Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

3,863 results · page 75 of 78

Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
Product
Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro
Fixed in
5.12.3
What to do
Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.
Full record and what to do →NVD record wpscan.com pritect.net
Aug 22, 2022Duplicator: Discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the pluginCVE-2022-2551 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
Product
Duplicator
Fixed in
1.4.7
What to do
Update Duplicator to 1.4.7 or newer.
Full record and what to do →NVD record github.com wpscan.com
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated usersCVE-2021-24910 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
Transposh WordPress Translation
Fixed in
1.0.8
What to do
Update Transposh WordPress Translation to 1.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 15, 2022The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unaCVE-2022-2180 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE).
Fixed in
1.2.7
What to do
Update the plugin to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Youzify: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1950 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
Product
Youzify
Fixed in
1.2.0
What to do
Update Youzify to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Copyright Proof: Does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-1906 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
Product
Copyright Proof
Affected
up to 4.16
What to do
Affects up to 4.16. Update Copyright Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.CVE-2022-33965 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.
Affected
up to 5.7
What to do
Affects up to 5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 22, 2022Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.CVE-2022-33901 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.
Affected
up to 4.13.1
What to do
Affects up to 4.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 21, 2022Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.CVE-2022-34487 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 21, 2022Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.CVE-2022-33198 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 18, 2022plugin Wbcom Designs – BuddyPress Group Reviews: Unauthorized settings changes and review modificationCVE-2022-2108 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.
Product
plugin Wbcom Designs – BuddyPress Group Reviews
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update plugin Wbcom Designs – BuddyPress Group Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2022CDI: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1933 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
Product
CDI
Fixed in
5.1.9
What to do
Update CDI to 5.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022Awin Data Feed: Does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
Product
Awin Data Feed
Fixed in
1.8
What to do
Update Awin Data Feed to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022Pricing Deals for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1057 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
Product
Pricing Deals for WooCommerce
Affected
up to 2.0.2.02
What to do
Affects up to 2.0.2.02. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2022Gallery: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1946 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Product
Gallery
Fixed in
2.0.0
What to do
Update Gallery to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenCVE-2022-1916 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Fixed in
1.0.5
What to do
Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to 1.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Pricing Tables: Does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated)CVE-2022-1904 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflected Cross-Site Scripting
Product
Pricing Tables
Fixed in
3.2.1
What to do
Update Pricing Tables to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022ARMember: Is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated usersCVE-2022-1903 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
Product
ARMember
Fixed in
3.4.8
What to do
Update ARMember to 3.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 20, 2022Events Made Easy: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1905 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
Events Made Easy
Fixed in
2.2.81
What to do
Update Events Made Easy to 2.2.81 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 15, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress.CVE-2021-36901 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress.
Affected
up to 2.17.0
What to do
Affects up to 2.17.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 13, 2022RSVPMaker: Unauthenticated SQL InjectionCVE-2022-1768 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.
Product
RSVPMaker
Affected
up to 9.3.2
What to do
Affects up to 9.3.2. Update RSVPMaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
Product
Nirweb support
Fixed in
2.8.2
What to do
Update Nirweb support to 2.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 10, 2022RSVPMaker: Unauthenticated SQL InjectionCVE-2022-1505 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.6.
Product
RSVPMaker
Affected
up to 9.2.6
What to do
Affects up to 9.2.6. Update RSVPMaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 10, 2022RSVPMaker: Unauthenticated SQL InjectionCVE-2022-1453 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
Product
RSVPMaker
Affected
up to 9.2.5
What to do
Affects up to 9.2.5. Update RSVPMaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 9, 2022Order Listener for WooCommerce: Does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated usersCVE-2022-0948 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection
Product
Order Listener for WooCommerce
Fixed in
3.2.2
What to do
Update Order Listener for WooCommerce to 3.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
May 2, 2022Multiple Shipping Address Woocommerce: Does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated usersCVE-2022-0783 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
Product
Multiple Shipping Address Woocommerce
Fixed in
2.0
What to do
Update Multiple Shipping Address Woocommerce to 2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 28, 2022Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress.CVE-2022-29415 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress.
Affected
up to 2.16
What to do
Affects up to 2.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 26, 2022Tripetto's Tripetto plugin <= 5.1.4 on: Unauthenticated Cross-Site Scripting (XSS)CVE-2021-36895 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload.
Product
Tripetto's Tripetto plugin <= 5.1.4 on
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update Tripetto's Tripetto plugin <= 5.1.4 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022Donations: Does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated usersCVE-2022-0782 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Product
Donations
Affected
up to 1.8
What to do
Affects up to 1.8. Update Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Users Ultra: Fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and auCVE-2022-0769 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.
Product
Users Ultra
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update Users Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Master Elements: Does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2022-0693 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection
Product
Master Elements
Affected
up to 8.0
What to do
Affects up to 8.0. Update Master Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Web To Print Shop : uDraw: Does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function CVE-2022-0656 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
Product
Web To Print Shop : uDraw
Fixed in
3.3.3
What to do
Update Web To Print Shop : uDraw to 3.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 19, 2022Elementor Website Builder: Unauthorized execution of several AJAX actionsCVE-2022-1329 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
Product
Elementor Website Builder
Affected
3.6.0 to 3.6.2
What to do
Affects 3.6.0 to 3.6.2. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Apr 19, 2022The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API routeCVE-2022-1186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0993 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
Product
SiteGround Security
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0992 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
Product
SiteGround Security
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 18, 2022Product Table for WooCommerce (wooproducttable): Does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
Product
Product Table for WooCommerce (wooproducttable)
Fixed in
3.1.2
What to do
Update Product Table for WooCommerce (wooproducttable) to 3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 18, 2022Daily Prayer Time: Does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users)CVE-2022-0785 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
Product
Daily Prayer Time
Fixed in
2022.03.01
What to do
Update Daily Prayer Time to 2022.03.01 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2022Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions.CVE-2022-27852 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions.
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 11, 2022The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated userCVE-2022-0919 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.
Fixed in
7.6.3
What to do
Update the plugin to 7.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Social Share, Social Login and Social Comments: Does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it CVE-2021-24987 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.30
What to do
Update Social Share, Social Login and Social Comments to 7.13.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters.CVE-2022-1167 · WordPress plugins & themes · reported by WPScanMedium 6.1
There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters.
Fixed in
2.3.1
What to do
Update the plugin to 2.3.1 or newer.
Full record and what to do →NVD record m0ze.ru themeforest.net
Mar 28, 2022Limit Login Attempts (Spam Protection): Does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users)CVE-2022-0787 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections
Product
Limit Login Attempts (Spam Protection)
Fixed in
5.1
What to do
Update Limit Login Attempts (Spam Protection) to 5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Title Experiments Free: Does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users)CVE-2022-0784 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
Product
Title Experiments Free
Fixed in
9.0.1
What to do
Update Title Experiments Free to 9.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Plezi: Has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable optionCVE-2022-0680 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue
Product
Plezi
Fixed in
1.0.3
What to do
Update Plezi to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Narnoo Distributor: Fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticatCVE-2022-0679 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.
Product
Narnoo Distributor
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Narnoo Distributor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2022Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code.CVE-2022-25610 · WordPress plugins & themes · reported by PatchstackLow 3.4
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.
Affected
up to 20220115
What to do
Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 21, 2022Simple Link Directory: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0760 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Product
Simple Link Directory
Fixed in
7.7.2
What to do
Update Simple Link Directory to 7.7.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022Infographic Maker: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0747 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Product
Infographic Maker
Fixed in
4.3.8
What to do
Update Infographic Maker to 4.3.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Product
BookingPress
Fixed in
1.0.11
What to do
Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.