Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
521 results · page 8 of 11
Jan 30, 2023Custom User Profile Fields for User Registration: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4831 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Custom User Profile Fields for User Registration
- Fixed in
- 1.8.1
- What to do
- Update Custom User Profile Fields for User Registration to 1.8.1 or newer.
Jan 30, 2023Panda Pods Repeater Field: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.
- Product
- Panda Pods Repeater Field
- Fixed in
- 1.5.4
- What to do
- Update Panda Pods Repeater Field to 1.5.4 or newer.
Jan 16, 2023Custom Post Types and Custom Fields creator: Does not sanitize and escape some of its settingsCVE-2022-4442 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Custom Post Types and Custom Fields creator
- Fixed in
- 2.3.3
- What to do
- Update Custom Post Types and Custom Fields creator to 2.3.3 or newer.
Jan 9, 2023Multi Step Form: Does not sanitise and escape some of its form fieldsCVE-2022-4196 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Multi Step Form
- Fixed in
- 1.7.8
- What to do
- Update Multi Step Form to 1.7.8 or newer.
Jan 2, 2023Custom Field Template: Unserialises the content of an imported fileCVE-2022-4324 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.
- Product
- Custom Field Template
- Fixed in
- 2.5.8
- What to do
- Update Custom Field Template to 2.5.8 or newer.
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4165 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-loginCVE-2022-4158 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4150 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 12, 2022WP CSV Exporter: Does not properly escape the fieldsCVE-2022-3605 · WordPress plugins & themes · reported by WPScanHigh 7.8
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability.
- Product
- WP CSV Exporter
- Fixed in
- 1.3.7
- What to do
- Update WP CSV Exporter to 1.3.7 or newer.
Nov 28, 2022Checkout Field Editor (Checkout Manager) for WooCommerce: Unserializes user input provided via the settingsCVE-2022-3490 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Checkout Field Editor (Checkout Manager) for WooCommerce
- Fixed in
- 1.8.0
- What to do
- Update Checkout Field Editor (Checkout Manager) for WooCommerce to 1.8.0 or newer.
Nov 7, 2022Contact Form: Does not validate and escape fieldsCVE-2022-3463 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
- Product
- Contact Form
- Fixed in
- 4.3.13
- What to do
- Update Contact Form to 4.3.13 or newer.
Oct 25, 2022Post to CSV by BestWebSoft: Does not properly escape fieldsCVE-2022-3393 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection
- Product
- Post to CSV by BestWebSoft
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Post to CSV by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2022Mobile Events Manager: Does not properly escape the Enquiry source fieldCVE-2022-1194 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
- Product
- Mobile Events Manager
- Fixed in
- 1.4.8
- What to do
- Update Mobile Events Manager to 1.4.8 or newer.
Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
- Product
- Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro
- Fixed in
- 5.12.3
- What to do
- Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.
Aug 8, 2022WordPress Comments Fields: Does not escape Field Error MessageCVE-2022-2398 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WordPress Comments Fields
- Fixed in
- 4.1
- What to do
- Update WordPress Comments Fields to 4.1 or newer.
Jul 25, 2022W-DALIL: Does not sanitise and escape some of its fieldsCVE-2022-2340 · WordPress plugins & themes · reported by WPScanMedium 4.8
The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- W-DALIL
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update W-DALIL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2022404s: Does not sanitise and escape its fieldsCVE-2022-2118 · WordPress plugins & themes · reported by WPScanMedium 4.8
The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- 404s
- Fixed in
- 3.5.1
- What to do
- Update 404s to 3.5.1 or newer.
Jul 4, 2022Ninja Forms Contact Form: Does not sanitise and escape field labelsCVE-2021-25056 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.10
- What to do
- Update Ninja Forms Contact Form to 3.6.10 or newer.
Jun 27, 2022Image Gallery: Does not sanitize and escape some of its Image fieldsCVE-2022-1327 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Image Gallery
- Fixed in
- 1.1.6
- What to do
- Update Image Gallery to 1.1.6 or newer.
Jun 27, 2022Form - Contact Form: Does not sanitize and escape Custom text fieldsCVE-2022-1326 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Form - Contact Form
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Form - Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Appointment Hour Booking: Does not sanitise and escape a settings of its Calendar fieldsCVE-2022-1710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.56
- What to do
- Update Appointment Hour Booking to 1.3.56 or newer.
Jun 13, 2022WP-CRM: Does not validate and sanitise fieldsCVE-2022-1202 · WordPress plugins & themes · reported by WPScanHigh 7.8
The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
- Product
- WP-CRM
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update WP-CRM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022FormCraft: Does not sanitise and escape Field LabelsCVE-2022-1647 · WordPress plugins & themes · reported by WPScanMedium 4.8
The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- FormCraft
- Fixed in
- 1.2.6
- What to do
- Update FormCraft to 1.2.6 or newer.
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
Jun 8, 2022WP Born Babies: Does not sanitise and escape some of its fieldsCVE-2022-1506 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WP Born Babies
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Born Babies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Ask me: Does not properly sanitise and escape several of the fields in the Edit Profile pageCVE-2022-1241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues
- Product
- Ask me
- Fixed in
- 6.8.2
- What to do
- Update Ask me to 6.8.2 or newer.
May 30, 2022Birthdays Widget: Does not sanitise and escape some of its fieldsCVE-2022-1643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Birthdays Widget
- Affected
- up to 1.7.18
- What to do
- Affects up to 1.7.18. Update Birthdays Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022WP Subtitle: Adds a subtitle field and provides a shortcode to display it via [wp_subtitle]CVE-2022-1393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via [wp_subtitle]. The subtitle is stored as a custom post meta with the key: "wps_subtitle", which is sanitized upon post save/update, however is not sanitized when updating it directly from the post meta update button (via AJAX) - and this makes the XSS exploitable by authenticated users with a role as low as contributor.
- Product
- WP Subtitle
- Fixed in
- 3.4.1
- What to do
- Update WP Subtitle to 3.4.1 or newer.
May 9, 2022IgniteUp: Does not sanitise and escape some fieldsCVE-2022-0898 · WordPress plugins & themes · reported by WPScanMedium 5.4
The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues
- Product
- IgniteUp
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update IgniteUp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2022Visual Form Builder: Does not sanitise and escape the form's 'Email to' fieldCVE-2022-1046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Visual Form Builder
- Fixed in
- 3.0.7
- What to do
- Update Visual Form Builder to 3.0.7 or newer.
Apr 25, 2022Donations: Does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated usersCVE-2022-0782 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- Donations
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Thank Me Later: Does not sanitise and escape the Message Subject field before outputting it in the Messages listCVE-2022-1063 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Thank Me Later
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Thank Me Later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 11, 2022Easy Social Icons: Does not properly escape the image_file fieldCVE-2022-0840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
- Product
- Easy Social Icons
- Fixed in
- 3.2.1
- What to do
- Update Easy Social Icons to 3.2.1 or newer.
Apr 4, 2022Profile Builder: Does not sanitise and escape Form Fields titles and descriptionCVE-2022-0884 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Profile Builder
- Fixed in
- 3.6.8
- What to do
- Update Profile Builder to 3.6.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 31, 2022Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1: Missing authorizationCVE-2022-23183 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
- Product
- Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1
- What to do
- Update Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 to the newest version.
Mar 28, 2022Interactive Medical Drawing of Human Body: Does not sanitise and escape the Link fieldCVE-2022-0388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Interactive Medical Drawing of Human Body
- Fixed in
- 2.6
- What to do
- Update Interactive Medical Drawing of Human Body to 2.6 or newer.
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
- Product
- Contact Form Submissions
- Fixed in
- 1.7.3
- What to do
- Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Patreon: Does not sanitise and escape the field "Custom Patreon Page name"CVE-2021-25026 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Patreon
- Fixed in
- 1.8.2
- What to do
- Update Patreon to 1.8.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Add Subtitle: Does not sanitise or escape the sub-title field (available only with classic editor)CVE-2021-24897 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Add Subtitle
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Add Subtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2022Custom Content Shortcode: Does not escape custom fields before outputting themCVE-2021-24826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)
- Product
- Custom Content Shortcode
- Fixed in
- 4.0.2
- What to do
- Update Custom Content Shortcode to 4.0.2 or newer.
Mar 7, 2022The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, toCVE-2021-24824 · WordPress plugins & themes · reported by WPScanMedium 4.3
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
- Product
- [field] shortcode included with the Custom Content Shortcode
- Fixed in
- 4.0.1
- What to do
- Update [field] shortcode included with the Custom Content Shortcode to 4.0.1 or newer.
Mar 7, 2022WP Event Manager: Does not escape some of its Field Editor settingsCVE-2021-24810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- WP Event Manager
- Fixed in
- 3.1.23
- What to do
- Update WP Event Manager to 3.1.23 or newer.
Feb 28, 2022EditableTable: Does not sanitise and escape any of the Table and Column fieldsCVE-2021-24898 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- EditableTable
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update EditableTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Shield Security: Does not sanitise and escape admin notesCVE-2022-0211 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Shield Security
- Fixed in
- 13.0.6
- What to do
- Update Shield Security to 13.0.6 or newer.
Feb 21, 2022Image Photo Gallery Final Tiles Grid: Does not sanitise and escape the Description fieldCVE-2022-0186 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.5.3
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.5.3 or newer.
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
- Product
- Buffer Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
- Product
- Translation Exchange
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 1, 2022Ninja Tables: Does not sanitise and escape some of its table fieldsCVE-2021-24900 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Ninja Tables
- Fixed in
- 4.1.8
- What to do
- Update Ninja Tables to 4.1.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jan 24, 2022Easy Forms for Mailchimp: Does not sanitise and escape the field_name and field_type parameters before outputting them back in attributesCVE-2021-24985 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.6 does not sanitise and escape the field_name and field_type parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.6
- What to do
- Update Easy Forms for Mailchimp to 6.8.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Advanced Custom Fields: Extended: Does not validate the order and orderby parameters before using them in a SQL statementCVE-2021-24865 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.8.8.7
- What to do
- Update Advanced Custom Fields: Extended to 0.8.8.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.