do
- Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Cookie Information | Free GDPR Consent Solution
- Fixed in
- 2.0.8
- What to do
- Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leadingCVE-2021-24996 · WordPress plugins & themes · reported by WPScanMedium 6.1
The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting
- Product
- IDPay for Contact Form 7
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update IDPay for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2022Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).CVE-2022-25601 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Reflected Cross-Site Scripting (XSS) vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin (versions <= 2.4).
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Mar 7, 2022Ditty (formerly Ditty News Ticker): Is affected by a Reflected Cross-Site Scripting (XSS) vulnerabilityCVE-2022-0533 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
- Product
- Ditty (formerly Ditty News Ticker)
- Fixed in
- 3.0.15
- What to do
- Update Ditty (formerly Ditty News Ticker) to 3.0.15 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022RegistrationMagic: Does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboardCVE-2022-0420 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
- Product
- RegistrationMagic
- Fixed in
- 5.0.2.2
- What to do
- Update RegistrationMagic to 5.0.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022WP Time Slots Booking Form: Does not sanitise and escape Calendar namesCVE-2022-0389 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Time Slots Booking Form
- Fixed in
- 1.1.63
- What to do
- Update WP Time Slots Booking Form to 1.1.63 or newer.
Mar 7, 2022Smart Forms: Does not have authorisation in its rednao_smart_forms_entries_list AJAX actionCVE-2022-0163 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form.
- Product
- Smart Forms
- Fixed in
- 2.6.71
- What to do
- Update Smart Forms to 2.6.71 or newer.
Mar 7, 2022view submission functionality in the Hotscot Contact Form: Makes a get request with the sub_id parameterCVE-2021-24777 · WordPress plugins & themes · reported by WPScanHigh 7.2
The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter which not sanitised, escaped or validated before inserting to a SQL statement, leading to an SQL injection.
- Product
- view submission functionality in the Hotscot Contact Form
- Fixed in
- 1.3
- What to do
- Update view submission functionality in the Hotscot Contact Form to 1.3 or newer.
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloaCVE-2022-23988 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
- Fixed in
- 1.8.176
- What to do
- Update the plugin to 1.8.176 or newer.
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-SiCVE-2022-23987 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Fixed in
- 1.8.176
- What to do
- Update the plugin to 1.8.176 or newer.
Feb 28, 2022In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unCVE-2021-24704 · WordPress plugins & themes · reported by WPScanHigh 8.8
In the Orange Form WordPress plugin through 1.0, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example
- Product
- Orange Form
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server CVE-2021-24689 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack
- Product
- Contact Forms - Drag & Drop Contact Form Builder
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Contact Forms - Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 28, 2022Orange Form: Does not have any authorisation and CSRF checks in all of its AJAX callsCVE-2021-24688 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)
- Product
- Orange Form
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Orange Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.6.1
- What to do
- Affects up to 3.6.1. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2022Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).CVE-2022-23984 · WordPress plugins & themes · reported by PatchstackLow 3.7
Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).
- Affected
- up to 7.3.11
- What to do
- Affects up to 7.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022GiveWP: Does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX actionCVE-2021-25099 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Five Star Business Profile and Schema: Does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX actionCVE-2021-25060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues
- Product
- Five Star Business Profile and Schema
- Fixed in
- 2.1.7
- What to do
- Update Five Star Business Profile and Schema to 2.1.7 or newer.
Feb 18, 2022The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.CVE-2022-23982 · WordPress plugins & themes · reported by PatchstackMedium 4.3
The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Feb 14, 2022Form Store to DB: Does not sanitise and escape parameter keys before outputting it back in the created entryCVE-2021-25107 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
- Product
- Form Store to DB
- Fixed in
- 1.1.1
- What to do
- Update Form Store to DB to 1.1.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the lang and pid parameter before outputting them back in attributesCVE-2021-24874 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.31
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.31 or newer.
Feb 7, 2022All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs: Was vulnerable to reflected XSS on the my-sticky-elements-leads admin pageCVE-2022-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
- Product
- All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs
- Fixed in
- 2.0.4
- What to do
- Update All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs to 2.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Ivory Search: Does not escape some of the Form settingsCVE-2021-25105 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ivory Search
- Fixed in
- 5.4.1
- What to do
- Update Ivory Search to 5.4.1 or newer.
Feb 7, 2022CLUEVO LMS, E-Learning Platform: Does not sanitise and escape Course's moduleCVE-2021-25029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- CLUEVO LMS, E-Learning Platform
- Fixed in
- 1.8.1
- What to do
- Update CLUEVO LMS, E-Learning Platform to 1.8.1 or newer.
Feb 1, 2022Skins for Contact Form 7: Does not sanitise and escape the tab parameter before outputting it back in an admin pageCVE-2021-25063 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Skins for Contact Form 7
- Fixed in
- 2.5.1
- What to do
- Update Skins for Contact Form 7 to 2.5.1 or newer.
Feb 1, 2022Error Log Viewer: Does not perform nonce checkCVE-2021-24761 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server.
- Product
- Error Log Viewer
- Fixed in
- 1.1.2
- What to do
- Update Error Log Viewer to 1.1.2 or newer.
Jan 24, 2022Contact Form Entries: Does not validateCVE-2021-25080 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry
- Product
- Contact Form Entries
- Fixed in
- 1.1.7
- What to do
- Update Contact Form Entries to 1.1.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Contact Form Entries: Does not sanitise and escape various parametersCVE-2021-25079 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
- Product
- Contact Form Entries
- Fixed in
- 1.2.4
- What to do
- Update Contact Form Entries to 1.2.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Easy Forms for Mailchimp: Does not sanitise and escape the field_name and field_type parameters before outputting them back in attributesCVE-2021-24985 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.6
- What to do
- Update Easy Forms for Mailchimp to 6.8.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the sib-statistics-date parameter before outputting it back in an attributeCVE-2021-24923 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.25
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.25 or newer.
Jan 17, 2022SEUR Oficial: Does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-25005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- SEUR Oficial
- Fixed in
- 1.7.0
- What to do
- Update SEUR Oficial to 1.7.0 or newer.
Dec 27, 2021Contact Form & Lead Form Elementor Builder: Does not sanitise and escape some lead valuesCVE-2021-24967 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
- Product
- Contact Form & Lead Form Elementor Builder
- Fixed in
- 1.6.4
- What to do
- Update Contact Form & Lead Form Elementor Builder to 1.6.4 or newer.
Dec 27, 2021Typebot | Build beautiful conversational forms: Does not sanitise and escape the Publish ID settingCVE-2021-24902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Typebot | Build beautiful conversational forms
- Fixed in
- 1.4.3
- What to do
- Update Typebot | Build beautiful conversational forms to 1.4.3 or newer.
Dec 22, 2021Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).CVE-2021-36886 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).
- Affected
- up to 1.2.5.9
- What to do
- Affects up to 1.2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 22, 2021Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).CVE-2021-36885 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
- Affected
- up to 1.2.6.1
- What to do
- Affects up to 1.2.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Dec 21, 2021Contact Form, Drag and Drop Form Builder for: Does not escape the status parameter before outputting it back in an attributeCVE-2021-24907 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- Contact Form, Drag and Drop Form Builder for
- Fixed in
- 1.8.0
- What to do
- Update Contact Form, Drag and Drop Form Builder for to 1.8.0 or newer.
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- User Registration, Login Form, User Profile & Membership
- Fixed in
- 3.2.3
- What to do
- Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
- Product
- User Registration, Login Form, User Profile & Membership
- Fixed in
- 3.2.3
- What to do
- Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 13, 2021Caldera Forms: Does not sanitise and escape the Form Name before outputting it in attributesCVE-2021-24896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Caldera Forms
- Fixed in
- 1.9.5
- What to do
- Update Caldera Forms to 1.9.5 or newer.
Dec 13, 2021Contact Form Advanced Database: Does not have any authorisationCVE-2021-24790 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.
- Product
- Contact Form Advanced Database
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Contact Form Advanced Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021NEX-Forms: Does not have CSRF checks in placeCVE-2021-24705 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit arbitrary forms with Cross-Site Scripting payloads in them
- Product
- NEX-Forms
- Fixed in
- 8.4.3
- What to do
- Update NEX-Forms to 8.4.3 or newer.
Dec 13, 2021obtaining the user list which may allow a user to obtain the unauthorized information: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20866 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
- Product
- obtaining the user list which may allow a user to obtain the unauthorized information
- What to do
- Update obtaining the user list which may allow a user to obtain the unauthorized information to the newest version.
Dec 6, 2021LoginWP (Formerly Peter's Login Redirect): Does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin pageCVE-2021-24939 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- LoginWP (Formerly Peter's Login Redirect)
- Fixed in
- 3.0.0.5
- What to do
- Update LoginWP (Formerly Peter's Login Redirect) to 3.0.0.5 or newer.
Dec 6, 2021Contact Form, Survey & Popup Form Plugin for: Does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-24718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Contact Form, Survey & Popup Form Plugin for
- Fixed in
- 1.5
- What to do
- Update Contact Form, Survey & Popup Form Plugin for to 1.5 or newer.
Nov 29, 2021Contact Form With Captcha: Cross-Site Request ForgeryCVE-2021-42358 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2.
- Product
- Contact Form With Captcha
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Contact Form With Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.4
- What to do
- Update Ninja Forms Contact Form to 3.6.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.