Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
498 results · page 9 of 10
Nov 17, 2021Insert Pages: Adds a shortcode that prints out other pages' content and custom fieldsCVE-2021-24850 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields.
- Product
- Insert Pages
- Fixed in
- 3.7.0
- What to do
- Update Insert Pages to 3.7.0 or newer.
Nov 17, 2021Accept Donations with PayPal: Does not escape the Amount Menu Name field of created ButtonsCVE-2021-24815 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.2
- What to do
- Update Accept Donations with PayPal to 1.3.2 or newer.
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
- Product
- My Tickets
- Fixed in
- 1.8.31
- What to do
- Update My Tickets to 1.8.31 or newer.
Nov 17, 2021Testimonial: Does not escape some testimonial fieldsCVE-2021-24598 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Testimonial
- Fixed in
- 1.6.0
- What to do
- Update Testimonial to 1.6.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 8, 2021Support Board: Allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes fieldCVE-2021-24807 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
- Product
- Support Board
- Fixed in
- 3.3.5
- What to do
- Update Support Board to 3.3.5 or newer.
Nov 8, 2021Quiz Tool Lite: Does not sanitize multiple input fields usedCVE-2021-24701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in other setting options, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Quiz Tool Lite
- Affected
- up to 2.3.15
- What to do
- Affects up to 2.3.15. Update Quiz Tool Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2021School Management System – WPSchoolPress: Sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributesCVE-2021-24664 · WordPress plugins & themes · reported by WPScanMedium 4.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
- Product
- School Management System – WPSchoolPress
- Fixed in
- 2.1.17
- What to do
- Update School Management System – WPSchoolPress to 2.1.17 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Nov 1, 2021Events Made Easy: Does not sanitise and escape Custom Field NamesCVE-2021-24813 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Events Made Easy
- Fixed in
- 2.2.24
- What to do
- Update Events Made Easy to 2.2.24 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021BP Better Messages: Sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attributeCVE-2021-24808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- BP Better Messages
- Fixed in
- 1.9.9.41
- What to do
- Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 1, 2021Connections Business Directory: Does not validate or sanitise some connections' fieldsCVE-2020-36503 · WordPress plugins & themes · reported by WPScanHigh 8
The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields, which could lead to a CSV injection issue
- Product
- Connections Business Directory
- Fixed in
- 9.7
- What to do
- Update Connections Business Directory to 9.7 or newer.
Oct 25, 2021Great Quotes: Does not sanitise and escape the Quote and Author fields of its QuotesCVE-2021-24785 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Great Quotes
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Great Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.5.8.2
- What to do
- Update Ninja Forms Contact Form to 3.5.8.2 or newer.
Oct 18, 2021Customer Service Software & Support Ticket System: Does not sanitize or escape form fields before outputting it in the ListCVE-2021-24622 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Customer Service Software & Support Ticket System
- Fixed in
- 5.10.4
- What to do
- Update Customer Service Software & Support Ticket System to 5.10.4 or newer.
Sep 20, 2021youForms for: Does not sanitise escape the Button Text field of its TemplatesCVE-2021-24596 · WordPress plugins & themes · reported by WPScanMedium 4.8
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users (editors and admins) to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- youForms for
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update youForms for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2021KN Fix Your Title: Was vulnerable to Authenticated Stored XSS in the separator fieldCVE-2021-24547 · WordPress plugins & themes · reported by WPScanMedium 5.4
The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field.
- Product
- KN Fix Your Title
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update KN Fix Your Title to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2021Grid Gallery – Photo Image Grid Gallery: Does not properly sanitize the title field for image galleriesCVE-2021-24529 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability.
- Product
- Grid Gallery – Photo Image Grid Gallery
- Fixed in
- 1.2.5
- What to do
- Update Grid Gallery – Photo Image Grid Gallery to 1.2.5 or newer.
Aug 16, 2021Mimetic Books: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings pageCVE-2021-24548 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page.
- Product
- Mimetic Books
- Affected
- up to 0.2.13
- What to do
- Affects up to 0.2.13. Update Mimetic Books to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2021VikRentCar Car Rental Management System: Does not sanitise the 'Text Next to Icon' fieldCVE-2021-24519 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- VikRentCar Car Rental Management System
- Fixed in
- 1.1.10
- What to do
- Update VikRentCar Car Rental Management System to 1.1.10 or newer.
Aug 16, 2021My Site Audit: Does not sanitise or escape the Audit Name fieldCVE-2021-24445 · WordPress plugins & themes · reported by WPScanMedium 5.5
The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- My Site Audit
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update My Site Audit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2021Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.CVE-2021-28121 · WordPress plugins & themes · reported by MITRECritical 9.8
Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.
- Fixed in
- 1.10
- What to do
- Update the plugin to 1.10 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 9, 2021Forms: Did not sanitise its input fieldsCVE-2021-24505 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field.
- Product
- Forms
- Fixed in
- 1.12.3
- What to do
- Update Forms to 1.12.3 or newer.
Aug 2, 2021WP LMS – Best WordPress LMS: Does not properly sanitise or validate its User Field TitlesCVE-2021-24504 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)
- Product
- WP LMS – Best WordPress LMS
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP LMS – Best WordPress LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
- Product
- Tutor LMS – eLearning and online course solution
- Fixed in
- 1.9.2
- What to do
- Update Tutor LMS – eLearning and online course solution to 1.9.2 or newer.
Aug 2, 2021TaxoPress – Create and Manage Taxonomies, Tags, Categories: Does not sanitise its Taxonomy description fieldCVE-2021-24444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.
- Product
- TaxoPress – Create and Manage Taxonomies, Tags, Categories
- Fixed in
- 3.0.7.2
- What to do
- Update TaxoPress – Create and Manage Taxonomies, Tags, Categories to 3.0.7.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Aug 2, 2021About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Does not properly sanitise its Biography fieldCVE-2021-24443 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
- Product
- About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership
- Fixed in
- 1.0.7
- What to do
- Update About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership to 1.0.7 or newer.
Jul 12, 2021Sign-up Sheets: Did not sanitise or escape some of its fieldsCVE-2021-24440 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in the admin dashboard
- Product
- Sign-up Sheets
- Fixed in
- 1.0.14
- What to do
- Update Sign-up Sheets to 1.0.14 or newer.
Jul 12, 2021Salon booking system: Does not properly sanitise and escape the First Name fieldCVE-2021-24429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.
- Product
- Salon booking system
- Fixed in
- 6.3.1
- What to do
- Update Salon booking system to 6.3.1 or newer.
Jul 12, 2021Request a Quote: Did not sanitise and escape some of its quote fieldsCVE-2021-24420 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table.
- Product
- Request a Quote
- Fixed in
- 2.3.4
- What to do
- Update Request a Quote to 2.3.4 or newer.
Jul 7, 2021Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.CVE-2020-24147 · WordPress plugins & themes · reported by MITRECritical 9.1
Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.
- Product
- WP Smart Import (wp-smart-import)
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update WP Smart Import (wp-smart-import) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Jul 6, 2021WP Offload SES Lite: Did not escape some of the fields in the Activity page of the admin dashboardCVE-2021-24494 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the subject when filling a contact form for example. The XSS will be executed in the context of a logged in admin viewing the Activity tab of the plugin.
- Product
- WP Offload SES Lite
- Fixed in
- 1.4.5
- What to do
- Update WP Offload SES Lite to 1.4.5 or newer.
Jul 6, 2021In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the userCVE-2021-24388 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However, the field name is not sanitised or escaped before being output back in the page, leading to a stored Cross-Site Scripting issue. There is also no CSRF check done before saving the setting, allowing attackers to make a logged in admin set arbitrary Custom Fields, including one with XSS payload in it.
- Product
- VikRentCar Car Rental Management System
- Fixed in
- 1.1.7
- What to do
- Update VikRentCar Car Rental Management System to 1.1.7 or newer.
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameterCVE-2021-24339 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameterCVE-2021-24338 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 14, 2021In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitisedCVE-2021-24357 · WordPress plugins & themes · reported by WPScanMedium 5.4
In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue.
- Product
- Best Image Gallery & Responsive Photo Gallery – FooGallery
- Fixed in
- 2.0.35
- What to do
- Update Best Image Gallery & Responsive Photo Gallery – FooGallery to 2.0.35 or newer.
Jun 14, 2021theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder: Did not properly sanitise some of its fieldsCVE-2021-24351 · WordPress plugins & themes · reported by WPScanMedium 6.1
The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users)
- Product
- theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder
- Fixed in
- 4.1.12
- What to do
- Update theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder to 4.1.12 or newer.
Full record and what to do →NVD recordtheplusaddons.comwpscan.com
Jun 7, 2021Easy Preloader: Does not sanitise its setting fieldsCVE-2021-24344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues
- Product
- Easy Preloader
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Easy Preloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2021WP Statistics: Relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the queryCVE-2021-24340 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.
- Product
- WP Statistics
- Fixed in
- 13.0.8
- What to do
- Update WP Statistics to 13.0.8 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Jun 1, 2021Bello - Directory & Listing: Did not sanitise the bt_bb_listing_field_price_range_toCVE-2021-24321 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issues
- Product
- Bello - Directory & Listing
- Fixed in
- 1.6.0
- What to do
- Update Bello - Directory & Listing to 1.6.0 or newer.
May 24, 2021The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4CVE-2021-24308 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.
- Fixed in
- 4.21.1
- What to do
- Update the plugin to 4.21.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 24, 2021Hana Flv Player: Is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' fieldCVE-2021-24302 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field.
- Product
- Hana Flv Player
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Hana Flv Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2021SEO Redirection Plugin – 301 Redirect Manager: Did not sanitise the Redirect From and Redirect To fieldsCVE-2021-24327 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users (even with the unfiltered_html disabled) to set XSS payloads
- Product
- SEO Redirection Plugin – 301 Redirect Manager
- Fixed in
- 6.4
- What to do
- Update SEO Redirection Plugin – 301 Redirect Manager to 6.4 or newer.
May 17, 2021When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high CVE-2021-24323 · WordPress plugins & themes · reported by WPScanMedium 4.8
When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output back in the admin dashboard, allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled
- Fixed in
- 5.2.0
- What to do
- Update the plugin to 5.2.0 or newer.
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.4
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
May 6, 2021Business Directory Plugin – Easy Listing Directories for: Suffered from lack of sanitisation in the label of the Form FieldsCVE-2021-24250 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from lack of sanitisation in the label of the Form Fields, leading to Authenticated Stored Cross-Site Scripting issues across various pages of the plugin.
- Product
- Business Directory Plugin – Easy Listing Directories for
- Fixed in
- 5.11.2
- What to do
- Update Business Directory Plugin – Easy Listing Directories for to 5.11.2 or newer.
Apr 22, 2021Advanced Custom Fields Pro: Did not properly escape the generated update URLCVE-2021-24241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.
- Product
- Advanced Custom Fields Pro
- Fixed in
- 5.9.1
- What to do
- Update Advanced Custom Fields Pro to 5.9.1 or newer.
Apr 5, 2021The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page.CVE-2021-24211 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.
- Product
- WordPress Related Posts
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update WordPress Related Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2021Easy Contact Form Pro: Did not properly sanitise the text fields (suchCVE-2021-24168 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium privilege accounts (such as author and editor) to perform XSS attacks against high privilege ones like administrator.
- Product
- Easy Contact Form Pro
- Fixed in
- 1.1.1.9
- What to do
- Update Easy Contact Form Pro to 1.1.1.9 or newer.
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.CVE-2020-36175 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
- Product
- Ninja Forms
- Fixed in
- 3.4.27.1
- What to do
- Update Ninja Forms to 3.4.27.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 6, 2021The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.CVE-2020-36173 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
- Product
- Ninja Forms
- Fixed in
- 3.4.28
- What to do
- Update Ninja Forms to 3.4.28 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 6, 2021The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.CVE-2020-36172 · WordPress plugins & themes · reported by MITREMedium 6.1
The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.
- Product
- Advanced Custom Fields
- Fixed in
- 5.8.12
- What to do
- Update Advanced Custom Fields to 5.8.12 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.