Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

4,221 results · page 81 of 85

Jan 18, 2022Crisp Live Chat: Cross-Site Request ForgeryCVE-2021-43353 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.
Product
Crisp Live Chat
Affected
up to 0.31
What to do
Affects up to 0.31. Update Crisp Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Cross-site request forgery (CSRF)CVE-2022-0180 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Jan 13, 2022Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.CVE-2021-23227 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 22, 2021Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).CVE-2021-36886 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.5.9).
Affected
up to 1.2.5.9
What to do
Affects up to 1.2.5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 21, 2021Directorist: Was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directoryCVE-2021-24981 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.
Product
Directorist
Fixed in
7.0.6.2
What to do
Update Directorist to 7.0.6.2 or newer.
Full record and what to do →NVD record blog.sucuri.net wpscan.com
Dec 20, 2021Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugCVE-2021-36887 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 13, 2021Filter Portfolio Gallery: Is lacking Cross-Site Request Forgery (CSRF) checkCVE-2021-24795 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.
Product
Filter Portfolio Gallery
Affected
up to 1.5
What to do
Affects up to 1.5. Update Filter Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 30, 2021Browser and Operating System Finder versions prior to 1.2: Cross-site request forgery (CSRF)CVE-2021-20851 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of an administrator via unspecified vectors.
Product
Browser and Operating System Finder versions prior to 1.2
Fixed in
1.2
What to do
Update Browser and Operating System Finder versions prior to 1.2 to 1.2 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Nov 29, 2021Stetic: Cross-Site Request ForgeryCVE-2021-42364 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.0.6.
Product
Stetic
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Stetic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2021Contact Form With Captcha: Cross-Site Request ForgeryCVE-2021-42358 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the ~/cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2.
Product
Contact Form With Captcha
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update Contact Form With Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 24, 2021Push Notifications for: Cross-site request forgery (CSRF)CVE-2021-20846 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker to hijack the authentication of an administrator and conduct an arbitrary operation via a specially crafted web page.
Product
Push Notifications for
Fixed in
6.0.1
What to do
Update Push Notifications for to 6.0.1 or newer.
Full record and what to do →NVD record delitestudio.com jvn.jp
Nov 19, 2021Easy Registration Forms: Cross-Site Request ForgeryCVE-2021-39353 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajax_add_form function found in the ~/includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 2.1.1.
Product
Easy Registration Forms
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Easy Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 18, 2021WebFactory Ltd: Cross-Site Request Forgery (CSRF)CVE-2021-36908 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in WebFactory Ltd. WP Reset PRO plugin <= 5.98 versions.
Product
WebFactory Ltd
Fixed in
5.99
What to do
Update WebFactory Ltd to 5.99 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 1, 2021Delete All Comments Easily: Is lacking Cross-Site Request Forgery (CSRF) checksCVE-2020-36505 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which could result in an unauthenticated attacker making a logged in admin delete all comments from the blog.
Product
Delete All Comments Easily
Affected
up to 1.3
What to do
Affects up to 1.3. Update Delete All Comments Easily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com wpscan.com
Oct 13, 2021OG Tags versions prior to 2.0.2: Cross-site request forgery (CSRF)CVE-2021-20831 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of administrators and unintended operation may be performed via unspecified vectors.
Product
OG Tags versions prior to 2.0.2
Fixed in
2.0.2
What to do
Update OG Tags versions prior to 2.0.2 to 2.0.2 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Oct 4, 2021WordPress Media File Renamer – Auto & Manual Rename: Cross-Site Request Forgery (CSRF)CVE-2021-36850 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions <= 5.1.9). Affected parameters "post_title", "filename", "lock". This allows changing the uploaded media title, media file name, and media locking state.
Product
WordPress Media File Renamer – Auto & Manual Rename
Affected
up to 5.1.9
What to do
Affects up to 5.1.9. Update WordPress Media File Renamer – Auto & Manual Rename to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 28, 2021Countdown and CountUp, WooCommerce Sales Timers: Cross-Site Request ForgeryCVE-2021-34636 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.7.
Product
Countdown and CountUp, WooCommerce Sales Timers
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Countdown and CountUp, WooCommerce Sales Timers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2021WordPress uListing: Cross-Site Request Forgery (CSRF)CVE-2021-36877 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles.
Product
WordPress uListing
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update WordPress uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 27, 2021Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pagCVE-2021-36876 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pages.
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 27, 2021WordPress uListing: Cross-Site Request Forgery (CSRF)CVE-2021-36878 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update settings.
Product
WordPress uListing
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update WordPress uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 22, 2021Telefication: Open Proxy and Server-Side Request ForgeryCVE-2021-39339 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-supplied URL request value that gets called by a curl requests. This affects versions up to, and including, 1.8.0.
Product
Telefication
Affected
up to 1.8.0
What to do
Affects up to 1.8.0. Update Telefication to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 30, 2021The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which alCVE-2021-38342 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Nested Pages WordPress plugin <= 3.1.15 was vulnerable to Cross-Site Request Forgery via the `npBulkAction`s and `npBulkEdit` `admin_post` actions, which allowed attackers to trash or permanently purge arbitrary posts as well as changing their status, reassigning their ownership, and editing other metadata.
Product
Nested Pages
Affected
up to 3.1.15
What to do
Affects up to 3.1.15. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 19, 2021Shopping Cart & eCommerce Store: Cross-Site Request ForgeryCVE-2021-34645 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0.
Product
Shopping Cart & eCommerce Store
Affected
up to 5.1.0
What to do
Affects up to 5.1.0. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 9, 2021WP Fusion Lite: Cross-Site Request ForgeryCVE-2021-34661 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the `show_logs_section` function found in the ~/includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18.
Product
WP Fusion Lite
Affected
up to 3.37.18
What to do
Affects up to 3.37.18. Update WP Fusion Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 5, 2021Nifty Newsletters: Cross-Site Request ForgeryCVE-2021-34634 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23.
Product
Nifty Newsletters
Affected
up to 4.0.23
What to do
Affects up to 4.0.23. Update Nifty Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 5, 2021Youtube Feeder: Cross-Site Request ForgeryCVE-2021-34633 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feeder.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.1.
Product
Youtube Feeder
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Youtube Feeder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 5, 2021NewsPlugin: Cross-Site Request ForgeryCVE-2021-34631 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18.
Product
NewsPlugin
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update NewsPlugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Aug 2, 2021Post Index: Cross-Site Request ForgeryCVE-2021-34637 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the ~/php/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.5.
Product
Post Index
Affected
up to 0.7.5
What to do
Affects up to 0.7.5. Update Post Index to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2021SEO Backlinks: Cross-Site Request ForgeryCVE-2021-34632 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the loc_config function found in the ~/seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1.
Product
SEO Backlinks
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update SEO Backlinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 2, 2021Admin Custom Login: Cross-Site Request ForgeryCVE-2021-34628 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7.
Product
Admin Custom Login
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update Admin Custom Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 21, 2021WooCommerce Stock Manager: Cross-Site Request Forgery leading to Arbitrary File UploadCVE-2021-34619 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocommerce-stock-manager/trunk/admin/views/import-export.php file.
Product
WooCommerce Stock Manager
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update WooCommerce Stock Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 13, 2021Software License Manager versions prior to 4.4.6: Cross-site request forgery (CSRF)CVE-2021-20782 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
Software License Manager versions prior to 4.4.6
Fixed in
4.4.6
What to do
Update Software License Manager versions prior to 4.4.6 to 4.4.6 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Jul 13, 2021WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8: Cross-site request forgery (CSRF)CVE-2021-20781 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8
What to do
Update WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 to the newest version.
Full record and what to do →NVD record jvn.jp wp-filter.com
Jul 7, 2021Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter inCVE-2020-24149 · WordPress plugins & themes · reported by MITREHigh 7.5
Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.
Product
Podcast Importer SecondLine (podcast-importer-secondline)
Affected
1.1.4 to 1.1.4
What to do
Affects 1.1.4 to 1.1.4. Update Podcast Importer SecondLine (podcast-importer-secondline) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml actioCVE-2020-24148 · WordPress plugins & themes · reported by MITRECritical 9.1
Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.
Product
Import XML and RSS Feeds (import-xml-feed)
Affected
2.0.1 to 2.0.1
What to do
Affects 2.0.1 to 2.0.1. Update Import XML and RSS Feeds (import-xml-feed) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.CVE-2020-24147 · WordPress plugins & themes · reported by MITRECritical 9.1
Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.
Product
WP Smart Import (wp-smart-import)
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update WP Smart Import (wp-smart-import) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordpress.org
Jul 7, 2021Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the CVE-2020-24142 · WordPress plugins & themes · reported by MITRECritical 9.8
Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services
Product
Video Downloader for TikTok (aka downloader-tiktok)
Affected
1.3 to 1.3
What to do
Affects 1.3 to 1.3. Update Video Downloader for TikTok (aka downloader-tiktok) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 7, 2021Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerablCVE-2020-24141 · WordPress plugins & themes · reported by MITREMedium 5.3
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
Product
WP-DownloadManager
Affected
1.68.4 to 1.68.4
What to do
Affects 1.68.4 to 1.68.4. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 7, 2021WP Fluent Forms plugin < 3.6.67: Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege EscalationCVE-2021-34620 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
Product
WP Fluent Forms plugin < 3.6.67
What to do
Update WP Fluent Forms plugin < 3.6.67 to the newest version.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 7, 2021WPCS - WordPress Currency Switcher 1.1.6 and earlier: Cross-site request forgery (CSRF)CVE-2021-20780 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WPCS - WordPress Currency Switcher 1.1.6 and earlier
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update WPCS - WordPress Currency Switcher 1.1.6 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jvn.jp pluginus.net
Jul 7, 2021WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8: Cross-site request forgery (CSRF)CVE-2021-20779 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Product
WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8
Fixed in
3.0.8
What to do
Update WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 to 3.0.8 or newer.
Full record and what to do →NVD record codemiq.com jvn.jp
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from a Cross-Site Request Forgery issueCVE-2021-24251 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status (from pending to completed to example)
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11.2
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from a Cross-Site Request Forgery issueCVE-2021-24249 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator export files, which could then be downloaded by the attacker to get access to PII, such as email, home addresses etc
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11.2
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from a Cross-Site Request Forgery issueCVE-2021-24179 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE.
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from Cross-Site Request Forgery issuesCVE-2021-24178 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 suffered from Cross-Site Request Forgery issues, allowing an attacker to make a logged in administrator add, edit or delete form fields, which could also lead to Stored Cross-Site Scripting issues.
Product
Business Directory Plugin – Easy Listing Directories for
Fixed in
5.11.1
What to do
Update Business Directory Plugin – Easy Listing Directories for to 5.11.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2021The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged adCVE-2021-24231 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link.
Product
Patreon
Fixed in
1.7.0
What to do
Update Patreon to 1.7.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged inCVE-2021-24230 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content.
Product
Patreon
Fixed in
1.7.0
What to do
Update Patreon to 1.7.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 5, 2021LikeBtn WordPress Like Button Rating ♥ LikeBtn: Was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF)CVE-2021-24150 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LikeBtn WordPress Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.32 was vulnerable to Unauthenticated Full-Read Server-Side Request Forgery (SSRF).
Product
LikeBtn WordPress Like Button Rating ♥ LikeBtn
Fixed in
2.6.32
What to do
Update LikeBtn WordPress Like Button Rating ♥ LikeBtn to 2.6.32 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 9, 2021A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload.CVE-2020-35943 · WordPress plugins & themes · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
Product
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery
Fixed in
3.5.0
What to do
Update A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery to 3.5.0 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com
Feb 9, 2021A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modiCVE-2020-35942 · WordPress plugins & themes · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification, leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)
Product
A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery
Fixed in
3.5.0
What to do
Update A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery to 3.5.0 or newer.
Full record and what to do →NVD record wordfence.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.