Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
428 results · page 8 of 9
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce sCVE-2023-34015 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin <= 1.6.4.4 versions.
- Fixed in
- 1.6.4.6
- What to do
- Update the plugin to 1.6.4.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 27, 2023File Manager Advanced Shortcode: Does not adequately prevent uploading files with disallowed MIME typesCVE-2023-2068 · WordPress plugins & themes · reported by WPScanCritical 9.8
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
- Product
- File Manager Advanced Shortcode
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update File Manager Advanced Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 9, 2023Advanced Woo Search: Stored Cross-Site ScriptingCVE-2023-2452 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.77 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Advanced Woo Search
- Affected
- up to 2.77
- What to do
- Affects up to 2.77. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 6, 2023The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticCVE-2021-4347 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Zorem Advanced Shipment Tracking for WooCommerce plugin <= 3.5.2 versions.CVE-2022-41635 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Zorem Advanced Shipment Tracking for WooCommerce plugin <= 3.5.2 versions.
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 24, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.CVE-2022-47447 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2023The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow useCVE-2023-1196 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
- Fixed in
- 6.1.0
- What to do
- Update the plugin to 6.1.0 or newer.
Mar 20, 2023WPB Advanced FAQ: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0370 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WPB Advanced FAQ
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WPB Advanced FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2023Advanced Recent Posts: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0212 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Advanced Recent Posts
- Affected
- up to 0.6.14
- What to do
- Affects up to 0.6.14. Update Advanced Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023Genesis Columns Advanced: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4706 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
- Product
- Genesis Columns Advanced
- Fixed in
- 2.0.4
- What to do
- Update Genesis Columns Advanced to 2.0.4 or newer.
Dec 5, 2022Advanced Import: Does not have CSRF checkCVE-2022-3677 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks
- Product
- Advanced Import
- Fixed in
- 1.3.8
- What to do
- Update Advanced Import to 1.3.8 or newer.
Dec 5, 2022Advanced WP Columns: Does not sanitise and escape some of its settingsCVE-2022-3426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Advanced WP Columns
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Advanced WP Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.CVE-2022-45824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 9, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.CVE-2022-43488 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.
- Affected
- up to 4.1.5
- What to do
- Affects up to 4.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.CVE-2022-43491 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.
- Affected
- up to 4.1.5
- What to do
- Affects up to 4.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.CVE-2022-43481 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.CVE-2022-40128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 10, 2022Advanced Comment Form: Does not sanitise and escape its settingsCVE-2022-3220 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Advanced Comment Form
- Fixed in
- 1.2.1
- What to do
- Update Advanced Comment Form to 1.2.1 or newer.
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress.CVE-2022-38095 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress.
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 9, 2022Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPressCVE-2022-35275 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPress.
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
- Product
- Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro
- Fixed in
- 5.12.3
- What to do
- Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.
Aug 1, 2022Advanced WordPress Reset: Does not escape some generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2181 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced WordPress Reset
- Fixed in
- 1.6
- What to do
- Update Advanced WordPress Reset to 1.6 or newer.
Jul 17, 2022Advanced Database Cleaner: Does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced Database Cleaner
- Fixed in
- 3.1.1
- What to do
- Update Advanced Database Cleaner to 3.1.1 or newer.
Jun 13, 2022Advanced Admin Search: Does not sanitize and escape some parameters before outputting them back in an admin pageCVE-2022-0626 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Advanced Admin Search
- Fixed in
- 1.1.6
- What to do
- Update Advanced Admin Search to 1.1.6 or newer.
May 25, 2022Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.CVE-2022-29408 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 16, 2022Advanced Image Sitemap: Does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin pageCVE-2022-1216 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
- Product
- Advanced Image Sitemap
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Advanced Image Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Advanced Uploader: Allows any authenticated users like subscriber to upload arbitrary filesCVE-2022-1103 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE
- Product
- Advanced Uploader
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Advanced Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2022Advanced Page Visit Counter: Does not sanitise and escape some input before outputting it in an admin dashboard pageCVE-2021-25086 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it
- Product
- Advanced Page Visit Counter
- Fixed in
- 6.1.2
- What to do
- Update Advanced Page Visit Counter to 6.1.2 or newer.
Apr 25, 2022Advanced Page Visit Counter: Does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX actionCVE-2021-24957 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection
- Product
- Advanced Page Visit Counter
- Fixed in
- 6.1.6
- What to do
- Update Advanced Page Visit Counter to 6.1.6 or newer.
Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the room parameter before outputting it back in an admin pageCVE-2022-1007 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.1
- What to do
- Update Advanced Booking Calendar to 1.7.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the id parameterCVE-2022-1006 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.1
- What to do
- Update Advanced Booking Calendar to 1.7.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 31, 2022Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1: Missing authorizationCVE-2022-23183 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
- Product
- Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1
- What to do
- Update Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 to the newest version.
Mar 21, 2022Advanced Booking Calendar: Does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated useCVE-2022-0694 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.0
- What to do
- Update Advanced Booking Calendar to 1.7.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Advanced Contact form 7 DB: Does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX actionCVE-2021-24905 · WordPress plugins & themes · reported by WPScanHigh 8
The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.
- Product
- Advanced Contact form 7 DB
- Fixed in
- 1.8.7
- What to do
- Update Advanced Contact form 7 DB to 1.8.7 or newer.
Mar 14, 2022Advanced Product Labels for WooCommerce: Does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's responseCVE-2022-0399 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting
- Product
- Advanced Product Labels for WooCommerce
- Fixed in
- 1.2.3.7
- What to do
- Update Advanced Product Labels for WooCommerce to 1.2.3.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022Advanced iFrame: Does not sanitise and escape the ai_config_id parameter before outputting it back in an admin pageCVE-2021-24953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- Advanced iFrame
- Fixed in
- 2022
- What to do
- Update Advanced iFrame to 2022 or newer.
Feb 21, 2022Advanced Database Cleaner: Does not sanitise and escape $_GET keys and values before outputting them back in attributesCVE-2021-24921 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Advanced Database Cleaner
- Fixed in
- 3.0.4
- What to do
- Update Advanced Database Cleaner to 3.0.4 or newer.
Feb 7, 2022Advanced Cron Manager: And Advanced Cron Manager Pro WordPress plugin before 2CVE-2021-25084 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example
- Product
- Advanced Cron Manager
- Fixed in
- 2.4.2
- What to do
- Update Advanced Cron Manager to 2.4.2 or newer.
Jan 24, 2022Advanced Custom Fields: Extended: Does not validate the order and orderby parameters before using them in a SQL statementCVE-2021-24865 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.8.8.7
- What to do
- Update Advanced Custom Fields: Extended to 0.8.8.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 13, 2021Contact Form Advanced Database: Does not have any authorisationCVE-2021-24790 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.
- Product
- Contact Form Advanced Database
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Contact Form Advanced Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021moving the field group which may allow a user to move the unauthorized field group: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20867 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
- Product
- moving the field group which may allow a user to move the unauthorized field group
- What to do
- Update moving the field group which may allow a user to move the unauthorized field group to the newest version.
Dec 13, 2021obtaining the user list which may allow a user to obtain the unauthorized information: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20866 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
- Product
- obtaining the user list which may allow a user to obtain the unauthorized information
- What to do
- Update obtaining the user list which may allow a user to obtain the unauthorized information to the newest version.
Dec 13, 2021browsing database which may allow a user to browse unauthorized data: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20865 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
- Product
- browsing database which may allow a user to browse unauthorized data
- What to do
- Update browsing database which may allow a user to browse unauthorized data to the newest version.
Nov 23, 2021Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's emCVE-2021-24892 · WordPress plugins & themes · reported by WPScanHigh 8.8
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
- Fixed in
- 1.6.9
- What to do
- Update the plugin to 1.6.9 or newer.
Nov 23, 2021Advanced Access Manager: Does not escape some of its settingsCVE-2021-24830 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Advanced Access Manager
- Fixed in
- 6.8.0
- What to do
- Update Advanced Access Manager to 6.8.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 13, 2021WordPress Advanced Ticket System, Elite Support Helpdesk: Does not sanitize or escape form values before saving to the database orCVE-2021-24623 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordPress Advanced Ticket System, Elite Support Helpdesk
- Fixed in
- 1.0.64
- What to do
- Update WordPress Advanced Ticket System, Elite Support Helpdesk to 1.0.64 or newer.
Jul 12, 2021WP Reset – Most Advanced WordPress Reset Tool: Did not sanitise or escape its extra_data parameterCVE-2021-24424 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- WP Reset – Most Advanced WordPress Reset Tool
- Fixed in
- 1.90
- What to do
- Update WP Reset – Most Advanced WordPress Reset Tool to 1.90 or newer.
Jul 12, 2021The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request.CVE-2021-24385 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.
- Affected
- 4.7.3 to 4.7.3
- What to do
- Affects 4.7.3 to 4.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2021The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped beforeCVE-2021-24337 · WordPress plugins & themes · reported by WPScanHigh 8.8
The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
- Product
- Video Embed
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Video Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Apr 22, 2021Advanced Custom Fields Pro: Did not properly escape the generated update URLCVE-2021-24241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
- Product
- Advanced Custom Fields Pro
- Fixed in
- 5.9.1
- What to do
- Update Advanced Custom Fields Pro to 5.9.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.