Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
407 results · page 8 of 9
Nov 30, 2023Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-40674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management allows Stored XSS.This issue affects Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management: from n/a through 118.
- Product
- Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management
- Affected
- up to 118
- What to do
- Affects up to 118. Update Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023ImageMapper: Cross-Site Request ForgeryCVE-2023-5975 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to update the plugin settings via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ImageMapper
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update ImageMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 7, 2023ImageMapper: Cross-Site Request ForgeryCVE-2023-5532 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the 'imgmap_save_area_title' function. This makes it possible for unauthenticated attackers to update the post title and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ImageMapper
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update ImageMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 7, 2023ImageMapper: Stored Cross-Site ScriptingCVE-2023-5507 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ImageMapper
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update ImageMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 7, 2023ImageMapper: Unauthorized loss of dataCVE-2023-5506 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area_ajax' function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts and pages.
- Product
- ImageMapper
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update ImageMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 6, 2023The School Management – Education & Learning Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-47430 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar The School Management – Education & Learning Management allows SQL Injection.This issue affects The School Management – Education & Learning Management: from n/a through 4.1.
- Product
- The School Management – Education & Learning Management
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update The School Management – Education & Learning Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 20, 2023ImageMagick Engine: Remote code executionCVE-2022-2441 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.
- Product
- ImageMagick Engine
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update ImageMagick Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2023School Management System: Uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the queryCVE-2023-4776 · WordPress plugins & themes · reported by WPScanHigh 8.8
The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
- Product
- School Management System
- Fixed in
- 2.2.5
- What to do
- Update School Management System to 2.2.5 or newer.
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <= 2.4.2 versions.CVE-2023-39158 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Banner Management For WooCommerce plugin <= 2.4.2 versions.
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 3, 2023CRM and Lead Management by vcita: Cross-Site Request ForgeryCVE-2023-2405 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- CRM and Lead Management by vcita
- Affected
- up to 2.7.0
- What to do
- Affects up to 2.7.0. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jonh.euplugins.trac.wordpress.org
Jun 3, 2023CRM and Lead Management by vcita: Stored Cross-Site ScriptingCVE-2023-2404 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CRM and Lead Management by vcita
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jonh.euplugins.trac.wordpress.org
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0763 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack
- Product
- Clock In Portal- Staff & Attendance Management
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0762 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack
- Product
- Clock In Portal- Staff & Attendance Management
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0761 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack
- Product
- Clock In Portal- Staff & Attendance Management
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 9, 2023ImageMagick Engine: Deserialization of untrusted inputCVE-2022-3568 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- ImageMagick Engine
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update ImageMagick Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4155 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery Pro: Does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
- Product
- Contest Gallery Pro
- Fixed in
- 19.1.5
- What to do
- Update Contest Gallery Pro to 19.1.5 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 5, 2022Comic Book Management System: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2022-3856 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- Comic Book Management System
- Fixed in
- 2.2.0
- What to do
- Update Comic Book Management System to 2.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Aug 23, 2022Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.CVE-2022-35242 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 17, 2022Best Contact Management Software: Does not sanitise and escape its settingsCVE-2022-2151 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Best Contact Management Software
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Best Contact Management Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022Admin Management Xtended: Does not have CSRF checks in some of its AJAX actionsCVE-2022-1599 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.
- Product
- Admin Management Xtended
- Fixed in
- 2.4.5
- What to do
- Update Admin Management Xtended to 2.4.5 or newer.
Jun 15, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.CVE-2022-29450 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compatchstack.com
May 23, 2022Gwyn's Imagemap Selector: Does not sanitise and escape some parameters before outputting them back in attributesCVE-2022-1221 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting.
- Product
- Gwyn's Imagemap Selector
- Affected
- up to 0.3.3
- What to do
- Affects up to 0.3.3. Update Gwyn's Imagemap Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022RSVP and Event Management: Does not have any authorisation checksCVE-2022-1054 · WordPress plugins & themes · reported by WPScanMedium 5.3
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events
- Product
- RSVP and Event Management
- Fixed in
- 2.7.8
- What to do
- Update RSVP and Event Management to 2.7.8 or newer.
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21664 · WordPress plugins & themes · reported by GitHubHigh 7.4
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- What to do
- Update the plugin to the newest version.
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21663 · WordPress plugins & themes · reported by GitHubMedium 6.6
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21662 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21661 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 8, 2021School Management System – WPSchoolPress: Sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributesCVE-2021-24664 · WordPress plugins & themes · reported by WPScanMedium 4.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
- Product
- School Management System – WPSchoolPress
- Fixed in
- 2.1.17
- What to do
- Update School Management System – WPSchoolPress to 2.1.17 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Nov 8, 2021School Management System – WPSchoolPress: Does not properly sanitize or use prepared statements before using POST variable in SQL queriesCVE-2021-24575 · WordPress plugins & themes · reported by WPScanHigh 8.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.
- Product
- School Management System – WPSchoolPress
- Fixed in
- 2.1.10
- What to do
- Update School Management System – WPSchoolPress to 2.1.10 or newer.
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39203 · WordPress plugins & themes · reported by GitHubMedium 6.8
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comhackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39202 · WordPress plugins & themes · reported by GitHubHigh 7.6
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comhackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39201 · WordPress plugins & themes · reported by GitHubHigh 7.6
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comhackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39200 · WordPress plugins & themes · reported by GitHubMedium 5.3
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comhackerone.com
Aug 23, 2021LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for: Was affected by an IDOR issueCVE-2021-24562 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades
- Product
- LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for
- Fixed in
- 4.21.2
- What to do
- Update LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for to 4.21.2 or newer.
Full record and what to do →NVD recordmake.lifterlms.comwpscan.com
Aug 16, 2021VikRentCar Car Rental Management System: Does not sanitise the 'Text Next to Icon' fieldCVE-2021-24519 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- VikRentCar Car Rental Management System
- Fixed in
- 1.1.10
- What to do
- Update VikRentCar Car Rental Management System to 1.1.10 or newer.
Jul 6, 2021In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the userCVE-2021-24388 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However, the field name is not sanitised or escaped before being output back in the page, leading to a stored Cross-Site Scripting issue. There is also no CSRF check done before saving the setting, allowing attackers to make a logged in admin set arbitrary Custom Fields, including one with XSS payload in it.
- Product
- VikRentCar Car Rental Management System
- Fixed in
- 1.1.7
- What to do
- Update VikRentCar Car Rental Management System to 1.1.7 or newer.
Jun 14, 2021The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or esCVE-2021-24345 · WordPress plugins & themes · reported by WPScanMedium 6.6
The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
- Product
- Sendit WP Newsletter
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Sendit WP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
- Fixed in
- 4.21.1
- What to do
- Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 6, 2021Imagements: Allows images to be uploaded in commentsCVE-2021-24236 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE.
- Product
- Imagements
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update Imagements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 20, 2019The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.CVE-2015-9390 · WordPress plugins & themes · reported by MITREMedium 4.3
The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
- Product
- admin-management-xtended
- Fixed in
- 2.4.0.1
- What to do
- Update admin-management-xtended to 2.4.0.1 or newer.
Full record and what to do →NVD recordsecurity.szurek.plwordpress.org
Mar 5, 2019The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR MaCVE-2019-9574 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role.
- Product
- WP Human Resource Management
- Fixed in
- 2.2.6
- What to do
- Update WP Human Resource Management to 2.2.6 or newer.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Mar 5, 2019The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.CVE-2019-9573 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.
- Product
- WP Human Resource Management
- Fixed in
- 2.2.6
- What to do
- Update WP Human Resource Management to 2.2.6 or newer.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
May 30, 2018class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change VulnerCVE-2018-11579 · WordPress plugins & themes · reported by MITREMedium 5.3
class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wp_ajax_nopriv_ usage. Anyone can change the plugin's setting by simply sending a request with a wbm_save_shop_page_banner_data action.
- Product
- MULTIDOTS WooCommerce Category Banner Management
- Affected
- 1.1.0 to 1.1.0
- What to do
- Affects 1.1.0 to 1.1.0. Update MULTIDOTS WooCommerce Category Banner Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlabs.threatpress.comwordpress.org
Dec 27, 2017Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin befoCVE-2015-7667 · WordPress plugins & themes · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in (1) templates/admanagement/admanagement.php and (2) templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter.
- Fixed in
- 1.0.2
- What to do
- Update the plugin to 1.0.2 or newer.
Full record and what to do →NVD recordsecurityfocus.comwordpress.org
Oct 2, 2017WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.CVE-2017-14848 · WordPress plugins & themes · reported by MITREHigh 8.8
WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpvulndb.comexploit-db.com
Sep 27, 2017Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14847 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 27, 2017Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14846 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 27, 2017Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14845 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Sep 27, 2017Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.CVE-2017-14844 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.