Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

416 results · page 8 of 9

Jan 24, 2022WP User Frontend: Does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboardCVE-2021-25076 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
Product
WP User Frontend
Fixed in
3.5.26
What to do
Update WP User Frontend to 3.5.26 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Jan 24, 2022myCred: Does not sanitise and escape the search query before outputting it back in the history dashboard pageCVE-2021-25015 · WordPress plugins & themes · reported by WPScanMedium 6.1
The myCred WordPress plugin before 2.4 does not sanitise and escape the search query before outputting it back in the history dashboard page, leading to a Reflected Cross-Site Scripting issue
Product
myCred
Fixed in
2.4
What to do
Update myCred to 2.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022PowerPack Addons for Elementor: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-25027 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
PowerPack Addons for Elementor
Fixed in
2.6.2
What to do
Update PowerPack Addons for Elementor to 2.6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboardCVE-2021-25001 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue
Product
Booster for WooCommerce
Fixed in
5.4.9
What to do
Update Booster for WooCommerce to 5.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboardCVE-2021-25000 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue
Product
Booster for WooCommerce
Fixed in
5.4.9
What to do
Update Booster for WooCommerce to 5.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboardCVE-2021-24999 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting
Product
Booster for WooCommerce
Fixed in
5.4.9
What to do
Update Booster for WooCommerce to 5.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021WP RSS Aggregator: Does not sanitise and escape data before outputting it in the System Info admin dashboardCVE-2021-24988 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.
Product
WP RSS Aggregator
Fixed in
4.19.3
What to do
Update WP RSS Aggregator to 4.19.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021WPFront User Role Editor: Does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboardCVE-2021-24984 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
Product
WPFront User Role Editor
Fixed in
3.2.1.11184
What to do
Update WPFront User Role Editor to 3.2.1.11184 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
Product
Tickera
Fixed in
3.4.8.3
What to do
Update Tickera to 3.4.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021All-in-One Video Gallery: Does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboardCVE-2021-24970 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue
Product
All-in-One Video Gallery
Fixed in
2.5.0
What to do
Update All-in-One Video Gallery to 2.5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard pageCVE-2021-24954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
Product
User Registration, Login Form, User Profile & Membership
Fixed in
3.2.3
What to do
Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 29, 2021myCred: Does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboardCVE-2017-20008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting
Product
myCred
Fixed in
1.7.8
What to do
Update myCred to 1.7.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
Product
My Tickets
Fixed in
1.8.31
What to do
Update My Tickets to 1.8.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 17, 2021Stream: Does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statementCVE-2021-24772 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue.
Product
Stream
Fixed in
3.8.2
What to do
Update Stream to 3.8.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Affiliates Manager: Does not validate the orderby parameter before using it in an SQL statement in the admin dashboardCVE-2021-24844 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue
Product
Affiliates Manager
Fixed in
2.8.7
What to do
Update Affiliates Manager to 2.8.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Support Board: Allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes fieldCVE-2021-24807 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
Product
Support Board
Fixed in
3.3.5
What to do
Update Support Board to 3.3.5 or newer.
Full record and what to do →NVD record github.com medium.com
Nov 8, 2021Schreikasten: Does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actionsCVE-2021-24630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
Product
Schreikasten
Affected
up to 0.14.18
What to do
Affects up to 0.14.18. Update Schreikasten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 8, 2021Post Content XMLRPC: Does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboardCVE-2021-24629 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
Product
Post Content XMLRPC
Affected
up to 1.0
What to do
Affects up to 1.0. Update Post Content XMLRPC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Nov 8, 2021SpiderCatalog: Does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statementCVE-2021-24625 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category
Product
SpiderCatalog
Affected
up to 1.7.3
What to do
Affects up to 1.7.3. Update SpiderCatalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Oct 26, 2021A vulnerability was found in Mangboard(WordPress plugin).CVE-2021-26609 · WordPress plugins & themes · reported by vuln@krcert.or.krHigh 7.5
A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type parameter makes a SQL query using unfiltered data. This vulnerability allows a remote attacker to steal user information.
Fixed in
2.0.0
What to do
Update the plugin to 2.0.0 or newer.
Full record and what to do →NVD record boho.or.kr boho.or.kr
Oct 21, 2021Simple Job Board: Stored Cross-Site ScriptingCVE-2021-39328 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Simple Job Board
Affected
up to 2.9.4
What to do
Affects up to 2.9.4. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 19, 2021JobBoardWP: Stored Cross-Site ScriptingCVE-2021-39329 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-metabox.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
JobBoardWP
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update JobBoardWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 18, 2021MainWP Child Reports: Does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboardCVE-2021-24754 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue
Product
MainWP Child Reports
Fixed in
2.0.8
What to do
Update MainWP Child Reports to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Sociable: Does not sanitise or escape some of its settings before outputting them in the admins dashboardCVE-2021-24612 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed
Product
Sociable
Affected
up to 4.3.4.1
What to do
Affects up to 4.3.4.1. Update Sociable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 15, 2021Job Board Vanila: Stored Cross-Site ScriptingCVE-2021-39334 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjb_exp_in and the psjb_curr_in parameters found in the ~/job-settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Job Board Vanila
Affected
up to 1.0
What to do
Affects up to 1.0. Update Job Board Vanila to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Sep 27, 2021Recipe Card Blocks by WPZOOM: Does not escape the message parameter before outputting it back in the admin dashboardCVE-2021-24632 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Recipe Card Blocks by WPZOOM
Fixed in
2.8.1
What to do
Update Recipe Card Blocks by WPZOOM to 2.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Support Board: Does not escape multiple POST parameters (suchCVE-2021-24741 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, department, user_id, conversation_id, conversation_status_code, and recipient_id) before using them in SQL statements, leading to SQL injections which are exploitable by unauthenticated users.
Product
Support Board
Fixed in
3.3.4
What to do
Update Support Board to 3.3.4 or newer.
Full record and what to do →NVD record board.support medium.com
Sep 20, 2021Splash Header: Doesn't sanitise and escape some of its settings while outputting them in the admin dashboardCVE-2021-24587 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Splash Header WordPress plugin before 1.20.8 doesn't sanitise and escape some of its settings while outputting them in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue.
Product
Splash Header
Fixed in
1.20.8
What to do
Update Splash Header to 1.20.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021options.php file of the WP-Board: Beta accepts a postid parameterCVE-2021-24404 · WordPress plugins & themes · reported by WPScanHigh 8.8
The options.php file of the WP-Board WordPress plugin through 1.1 beta accepts a postid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. This is a time based SQLI and in the same function vulnerable parameter is passed twice so if we pass time as 5 seconds it takes 10 seconds to return since the query ran twice.
Product
options.php file of the WP-Board
Affected
up to 1.1
What to do
Affects up to 1.1. Update options.php file of the WP-Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Sep 13, 2021StopBadBots: Did not validate or escape the order and orderby GET parameter in some of its admin dashboard pagesCVE-2021-24727 · WordPress plugins & themes · reported by WPScanHigh 8.8
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
Product
StopBadBots
Fixed in
6.60
What to do
Update StopBadBots to 6.60 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Sep 13, 2021Software License Manager: Does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboardCVE-2021-24560 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Software License Manager
Fixed in
4.4.8
What to do
Update Software License Manager to 4.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021MF Gig Calendar: Does not sanitise and escape the id GET parameter before outputting back in the admin dashboardCVE-2021-24510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
Product
MF Gig Calendar
Fixed in
1.2
What to do
Update MF Gig Calendar to 1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021Side Menu Lite: Does not sanitise user input from the List page in the admin dashboard before using it in SQL statementCVE-2021-24580 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue
Product
Side Menu Lite
Fixed in
2.2.6
What to do
Update Side Menu Lite to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2021ShareThis Dashboard for Google Analytics: Does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attributeCVE-2021-24438 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'ga_action' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
Product
ShareThis Dashboard for Google Analytics
Fixed in
2.5.2
What to do
Update ShareThis Dashboard for Google Analytics to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021Erident Custom Login and Dashboard: Did not properly sanitise its settingsCVE-2021-24658 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings, allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)
Product
Erident Custom Login and Dashboard
Fixed in
3.5.9
What to do
Update Erident Custom Login and Dashboard to 3.5.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Aug 2, 2021RSS for Yandex Turbo: Does not sanitise or escape some of its settings before saving and outputing them in the admin dashboardCVE-2021-24428 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard, leading to an Authenticated Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed.
Product
RSS for Yandex Turbo
Affected
up to 1.30
What to do
Affects up to 1.30. Update RSS for Yandex Turbo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record m0ze.ru wpscan.com
Jul 19, 2021W3 Total Cache: Was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboardCVE-2021-24452 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Product
W3 Total Cache
Fixed in
2.1.5
What to do
Update W3 Total Cache to 2.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 19, 2021W3 Total Cache: Was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboardCVE-2021-24436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Product
W3 Total Cache
Fixed in
2.1.4
What to do
Update W3 Total Cache to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 6, 2021WP Offload SES Lite: Did not escape some of the fields in the Activity page of the admin dashboardCVE-2021-24494 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for example. The XSS will be executed in the context of a logged in admin viewing the Activity tab of the plugin.
Product
WP Offload SES Lite
Fixed in
1.4.5
What to do
Update WP Offload SES Lite to 1.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 24, 2021dsgvoaio_write_log AJAX action of the DSGVO All in one for WP: Did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/adminCVE-2021-24294 · WordPress plugins & themes · reported by WPScanMedium 6.1
The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-show-log). This could allow unauthenticated attackers to gain unauthorised access by using an XSS payload to create a rogue administrator account, which will be trigged when an administrator will view the logs.
Product
dsgvoaio_write_log AJAX action of the DSGVO All in one for WP
Fixed in
4.0
What to do
Update dsgvoaio_write_log AJAX action of the DSGVO All in one for WP to 4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2021When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high CVE-2021-24323 · WordPress plugins & themes · reported by WPScanMedium 4.8
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
Fixed in
5.2.0
What to do
Update the plugin to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Contact Form Check Tester: Settings are visible to all registered users in the dashboard and are lacking any sanitisationCVE-2021-24247 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
Product
Contact Form Check Tester
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Contact Form Check Tester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low prCVE-2021-24244 · WordPress plugins & themes · reported by WPScanMedium 6.5
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).
Fixed in
4.5.8
What to do
Update the plugin to 4.5.8 or newer.
Full record and what to do →NVD record codecanyon.net wpscan.com
May 6, 2021An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitizationCVE-2021-24243 · WordPress plugins & themes · reported by WPScanMedium 5.4
An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization, allowing low privilege users (subscriber+) to call it and set XSS payloads, which will be triggered in all backend pages.
Fixed in
4.5.6
What to do
Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD record codecanyon.net wpscan.com
Jan 15, 2021Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows reCVE-2020-35749 · WordPress plugins & themes · reported by MITREHigh 7.7
Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php.
Product
Simple Board Job
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Simple Board Job to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Aug 31, 2020The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.CVE-2020-24699 · WordPress plugins & themes · reported by MITREMedium 6.1
The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.
Affected
3.2.8 to 3.2.8
What to do
Affects 3.2.8 to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record l0l.xyz wordpress.org
Jun 15, 2020The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.CVE-2019-19112 · WordPress plugins & themes · reported by MITREMedium 6.1
The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.
Affected
1.6.5 to 1.6.5
What to do
Affects 1.6.5 to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record twitter.com twitter.com
Mar 17, 2020The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.CVE-2018-18576 · WordPress plugins & themes · reported by MITREMedium 5.3
The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.
Product
Hustle (aka wordpress-popup)
Affected
up to 6.0.5
What to do
Affects up to 6.0.5. Update Hustle (aka wordpress-popup) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record pastebin.com wordpress.org
Feb 26, 2020The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufCVE-2019-19134 · WordPress plugins & themes · reported by MITREMedium 6.1
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record heroplugins.com heroplugins.com
Feb 25, 2020The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.CVE-2020-9019 · WordPress plugins & themes · reported by MITREMedium 6.1
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
Affected
5.5.3 to 5.5.3
What to do
Affects 5.5.3 to 5.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cert.ikiu.ac.ir uploadboy.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.