Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,277 results · page 83 of 86
Jun 8, 2022Five Minute Webshop: Does not sanitise and escape the id parameter before using it in a SQL statementCVE-2022-1686 · WordPress plugins & themes · reported by WPScanLow 2.7
The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection
- Product
- Five Minute Webshop
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Five Minute Webshop: Does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin pageCVE-2022-1685 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
- Product
- Five Minute Webshop
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Cube Slider: Does not sanitise and escape the idslider parameter before using it in various SQL queriesCVE-2022-1684 · WordPress plugins & themes · reported by WPScanLow 2.7
The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin
- Product
- Cube Slider
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Cube Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022amtyThumb: Does not sanitise and escape a parameter before using it in a SQL statement via its shortcodeCVE-2022-1683 · WordPress plugins & themes · reported by WPScanHigh 8.8
The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user (and not just Author+ like the original advisory mention) due to the fact that they can execute shortcodes via an AJAX action
- Product
- amtyThumb
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update amtyThumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022WP Fundraising Donation and Crowdfunding Platform: Does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST routeCVE-2022-0788 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users
- Product
- WP Fundraising Donation and Crowdfunding Platform
- Fixed in
- 1.5.0
- What to do
- Update WP Fundraising Donation and Crowdfunding Platform to 1.5.0 or newer.
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 30, 2022StaffList: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-1556 · WordPress plugins & themes · reported by WPScanCritical 9.8
The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection
- Product
- StaffList
- Fixed in
- 3.1.5
- What to do
- Update StaffList to 3.1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
- Product
- Nirweb support
- Fixed in
- 2.8.2
- What to do
- Update Nirweb support to 2.8.2 or newer.
May 16, 2022Amministrazione Aperta: Does not validate the open parameter before using it in an include statementCVE-2022-1560 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link
- Product
- Amministrazione Aperta
- Fixed in
- 3.8
- What to do
- Update Amministrazione Aperta to 3.8 or newer.
May 16, 2022Visual Slide Box Builder: Does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (suchCVE-2022-1182 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections
- Product
- Visual Slide Box Builder
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Visual Slide Box Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022Themify Post Type Builder Search Addon: Does not properly escape the current page URL before reusing it in a HTML attributeCVE-2022-1047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability.
- Product
- Themify Post Type Builder Search Addon
- Fixed in
- 1.4.0
- What to do
- Update Themify Post Type Builder Search Addon to 1.4.0 or newer.
May 9, 2022Order Listener for WooCommerce: Does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated usersCVE-2022-0948 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection
- Product
- Order Listener for WooCommerce
- Fixed in
- 3.2.2
- What to do
- Update Order Listener for WooCommerce to 3.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 9, 2022SEMA API: Does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX actionCVE-2022-0836 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users
- Product
- SEMA API
- Fixed in
- 4.02
- What to do
- Update SEMA API to 4.02 or newer.
May 9, 2022WP Video Gallery: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCVE-2022-0826 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- WP Video Gallery
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update WP Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022BadgeOS: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCVE-2022-0817 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- BadgeOS
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update BadgeOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022Ubigeo de Perú para Woocommerce: Does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actionsCVE-2022-0814 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
- Product
- Ubigeo de Perú para Woocommerce
- Fixed in
- 3.6.4
- What to do
- Update Ubigeo de Perú para Woocommerce to 3.6.4 or newer.
May 9, 2022MapSVG: Does not validate and escape a parameter via a REST endpoint before using it in a SQL statementCVE-2022-0592 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.
- Product
- MapSVG
- Fixed in
- 6.2.20
- What to do
- Update MapSVG to 6.2.20 or newer.
May 2, 2022Multiple Shipping Address Woocommerce: Does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated usersCVE-2022-0783 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
- Product
- Multiple Shipping Address Woocommerce
- Fixed in
- 2.0
- What to do
- Update Multiple Shipping Address Woocommerce to 2.0 or newer.
Apr 25, 2022Videos sync PDF: Does not validate the p parameter before using it in an include statementCVE-2022-1392 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues
- Product
- Videos sync PDF
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update Videos sync PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 25, 2022Cab fare calculator: Does not validate the controller parameter before using it in require statementsCVE-2022-1391 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.
- Product
- Cab fare calculator
- Fixed in
- 1.0.4
- What to do
- Update Cab fare calculator to 1.0.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 25, 2022Donations: Does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated usersCVE-2022-0782 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- Donations
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022Master Elements: Does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2022-0693 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection
- Product
- Master Elements
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Master Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022Web To Print Shop : uDraw: Does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function CVE-2022-0656 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
- Product
- Web To Print Shop : uDraw
- Fixed in
- 3.3.3
- What to do
- Update Web To Print Shop : uDraw to 3.3.3 or newer.
Apr 25, 2022Advanced Page Visit Counter: Does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX actionCVE-2021-24957 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection
- Product
- Advanced Page Visit Counter
- Fixed in
- 6.1.6
- What to do
- Update Advanced Page Visit Counter to 6.1.6 or newer.
Apr 18, 2022Daily Prayer Time: Does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users)CVE-2022-0785 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
- Product
- Daily Prayer Time
- Fixed in
- 2022.03.01
- What to do
- Update Daily Prayer Time to 2022.03.01 or newer.
Apr 11, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJACVE-2022-0949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 6.930
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 6.930 or newer.
Apr 11, 2022LearnPress: Does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX actionCVE-2022-0271 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- LearnPress
- Fixed in
- 4.1.6
- What to do
- Update LearnPress to 4.1.6 or newer.
Apr 11, 2022settings of the iQ Block Country: Can be exported or imported using its backup functionalityCVE-2022-0246 · WordPress plugins & themes · reported by WPScanMedium 4.9
The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
- Product
- settings of the iQ Block Country
- Fixed in
- 1.2.13
- What to do
- Update settings of the iQ Block Country to 1.2.13 or newer.
Apr 4, 2022Easy Social Icons: Does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statementCVE-2022-0887 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.
- Product
- Easy Social Icons
- Fixed in
- 3.1.4
- What to do
- Update Easy Social Icons to 3.1.4 or newer.
Apr 4, 2022Library File Manager: Is using an outdated version of the elFinder libraryCVE-2022-0403 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.
- Product
- Library File Manager
- Fixed in
- 5.2.3
- What to do
- Update Library File Manager to 5.2.3 or newer.
Mar 31, 2022Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1: Missing authorizationCVE-2022-23183 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
- Product
- Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1
- What to do
- Update Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 to the newest version.
Mar 28, 2022SpeakOut! Email Petitions: Does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX actionCVE-2022-0846 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- SpeakOut! Email Petitions
- Fixed in
- 2.14.15.1
- What to do
- Update SpeakOut! Email Petitions to 2.14.15.1 or newer.
Mar 28, 2022Limit Login Attempts (Spam Protection): Does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users)CVE-2022-0787 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections
- Product
- Limit Login Attempts (Spam Protection)
- Fixed in
- 5.1
- What to do
- Update Limit Login Attempts (Spam Protection) to 5.1 or newer.
Mar 28, 2022Title Experiments Free: Does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users)CVE-2022-0784 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
- Product
- Title Experiments Free
- Fixed in
- 9.0.1
- What to do
- Update Title Experiments Free to 9.0.1 or newer.
Mar 28, 2022Popup Builder: Does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboardCVE-2022-0479 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
- Product
- Popup Builder
- Fixed in
- 4.1.1
- What to do
- Update Popup Builder to 4.1.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 28, 2022Block Bad Bots: Does not properly sanitise and escape the User Agent before using it in a SQL statement to record logsCVE-2021-25070 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue
- Product
- Block Bad Bots
- Fixed in
- 6.88
- What to do
- Update Block Bad Bots to 6.88 or newer.
Mar 21, 2022Simple Link Directory: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0760 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
- Product
- Simple Link Directory
- Fixed in
- 7.7.2
- What to do
- Update Simple Link Directory to 7.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Infographic Maker: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0747 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
- Product
- Infographic Maker
- Fixed in
- 4.3.8
- What to do
- Update Infographic Maker to 4.3.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Advanced Booking Calendar: Does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated useCVE-2022-0694 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.0
- What to do
- Update Advanced Booking Calendar to 1.7.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Event Manager and Tickets Selling for WooCommerce: Does not validate and escape the post_author_gutenberg parameter before using it in a SQL statementCVE-2022-0478 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacks
- Product
- Event Manager and Tickets Selling for WooCommerce
- Fixed in
- 3.5.8
- What to do
- Update Event Manager and Tickets Selling for WooCommerce to 3.5.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
- Product
- WordPress Zero Spam
- Fixed in
- 5.2.11
- What to do
- Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.0
- What to do
- Update Photo Gallery by 10Web to 1.6.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022MOLIE: Does not validate and escape a post parameter before using in a SQL statementCVE-2021-25007 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection
- Product
- MOLIE
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update MOLIE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2022UsersWP: Is missing access controlsCVE-2022-0442 · WordPress plugins & themes · reported by WPScanMedium 4.3
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
- Product
- UsersWP
- Fixed in
- 1.2.3.1
- What to do
- Update UsersWP to 1.2.3.1 or newer.
Mar 7, 2022Page View Count: Does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpointCVE-2022-0434 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks
- Product
- Page View Count
- Fixed in
- 2.4.15
- What to do
- Update Page View Count to 2.4.15 or newer.
Mar 7, 2022WP Cerber Security, Anti-spam & Malware Scan: Does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboardCVE-2022-0429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 8.9.6
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 8.9.6 or newer.
Mar 7, 2022RegistrationMagic: Does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboardCVE-2022-0420 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
- Product
- RegistrationMagic
- Fixed in
- 5.0.2.2
- What to do
- Update RegistrationMagic to 5.0.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022WP Visitor Statistics (Real Time Traffic): Does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX actionCVE-2022-0410 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 5.6
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 5.6 or newer.
Mar 7, 2022NotificationX: Does not sanitise and escape the nx_id parameter before using it in a SQL statementCVE-2022-0349 · WordPress plugins & themes · reported by WPScanCritical 9.8
The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
- Product
- NotificationX
- Fixed in
- 2.3.9
- What to do
- Update NotificationX to 2.3.9 or newer.
Mar 7, 2022AdRotate: Does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to adminsCVE-2022-0267 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
- Product
- AdRotate
- Fixed in
- 5.8.22
- What to do
- Update AdRotate to 5.8.22 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.