Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

525new WordPress flaws this week

391,883entries in the database

3,863 results · page 76 of 78

Mar 21, 2022Advanced Booking Calendar: Does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated useCVE-2022-0694 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Product
Advanced Booking Calendar
Fixed in
1.7.0
What to do
Update Advanced Booking Calendar to 1.7.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022CommonsBooking: Does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queriesCVE-2022-0658 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
Product
CommonsBooking
Fixed in
2.6.8
What to do
Update CommonsBooking to 2.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022WP Voting Contest: Does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Product
WP Voting Contest
Fixed in
3.0
What to do
Update WP Voting Contest to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Product
Photo Gallery by 10Web
Fixed in
1.6.0
What to do
Update Photo Gallery by 10Web to 1.6.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloaCVE-2022-23988 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
Fixed in
1.8.176
What to do
Update the plugin to 1.8.176 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).CVE-2021-26256 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 21, 2022WOOCS: Does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the respCVE-2022-0234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Product
WOOCS
Fixed in
1.3.7.5
What to do
Update WOOCS to 1.3.7.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022GiveWP: Does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX actionCVE-2021-25099 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
Product
GiveWP
Fixed in
2.17.3
What to do
Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022SpiderCalendar: Does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0212 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
Product
SpiderCalendar
Affected
up to 1.5.65
What to do
Affects up to 1.5.65. Update SpiderCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Paid Memberships Pro: Does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statementCVE-2021-25114 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
Product
Paid Memberships Pro
Fixed in
2.6.7
What to do
Update Paid Memberships Pro to 2.6.7 or newer.
Full record and what to do →NVD record wpscan.com paidmembershipspro.com
Feb 4, 2022WP HTML Mail: Unauthorized access which allows unauthenticated attackers to retrieve and modify theme settingsCVE-2022-0218 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.
Product
WP HTML Mail
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update WP HTML Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 4, 2022Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid).CVE-2021-44779 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched version available, plugin closed.
Affected
up to 2.3
What to do
Affects up to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 1, 2022The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, respondsCVE-2022-0220 · WordPress plugins & themes · reported by WPScanMedium 6.1
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)
Product
WordPress GDPR
Fixed in
1.9.27
What to do
Update WordPress GDPR to 1.9.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, respondsCVE-2021-24814 · WordPress plugins & themes · reported by WPScanCritical 9.6
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction).
Product
WordPress GDPR
Fixed in
1.9.26
What to do
Update WordPress GDPR to 1.9.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 18, 2022The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability chCVE-2022-0236 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
Affected
up to 3.9.15
What to do
Affects up to 3.9.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 3, 2022Site Reviews: Does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users)CVE-2021-24973 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
Product
Site Reviews
Fixed in
5.17.3
What to do
Update Site Reviews to 5.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to mCVE-2021-24831 · WordPress plugins & themes · reported by WPScanHigh 7.5
All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.
Product
Tab
Fixed in
1.3.2
What to do
Update Tab to 1.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 22, 2021Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).CVE-2021-36885 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
Affected
up to 1.2.6.1
What to do
Affects up to 1.2.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 21, 2021The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not propeCVE-2021-24849 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
Product
WCFM Marketplace
Fixed in
3.4.12
What to do
Update WCFM Marketplace to 3.4.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2021Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPreCVE-2021-36888 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
Affected
up to 9.6.1
What to do
Affects up to 9.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 14, 2021The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid useCVE-2021-4073 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.
Affected
up to 5.0.1.7
What to do
Affects up to 5.0.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-SiCVE-2021-42549 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.15.3
What to do
Update search functionality of to 1.15.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected CCVE-2021-42548 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.15.3
What to do
Update search functionality of to 1.15.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected CrCVE-2021-42547 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.20.3
What to do
Update search functionality of to 1.20.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected CrCVE-2021-42546 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.18.3
What to do
Update search functionality of to 1.18.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in tCVE-2021-24925 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
Modern Events Calendar Lite
Fixed in
6.1.5
What to do
Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021moving the field group which may allow a user to move the unauthorized field group: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20867 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
Product
moving the field group which may allow a user to move the unauthorized field group
What to do
Update moving the field group which may allow a user to move the unauthorized field group to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 13, 2021obtaining the user list which may allow a user to obtain the unauthorized information: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20866 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
Product
obtaining the user list which may allow a user to obtain the unauthorized information
What to do
Update obtaining the user list which may allow a user to obtain the unauthorized information to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 13, 2021browsing database which may allow a user to browse unauthorized data: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20865 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
Product
browsing database which may allow a user to browse unauthorized data
What to do
Update browsing database which may allow a user to browse unauthorized data to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 6, 2021Registrations for the Events Calendar: Does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2021-24943 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
Product
Registrations for the Events Calendar
Fixed in
2.7.6
What to do
Update Registrations for the Events Calendar to 2.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021Secure Copy Content Protection and Content Locking: Does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SCVE-2021-24931 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.
Product
Secure Copy Content Protection and Content Locking
Fixed in
2.8.2
What to do
Update Secure Copy Content Protection and Content Locking to 2.8.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Nov 24, 2021WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user.CVE-2021-36917 · WordPress plugins & themes · reported by PatchstackMedium 6.5
WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.
Affected
up to 6.2.3
What to do
Affects up to 6.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net patchstack.com
Nov 8, 2021Squaretype: Allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpointCVE-2021-24840 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request.
Product
Squaretype
Fixed in
3.0.4
What to do
Update Squaretype to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 5, 2021WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenCVE-2021-42359 · WordPress plugins & themes · reported by WordfenceHigh 7.5
WP DSGVO Tools (GDPR) <= 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete an arbitrary post or page on the site by sending an AJAX request with the “action” parameter set to “admin-dismiss-unsubscribe” and the “id” parameter set to the post to be deleted. Sending such a request would move the post to the trash, and repeating the request would permanently delete the post in question.
Affected
up to 3.1.23
What to do
Affects up to 3.1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Nov 1, 2021OptinMonster: Sensitive information disclosure and unauthorized setting updatesCVE-2021-39341 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The OptinMonster WordPress plugin is vulnerable to sensitive information disclosure and unauthorized setting updates due to insufficient authorization validation via the logged_in_or_has_api_key function in the ~/OMAPI/RestApi.php file that can used to exploit inject malicious web scripts on sites with the plugin installed. This affects versions up to, and including, 2.6.4.
Product
OptinMonster
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2021Stylish Price List: Does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users)CVE-2021-24757 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.
Product
Stylish Price List
Fixed in
6.9.0
What to do
Update Stylish Price List to 6.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 11, 2021Poll Maker: Allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX actionCVE-2021-24651 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash.
Product
Poll Maker
Fixed in
3.4.2
What to do
Update Poll Maker to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021WordPress uListing: Unauthenticated SQL Injection (SQLi)CVE-2021-36880 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom.
Product
WordPress uListing
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update WordPress uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 27, 2021WordPress uListing: Unauthenticated Privilege EscalationCVE-2021-36879 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration.
Product
WordPress uListing
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update WordPress uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 13, 2021Smash Balloon Social Post Feed: Does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of iCVE-2021-24508 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
Product
Smash Balloon Social Post Feed
Fixed in
2.19.2
What to do
Update Smash Balloon Social Post Feed to 2.19.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any securityCVE-2021-24493 · WordPress plugins & themes · reported by WPScanCritical 9.8
The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE
Product
Shopp
Affected
up to 1.4
What to do
Affects up to 1.4. Update Shopp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 2, 2021The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `incluCVE-2021-38314 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Product
Gutenberg Template Library & Redux Framework
Affected
up to 4.2.11
What to do
Affects up to 4.2.11. Update Gutenberg Template Library & Redux Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 9, 2021Astra Pro Addon: Did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated userCVE-2021-24507 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues
Product
Astra Pro Addon
Fixed in
3.5.2
What to do
Update Astra Pro Addon to 3.5.2 or newer.
Full record and what to do →NVD record wpastra.com wpscan.com
Jul 6, 2021The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised usCVE-2021-24384 · WordPress plugins & themes · reported by WPScanCritical 9.8
The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Object Injection issue. Even though the plugin does not have a suitable gadget chain to exploit this, other installed plugins could, which might lead to more severe issues such as RCE
Product
JoomSport
Fixed in
5.1.8
What to do
Update JoomSport to 5.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 21, 2021Fancy Product Designer: Allows unauthenticated attackers to upload arbitrary filesCVE-2021-24370 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
Product
Fancy Product Designer
Fixed in
4.6.9
What to do
Update Fancy Product Designer to 4.6.9 or newer.
Full record and what to do →NVD record lists.openwall.net seclists.org
Jun 14, 2021import_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirectsCVE-2021-24353 · WordPress plugins & themes · reported by WPScanHigh 8.8
The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.
Product
import_data function of the Simple 301 Redirects by BetterLinks
Fixed in
2.0.4
What to do
Update import_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 14, 2021export_data function of the Simple 301 Redirects by BetterLinks: Had no capability or nonce checks making it possible for unauthenticated users to export a site's redirectsCVE-2021-24352 · WordPress plugins & themes · reported by WPScanHigh 8.8
The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects.
Product
export_data function of the Simple 301 Redirects by BetterLinks
Fixed in
2.0.4
What to do
Update export_data function of the Simple 301 Redirects by BetterLinks to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jun 14, 2021Visitors: Is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2021-24350 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.
Product
Visitors
Affected
up to 0.3
What to do
Affects up to 0.3. Update Visitors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability.CVE-2021-24305 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized.
Affected
2.0 to 2.0
What to do
Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com targetfirst.com
May 17, 2021It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress PluCVE-2021-24295 · WordPress plugins & themes · reported by WPScanHigh 7.5
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.
Product
Spam protection, AntiSpam, FireWall by CleanTalk
Fixed in
5.153.4
What to do
Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.153.4 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.