Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
652 results · page 8 of 14
Jun 13, 2022Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in libCVE-2022-1656 · WordPress plugins & themes · reported by WordfenceMedium 5.4
Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_api_ajax_ actions registered by the JupiterX Core Plugin (<=2.0.6). This includes the ability to deactivate arbitrary plugins as well as update the theme’s API key.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022Email Users: Does not have CSRF check in placeCVE-2022-1605 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and change the notification settings of arbitrary users
- Product
- Email Users
- Affected
- up to 4.8.8
- What to do
- Affects up to 4.8.8. Update Email Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
- Product
- Nirweb support
- Fixed in
- 2.8.2
- What to do
- Update Nirweb support to 2.8.2 or newer.
May 16, 2022Visual Slide Box Builder: Does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (suchCVE-2022-1182 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections
- Product
- Visual Slide Box Builder
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Visual Slide Box Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Advanced Uploader: Allows any authenticated users like subscriber to upload arbitrary filesCVE-2022-1103 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE
- Product
- Advanced Uploader
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Advanced Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Bulk Edit and Create User Profiles: Does not sanitise and escape the Users LoginCVE-2022-1089 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Bulk Edit and Create User Profiles
- Fixed in
- 1.5.14
- What to do
- Update Bulk Edit and Create User Profiles to 1.5.14 or newer.
May 9, 2022Order Listener for WooCommerce: Does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated usersCVE-2022-0948 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection
- Product
- Order Listener for WooCommerce
- Fixed in
- 3.2.2
- What to do
- Update Order Listener for WooCommerce to 3.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 9, 2022WPGraphQL: Doesn't properly restrict access to information about other users' roles on the affected siteCVE-2019-25060 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
- Product
- WPGraphQL
- Fixed in
- 0.3.5
- What to do
- Update WPGraphQL to 0.3.5 or newer.
May 2, 2022Import and export users and customers: Does not sanitise and escaped imported CSV dataCVE-2022-1255 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
- Product
- Import and export users and customers
- Fixed in
- 1.19.2.1
- What to do
- Update Import and export users and customers to 1.19.2.1 or newer.
May 2, 2022Multiple Shipping Address Woocommerce: Does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated usersCVE-2022-0783 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
- Product
- Multiple Shipping Address Woocommerce
- Fixed in
- 2.0
- What to do
- Update Multiple Shipping Address Woocommerce to 2.0 or newer.
May 2, 2022Ad Invalid Click Protector (AICP): Does not have CSRF check deleting banned usersCVE-2022-0191 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attackers to make a logged in admin remove arbitrary bans
- Product
- Ad Invalid Click Protector (AICP)
- Fixed in
- 1.2.7
- What to do
- Update Ad Invalid Click Protector (AICP) to 1.2.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2022-27854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher role via &wpt_test_page_submit_button_caption parameter.
- Affected
- up to 0.21.19
- What to do
- Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2021-36867 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher user rights.
- Affected
- up to 0.21.19
- What to do
- Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 25, 2022SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocializer plugin <= 0.98.22 at WordPress possible for users with a low role like a subscriber or higher.CVE-2022-29419 · WordPress plugins & themes · reported by PatchstackMedium 6
SQL Injection (SQLi) vulnerability in Don Crowther's 3xSocializer plugin <= 0.98.22 at WordPress possible for users with a low role like a subscriber or higher.
- Affected
- up to 0.98.22
- What to do
- Affects up to 0.98.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 25, 2022Menubar: Does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users)CVE-2022-1152 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting
- Product
- Menubar
- Fixed in
- 5.8
- What to do
- Update Menubar to 5.8 or newer.
Apr 25, 2022amr users: Does not sanitise and escape some of its settingsCVE-2022-1094 · WordPress plugins & themes · reported by WPScanMedium 4.8
The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- amr users
- Fixed in
- 4.59.4
- What to do
- Update amr users to 4.59.4 or newer.
Apr 25, 2022Donations: Does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated usersCVE-2022-0782 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- Donations
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022Users Ultra: Fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and auCVE-2022-0769 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.
- Product
- Users Ultra
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Users Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022Master Elements: Does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2022-0693 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection
- Product
- Master Elements
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Master Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022Web To Print Shop : uDraw: Does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function CVE-2022-0656 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
- Product
- Web To Print Shop : uDraw
- Fixed in
- 3.3.3
- What to do
- Update Web To Print Shop : uDraw to 3.3.3 or newer.
Apr 25, 2022SP Project & Document Manager: Allows any authenticated usersCVE-2021-4225 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.
- Product
- SP Project & Document Manager
- Fixed in
- 4.24
- What to do
- Update SP Project & Document Manager to 4.24 or newer.
Apr 25, 2022English WordPress Admin: Does not validate the admin_custom_language_return_url before redirecting users o itCVE-2021-25111 · WordPress plugins & themes · reported by WPScanMedium 6.1
The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue
- Product
- English WordPress Admin
- Fixed in
- 1.5.2
- What to do
- Update English WordPress Admin to 1.5.2 or newer.
Apr 19, 2022The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API routeCVE-2022-1186 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5.
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0993 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
- Product
- SiteGround Security
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 19, 2022SiteGround Security: Authentication bypass that allows unauthenticated users to log in as administrative usersCVE-2022-0992 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5.
- Product
- SiteGround Security
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update SiteGround Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 18, 2022Product Table for WooCommerce (wooproducttable): Does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
- Product
- Product Table for WooCommerce (wooproducttable)
- Fixed in
- 3.1.2
- What to do
- Update Product Table for WooCommerce (wooproducttable) to 3.1.2 or newer.
Apr 18, 2022Daily Prayer Time: Does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users)CVE-2022-0785 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
- Product
- Daily Prayer Time
- Fixed in
- 2022.03.01
- What to do
- Update Daily Prayer Time to 2022.03.01 or newer.
Apr 11, 2022Social Share, Social Login and Social Comments: Does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it CVE-2021-24987 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.30
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.30 or newer.
Mar 28, 2022Limit Login Attempts (Spam Protection): Does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users)CVE-2022-0787 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections
- Product
- Limit Login Attempts (Spam Protection)
- Fixed in
- 5.1
- What to do
- Update Limit Login Attempts (Spam Protection) to 5.1 or newer.
Mar 28, 2022Title Experiments Free: Does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users)CVE-2022-0784 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
- Product
- Title Experiments Free
- Fixed in
- 9.0.1
- What to do
- Update Title Experiments Free to 9.0.1 or newer.
Mar 28, 2022Plezi: Has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable optionCVE-2022-0680 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue
- Product
- Plezi
- Fixed in
- 1.0.3
- What to do
- Update Plezi to 1.0.3 or newer.
Mar 28, 2022The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode aCVE-2021-24962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution.
- Fixed in
- 4.16.3
- What to do
- Update the plugin to 4.16.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 23, 2022Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted sliCVE-2022-25608 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted slider duplicate or delete action.
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 21, 2022Simple Link Directory: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0760 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
- Product
- Simple Link Directory
- Fixed in
- 7.7.2
- What to do
- Update Simple Link Directory to 7.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Infographic Maker: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0747 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
- Product
- Infographic Maker
- Fixed in
- 4.3.8
- What to do
- Update Infographic Maker to 4.3.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- BookingPress
- Fixed in
- 1.0.11
- What to do
- Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022CommonsBooking: Does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queriesCVE-2022-0658 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
- Product
- CommonsBooking
- Fixed in
- 2.6.8
- What to do
- Update CommonsBooking to 2.6.8 or newer.
Mar 14, 2022WP Voting Contest: Does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
- Product
- WP Voting Contest
- Fixed in
- 3.0
- What to do
- Update WP Voting Contest to 3.0 or newer.
Mar 14, 2022WP Email Users: Does not escape the data_raw parameter in the weu_selected_users_1 AJAX actionCVE-2021-24959 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Email Users WordPress plugin through 1.7.6 does not escape the data_raw parameter in the weu_selected_users_1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks.
- Product
- WP Email Users
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update WP Email Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Simple Download Monitor: Allows users with a roleCVE-2021-24692 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Download Monitor WordPress plugin before 3.9.5 allows users with a role as low as Contributor to download any file on the web server (such as wp-config.php) via a path traversal vector.
- Product
- Simple Download Monitor
- Fixed in
- 3.9.5
- What to do
- Update Simple Download Monitor to 3.9.5 or newer.
Mar 7, 2022UsersWP: Is missing access controlsCVE-2022-0442 · WordPress plugins & themes · reported by WPScanMedium 4.3
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
- Product
- UsersWP
- Fixed in
- 1.2.3.1
- What to do
- Update UsersWP to 1.2.3.1 or newer.
Mar 7, 2022Video Conferencing with Zoom: Does not have authorisation in its vczapi_get_wp_users AJAX actionCVE-2022-0384 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog
- Product
- Video Conferencing with Zoom
- Fixed in
- 3.8.17
- What to do
- Update Video Conferencing with Zoom to 3.8.17 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022YOP Poll: Does not sanitise and escape some of the settings (available to users with a roleCVE-2022-0205 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue
- Product
- YOP Poll
- Fixed in
- 6.3.5
- What to do
- Update YOP Poll to 6.3.5 or newer.
Mar 7, 2022WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro: Allows users with a roleCVE-2021-24960 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks
- Product
- WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro
- Fixed in
- 4.16.3
- What to do
- Update WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro to 4.16.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, toCVE-2021-24824 · WordPress plugins & themes · reported by WPScanMedium 4.3
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
- Product
- [field] shortcode included with the Custom Content Shortcode
- Fixed in
- 4.0.1
- What to do
- Update [field] shortcode included with the Custom Content Shortcode to 4.0.1 or newer.
Mar 7, 2022Cost Calculator: Allows users with a roleCVE-2021-24821 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)
- Product
- Cost Calculator
- Fixed in
- 1.6
- What to do
- Update Cost Calculator to 1.6 or newer.
Feb 28, 2022The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-SiCVE-2022-23987 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Fixed in
- 1.8.176
- What to do
- Update the plugin to 1.8.176 or newer.
Feb 28, 2022Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration.CVE-2022-0377 · WordPress plugins & themes · reported by WPScanMedium 4.3
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.
- Product
- LearnPress
- Fixed in
- 4.1.5
- What to do
- Update LearnPress to 4.1.5 or newer.
Full record and what to do →NVD recordbozogullarindan.comgithub.com
Feb 28, 2022Customize WordPress Emails and Alerts: Does not have authorisation and CSRF check in its bnfw_search_users AJAX actionCVE-2022-0345 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
- Product
- Customize WordPress Emails and Alerts
- Fixed in
- 1.8.7
- What to do
- Update Customize WordPress Emails and Alerts to 1.8.7 or newer.
Feb 28, 2022Cost Calculator: Allows authenticated users (Contributor+ in versions < 1CVE-2021-24820 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout
- Product
- Cost Calculator
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.