Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,277 results · page 85 of 86
Nov 8, 2021Header Footer Code Manager: Does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statementCVE-2021-24791 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections
- Product
- Header Footer Code Manager
- Fixed in
- 1.1.14
- What to do
- Update Header Footer Code Manager to 1.1.14 or newer.
Nov 8, 2021Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes: Does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpCVE-2021-24731 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection.
- Product
- Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes
- Fixed in
- 3.7.1.6
- What to do
- Update Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes to 3.7.1.6 or newer.
Nov 8, 2021School Management System – WPSchoolPress: Sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributesCVE-2021-24664 · WordPress plugins & themes · reported by WPScanMedium 4.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
- Product
- School Management System – WPSchoolPress
- Fixed in
- 2.1.17
- What to do
- Update School Management System – WPSchoolPress to 2.1.17 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Nov 8, 2021Unlimited PopUps: Does not sanitise or escape the did GET parameter before using it in a SQL statementCVE-2021-24631 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection
- Product
- Unlimited PopUps
- Affected
- up to 4.5.3
- What to do
- Affects up to 4.5.3. Update Unlimited PopUps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 8, 2021Schreikasten: Does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actionsCVE-2021-24630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author
- Product
- Schreikasten
- Affected
- up to 0.14.18
- What to do
- Affects up to 0.14.18. Update Schreikasten to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 8, 2021Post Content XMLRPC: Does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboardCVE-2021-24629 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections
- Product
- Post Content XMLRPC
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Post Content XMLRPC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 8, 2021Wow Forms: Does not sanitise or escape a 'did' GET parameter before using it in a SQL statementCVE-2021-24628 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection
- Product
- Wow Forms
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Wow Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 8, 2021G Auto-Hyperlink: Does not sanitise or escape an 'id' GET parameter before using it in a SQL statementCVE-2021-24627 · WordPress plugins & themes · reported by WPScanHigh 7.2
The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection
- Product
- G Auto-Hyperlink
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update G Auto-Hyperlink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 8, 2021SpiderCatalog: Does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statementCVE-2021-24625 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category
- Product
- SpiderCatalog
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update SpiderCatalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Nov 8, 2021School Management System – WPSchoolPress: Does not properly sanitize or use prepared statements before using POST variable in SQL queriesCVE-2021-24575 · WordPress plugins & themes · reported by WPScanHigh 8.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.
- Product
- School Management System – WPSchoolPress
- Fixed in
- 2.1.10
- What to do
- Update School Management System – WPSchoolPress to 2.1.10 or newer.
Oct 25, 2021WP Debugging: Has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checksCVE-2021-24779 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Debugging WordPress plugin before 2.11.0 has its update_settings() function hooked to admin_init and is missing any authorisation and CSRF checks, as a result, the settings can be updated by unauthenticated users.
- Product
- WP Debugging
- Fixed in
- 2.11.0
- What to do
- Update WP Debugging to 2.11.0 or newer.
Oct 25, 2021Check & Log Email: Does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statementCVE-2021-24774 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
- Product
- Check & Log Email
- Fixed in
- 1.0.3
- What to do
- Update Check & Log Email to 1.0.3 or newer.
Oct 25, 2021Permalink Manager Lite: Does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager pageCVE-2021-24769 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection
- Product
- Permalink Manager Lite
- Fixed in
- 2.2.13.1
- What to do
- Update Permalink Manager Lite to 2.2.13.1 or newer.
Oct 25, 2021Game Server Status: Does not validate or escape the server_id parameter before using it in SQL statementCVE-2021-24662 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authenticated SQL Injection in an admin page
- Product
- Game Server Status
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Game Server Status to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021MainWP Child Reports: Does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboardCVE-2021-24754 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue
- Product
- MainWP Child Reports
- Fixed in
- 2.0.8
- What to do
- Update MainWP Child Reports to 2.0.8 or newer.
Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_creatCVE-2021-38346 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory traversal, and the file contents were populated via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin added a .jpg extension to all uploaded filenames, a double extension attack was still possible, e.g. a file named shell.php would be saved as shell.php.jpg, and would be executable on a number of common configurations.
- Product
- Brizy Page Builder
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Brizy Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admCVE-2021-38345 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127.
- Product
- Brizy Page Builder
- Affected
- up to 2.3.11
- Fixed in
- 1.0.126
- What to do
- Update Brizy Page Builder to 1.0.126 or newer.
Full record and what to do →NVD recordwordfence.comwordfence.com
Oct 4, 2021The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.pCVE-2021-39347 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
- Affected
- 3.0.0 to 3.3.9
- What to do
- Affects 3.0.0 to 3.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 20, 2021Availability Calendar: Does not escape the category attribute from its shortcode before using it in a SQL statementCVE-2021-24606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
- Product
- Availability Calendar
- Fixed in
- 1.2.1
- What to do
- Update Availability Calendar to 1.2.1 or newer.
Sep 6, 2021JiangQie Official Website Mini Program: Does not escape or validate the id GET parameter before using it in SQL statementsCVE-2021-24303 · WordPress plugins & themes · reported by WPScanHigh 8.8
The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues
- Product
- JiangQie Official Website Mini Program
- Fixed in
- 1.1.1
- What to do
- Update JiangQie Official Website Mini Program to 1.1.1 or newer.
Aug 30, 2021Side Menu Lite: Does not sanitise user input from the List page in the admin dashboard before using it in SQL statementCVE-2021-24580 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue
- Product
- Side Menu Lite
- Fixed in
- 2.2.6
- What to do
- Update Side Menu Lite to 2.2.6 or newer.
Aug 23, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not escape the Donation Level setting of its Donation FormsCVE-2021-24524 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.12.0
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.12.0 or newer.
Aug 23, 2021Slider Hero with Animation, Video Background & Intro Maker: Does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statementCVE-2021-24506 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
- Product
- Slider Hero with Animation, Video Background & Intro Maker
- Fixed in
- 8.2.7
- What to do
- Update Slider Hero with Animation, Video Background & Intro Maker to 8.2.7 or newer.
Aug 9, 2021Stock in & out: Lacks proper sanitization before passing variables to an SQL requestCVE-2021-24520 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Stock in & out WordPress plugin through 1.0.4 lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection attacks. Users with a role of contributor or higher can exploit this vulnerability.
- Product
- Stock in & out
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Stock in & out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 9, 2021Workreap: Had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations suchCVE-2021-24501 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site.
- Product
- Workreap
- Fixed in
- 2.2.2
- What to do
- Update Workreap to 2.2.2 or newer.
Aug 2, 2021get_reports() function in the Secure Copy Content Protection and Content Locking: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24484 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_reports() function in the Secure Copy Content Protection and Content Locking
- Fixed in
- 2.6.7
- What to do
- Update get_reports() function in the Secure Copy Content Protection and Content Locking to 2.6.7 or newer.
Aug 2, 2021get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24483 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker
- Fixed in
- 3.2.1
- What to do
- Update get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker to 3.2.1 or newer.
Aug 2, 2021get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24463 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel
- Fixed in
- 2.5.0
- What to do
- Update get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel to 2.5.0 or newer.
Aug 2, 2021get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_rCVE-2021-24462 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery
- Fixed in
- 4.4.4
- What to do
- Update get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery to 4.4.4 or newer.
Aug 2, 2021get_faqs() function in the FAQ Builder AYS: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24461 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_faqs() function in the FAQ Builder AYS
- Fixed in
- 1.3.6
- What to do
- Update get_faqs() function in the FAQ Builder AYS to 1.3.6 or newer.
Aug 2, 2021get_fb_likeboxes() function in the Popup Like box – Page: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24460 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_fb_likeboxes() function in the Popup Like box – Page
- Fixed in
- 3.5.3
- What to do
- Update get_fb_likeboxes() function in the Popup Like box – Page to 3.5.3 or newer.
Aug 2, 2021get_results() and get_items() functions in the Survey Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24459 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_results() and get_items() functions in the Survey Maker
- Fixed in
- 1.5.6
- What to do
- Update get_results() and get_items() functions in the Survey Maker to 1.5.6 or newer.
Aug 2, 2021get_ays_popupboxes() and get_popup_categories() functions of the Popup box: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24458 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_ays_popupboxes() and get_popup_categories() functions of the Popup box
- Fixed in
- 2.3.4
- What to do
- Update get_ays_popupboxes() and get_popup_categories() functions of the Popup box to 2.3.4 or newer.
Aug 2, 2021Quiz Maker: Did not properly sanitise and escape the order and orderby parameters before using them in SQL statementsCVE-2021-24456 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard
- Product
- Quiz Maker
- Fixed in
- 6.2.0.9
- What to do
- Update Quiz Maker to 6.2.0.9 or newer.
Jul 19, 2021WP Image Zoom: Did not validate its tab parameter before using it in the include_once() functionCVE-2021-24447 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to a local file inclusion issue in the admin dashboard
- Product
- WP Image Zoom
- Fixed in
- 1.47
- What to do
- Update WP Image Zoom to 1.47 or newer.
Jul 6, 2021Export Users With Meta: Did not escape the list of roles to export before using them in a SQL statement in the export functionalityCVE-2021-24451 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export Users With Meta WordPress plugin before 0.6.5 did not escape the list of roles to export before using them in a SQL statement in the export functionality, available to admins, leading to an authenticated SQL Injection.
- Product
- Export Users With Meta
- Fixed in
- 0.6.5
- What to do
- Update Export Users With Meta to 0.6.5 or newer.
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameterCVE-2021-24338 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 14, 2021Yes/No Chart: Did not sanitise its sid shortcode parameter before using it in a SQL statementCVE-2021-24360 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege users (contributor+) to perform Blind SQL Injection attacks
- Product
- Yes/No Chart
- Fixed in
- 1.0.12
- What to do
- Update Yes/No Chart to 1.0.12 or newer.
Jun 7, 2021WP Statistics: Relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the queryCVE-2021-24340 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
- Product
- WP Statistics
- Fixed in
- 13.0.8
- What to do
- Update WP Statistics to 13.0.8 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jun 7, 2021The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped beforeCVE-2021-24337 · WordPress plugins & themes · reported by WPScanHigh 8.8
The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.
- Product
- Video Embed
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Video Embed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
May 24, 2021Autoptimize: Was missing proper escaping and sanitisation in some of its settingsCVE-2021-24332 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
- Product
- Autoptimize
- Fixed in
- 2.8.4
- What to do
- Update Autoptimize to 2.8.4 or newer.
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.4
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
May 17, 2021When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized.CVE-2021-24288 · WordPress plugins & themes · reported by WPScanMedium 6.1
When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim.
- Fixed in
- 7.5.0
- What to do
- Update the plugin to 7.5.0 or newer.
Apr 22, 2021Business Hours Pro: Allows a remote attacker to upload arbitrary files using its manual update functionalityCVE-2021-24240 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.
- Product
- Business Hours Pro
- Affected
- up to 5.5.0
- What to do
- Affects up to 5.5.0. Update Business Hours Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Apr 12, 2021GiveWP – Donation Plugin and Fundraising Platform: Was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panelCVE-2021-24213 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.0 was affected by a reflected Cross-Site Scripting vulnerability inside of the administration panel, via the 's' GET parameter on the Donors page.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.0
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.0 or newer.
Apr 5, 2021WooCommerce Upload Files: Ran a single sanitization pass to remove blocked extensions suchCVE-2021-24171 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter.
- Product
- WooCommerce Upload Files
- Fixed in
- 59.4
- What to do
- Update WooCommerce Upload Files to 59.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 5, 2021Theme Editor: Did not validate the GET file parameter before passing it to the download_file() functionCVE-2021-24154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd
- Product
- Theme Editor
- Fixed in
- 2.6
- What to do
- Update Theme Editor to 2.6 or newer.
Nov 2, 2020wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.CVE-2020-28036 · WordPress plugins & themes · reported by MITRECritical 9.8
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordgithub.comlists.debian.org
Oct 7, 2020The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wCVE-2020-26876 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).
- Product
- wp-courses
- Affected
- up to 2.0.27
- What to do
- Affects up to 2.0.27. Update wp-courses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 10, 2020Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticCVE-2020-5780 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.3
Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.
- Fixed in
- 4.5.6
- What to do
- Update the plugin to 4.5.6 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.