Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
463 results · page 9 of 10
Mar 7, 2022Email Subscribers & Newsletters: Does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` actionCVE-2022-0439 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
- Product
- Email Subscribers & Newsletters
- Fixed in
- 5.3.2
- What to do
- Update Email Subscribers & Newsletters to 5.3.2 or newer.
Feb 21, 2022WOOCS: Does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the respCVE-2022-0234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- WOOCS
- Fixed in
- 1.3.7.5
- What to do
- Update WOOCS to 1.3.7.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
- Product
- Popup Builder
- Fixed in
- 4.0.7
- What to do
- Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Rearrange Woocommerce Products: Does not have proper access controls in the save_all_order AJAX actionCVE-2021-24928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.
- Product
- Rearrange Woocommerce Products
- Fixed in
- 3.0.8
- What to do
- Update Rearrange Woocommerce Products to 3.0.8 or newer.
Feb 1, 2022Wicked Folders: Does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX actionCVE-2021-24919 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection
- Product
- Wicked Folders
- Fixed in
- 2.8.10
- What to do
- Update Wicked Folders to 2.8.10 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Orders Tracking for WooCommerce: Does not sanitise and escape the file_url before outputting it back in an admin pageCVE-2021-25062 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Orders Tracking for WooCommerce WordPress plugin before 1.1.10 does not sanitise and escape the file_url before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Orders Tracking for WooCommerce
- Fixed in
- 1.1.10
- What to do
- Update Orders Tracking for WooCommerce to 1.1.10 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 24, 2022Advanced Custom Fields: Extended: Does not validate the order and orderby parameters before using them in a SQL statementCVE-2021-24865 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters before using them in a SQL statement, leading to a SQL Injection issue
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.8.8.7
- What to do
- Update Advanced Custom Fields: Extended to 0.8.8.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 3, 2022Download Monitor: Does not properly validate and escape the "orderby" GET parameter before using it in a SQL statementCVE-2021-24786 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
- Product
- Download Monitor
- Fixed in
- 4.4.5
- What to do
- Update Download Monitor to 4.4.5 or newer.
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Tickera
- Fixed in
- 3.4.8.3
- What to do
- Update Tickera to 3.4.8.3 or newer.
Dec 27, 2021Rich Reviews by Starfish: Does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statementCVE-2021-24753 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
- Product
- Rich Reviews by Starfish
- Fixed in
- 1.9.6
- What to do
- Update Rich Reviews by Starfish to 1.9.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 21, 2021The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenCVE-2021-24846 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber
- Product
- Ni WooCommerce Custom Order Status
- Fixed in
- 1.9.7
- What to do
- Update Ni WooCommerce Custom Order Status to 1.9.7 or newer.
Nov 29, 2021BSK PDF Manager: Does not validate and escape the orderby and order parameters before using them in a SQL statementCVE-2021-24860 · WordPress plugins & themes · reported by WPScanHigh 7.2
The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue
- Product
- BSK PDF Manager
- Fixed in
- 3.1.2
- What to do
- Update BSK PDF Manager to 3.1.2 or newer.
Nov 29, 2021Email Before Download: Does not properly validate and escape the order and orderby GET parameters before using them in SQL statementsCVE-2021-24748 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
- Product
- Email Before Download
- Fixed in
- 6.8
- What to do
- Update Email Before Download to 6.8 or newer.
Nov 23, 2021MainWP Child: Does not validate the orderby and order parameter before using them in a SQL statementCVE-2021-24877 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
- Product
- MainWP Child
- Fixed in
- 4.1.8
- What to do
- Update MainWP Child to 4.1.8 or newer.
Nov 17, 2021Stream: Does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statementCVE-2021-24772 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue.
- Product
- Stream
- Fixed in
- 3.8.2
- What to do
- Update Stream to 3.8.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 8, 2021Affiliates Manager: Does not validate the orderby parameter before using it in an SQL statement in the admin dashboardCVE-2021-24844 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue
- Product
- Affiliates Manager
- Fixed in
- 2.8.7
- What to do
- Update Affiliates Manager to 2.8.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 8, 2021Header Footer Code Manager: Does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statementCVE-2021-24791 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections
- Product
- Header Footer Code Manager
- Fixed in
- 1.1.14
- What to do
- Update Header Footer Code Manager to 1.1.14 or newer.
Nov 8, 2021SpiderCatalog: Does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statementCVE-2021-24625 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category
- Product
- SpiderCatalog
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update SpiderCatalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Oct 25, 2021Check & Log Email: Does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statementCVE-2021-24774 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameters before using them in a SQL statement when viewing logs, leading to SQL injections issues
- Product
- Check & Log Email
- Fixed in
- 1.0.3
- What to do
- Update Check & Log Email to 1.0.3 or newer.
Oct 25, 2021Permalink Manager Lite: Does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager pageCVE-2021-24769 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before using it in a SQL statement in the Permalink Manager page, leading to a SQL Injection
- Product
- Permalink Manager Lite
- Fixed in
- 2.2.13.1
- What to do
- Update Permalink Manager Lite to 2.2.13.1 or newer.
Oct 18, 2021MainWP Child Reports: Does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboardCVE-2021-24754 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue
- Product
- MainWP Child Reports
- Fixed in
- 2.0.8
- What to do
- Update MainWP Child Reports to 2.0.8 or newer.
Sep 20, 2021The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before insertinCVE-2021-24403 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Orders functionality in the WordPress Page Contact plugin through 1.0 has an order_id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
- Product
- Orders functionality in the WordPress Page Contact
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Orders functionality in the WordPress Page Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 20, 2021Orders functionality in the WP iCommerce: Has an `order_id` parameterCVE-2021-24402 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Orders functionality in the WP iCommerce WordPress plugin through 1.1.1 has an `order_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. The feature is available to low privilege users such as contributors
- Product
- Orders functionality in the WP iCommerce
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Orders functionality in the WP iCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 20, 2021check_order function of The Sorter: Uses an `area_id` parameterCVE-2021-24399 · WordPress plugins & themes · reported by WPScanHigh 7.2
The check_order function of The Sorter WordPress plugin through 1.0 uses an `area_id` parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- check_order function of The Sorter
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update check_order function of The Sorter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 13, 2021StopBadBots: Did not validate or escape the order and orderby GET parameter in some of its admin dashboard pagesCVE-2021-24727 · WordPress plugins & themes · reported by WPScanHigh 8.8
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
- Product
- StopBadBots
- Fixed in
- 6.60
- What to do
- Update StopBadBots to 6.60 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 10, 2021Border Loading Bar: Reflected Cross-Site ScriptingCVE-2021-38338 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
- Product
- Border Loading Bar
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Border Loading Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2021SMS Alert Order Notifications: Is affected by a cross site scripting (XSS) vulnerability in the plugin's setting pageCVE-2021-24588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's setting page.
- Product
- SMS Alert Order Notifications
- Fixed in
- 3.4.7
- What to do
- Update SMS Alert Order Notifications to 3.4.7 or newer.
Aug 16, 2021Video Posts Webcam Recorder: Has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videosCVE-2021-24512 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
- Product
- Video Posts Webcam Recorder
- Fixed in
- 3.2.4
- What to do
- Update Video Posts Webcam Recorder to 3.2.4 or newer.
Aug 2, 2021get_reports() function in the Secure Copy Content Protection and Content Locking: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24484 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_reports() function in the Secure Copy Content Protection and Content Locking WordPress plugin before 2.6.7 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_reports() function in the Secure Copy Content Protection and Content Locking
- Fixed in
- 2.6.7
- What to do
- Update get_reports() function in the Secure Copy Content Protection and Content Locking to 2.6.7 or newer.
Aug 2, 2021get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24483 · WordPress plugins & themes · reported by WPScanHigh 7.2
The get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker WordPress plugin before 3.2.1 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker
- Fixed in
- 3.2.1
- What to do
- Update get_poll_categories(), get_polls() and get_reports() functions in the Poll Maker to 3.2.1 or newer.
Aug 2, 2021get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24463 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel
- Fixed in
- 2.5.0
- What to do
- Update get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel to 2.5.0 or newer.
Aug 2, 2021get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_rCVE-2021-24462 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery WordPress plugin before 4.4.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery
- Fixed in
- 4.4.4
- What to do
- Update get_gallery_categories() and get_galleries() functions in the Photo Gallery by Ays – Responsive Image Gallery to 4.4.4 or newer.
Aug 2, 2021get_faqs() function in the FAQ Builder AYS: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24461 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_faqs() function in the FAQ Builder AYS WordPress plugin before 1.3.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_faqs() function in the FAQ Builder AYS
- Fixed in
- 1.3.6
- What to do
- Update get_faqs() function in the FAQ Builder AYS to 1.3.6 or newer.
Aug 2, 2021get_fb_likeboxes() function in the Popup Like box – Page: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24460 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_fb_likeboxes() function in the Popup Like box – Page Plugin WordPress plugin before 3.5.3 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_fb_likeboxes() function in the Popup Like box – Page
- Fixed in
- 3.5.3
- What to do
- Update get_fb_likeboxes() function in the Popup Like box – Page to 3.5.3 or newer.
Aug 2, 2021get_results() and get_items() functions in the Survey Maker: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24459 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_results() and get_items() functions in the Survey Maker WordPress plugin before 1.5.6 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_results() and get_items() functions in the Survey Maker
- Fixed in
- 1.5.6
- What to do
- Update get_results() and get_items() functions in the Survey Maker to 1.5.6 or newer.
Aug 2, 2021get_ays_popupboxes() and get_popup_categories() functions of the Popup box: Did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB callsCVE-2021-24458 · WordPress plugins & themes · reported by WPScanHigh 8.8
The get_ays_popupboxes() and get_popup_categories() functions of the Popup box WordPress plugin before 2.3.4 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard
- Product
- get_ays_popupboxes() and get_popup_categories() functions of the Popup box
- Fixed in
- 2.3.4
- What to do
- Update get_ays_popupboxes() and get_popup_categories() functions of the Popup box to 2.3.4 or newer.
Aug 2, 2021Quiz Maker: Did not properly sanitise and escape the order and orderby parameters before using them in SQL statementsCVE-2021-24456 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quiz Maker WordPress plugin before 6.2.0.9 did not properly sanitise and escape the order and orderby parameters before using them in SQL statements, leading to SQL injection issues in the admin dashboard
- Product
- Quiz Maker
- Fixed in
- 6.2.0.9
- What to do
- Update Quiz Maker to 6.2.0.9 or newer.
Apr 12, 2021In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcodCVE-2021-24226 · WordPress plugins & themes · reported by WPScanHigh 7.5
In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.
- Product
- AccessAlly
- Fixed in
- 3.5.7
- What to do
- Update AccessAlly to 3.5.7 or newer.
Apr 5, 2021This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data.CVE-2021-24169 · WordPress plugins & themes · reported by WPScanMedium 6.1
This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.
- Fixed in
- 3.1.8
- What to do
- Update the plugin to 3.1.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Mar 31, 2021Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.CVE-2021-27349 · WordPress plugins & themes · reported by MITREMedium 6.1
Advanced Order Export before 3.1.8 for WooCommerce allows XSS, a different vulnerability than CVE-2020-11727.
- Fixed in
- 3.1.8
- What to do
- Update the plugin to 3.1.8 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Feb 7, 2021wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.CVE-2021-26754 · WordPress plugins & themes · reported by MITRECritical 9.8
wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.
- Fixed in
- 3.4.1
- What to do
- Update the plugin to 3.4.1 or newer.
Full record and what to do →NVD recordn4nj0.github.iowordpress.org
Dec 27, 2020The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_staCVE-2020-29156 · WordPress plugins & themes · reported by MITREMedium 5.3
The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.
- Product
- WooCommerce
- Fixed in
- 4.7.0
- What to do
- Update WooCommerce to 4.7.0 or newer.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
Jun 28, 2020The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.CVE-2020-15363 · WordPress plugins & themes · reported by MITRECritical 9.8
The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.
- Product
- Nexos
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Nexos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 18, 2020A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order paCVE-2020-13640 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)
- Product
- gVectors wpDiscuz
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update gVectors wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.complugins.trac.wordpress.org
May 6, 2020A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject aCVE-2020-11727 · WordPress plugins & themes · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.
- Product
- AlgolPlus Advanced Order Export For WooCommerce
- Affected
- 3.1.3 to 3.1.3
- What to do
- Affects 3.1.3 to 3.1.3. Update AlgolPlus Advanced Order Export For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Dec 27, 2019Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116CVE-2014-4567 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in comments/videowhisper2/r_logout.php in the Video Comments Webcam Recorder plugin 1.55, as downloaded before 20140116 for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
- Product
- Video Comments Webcam Recorder
- Fixed in
- 20140116
- What to do
- Update Video Comments Webcam Recorder to 20140116 or newer.
Full record and what to do →NVD recordcodevigilant.complugins.trac.wordpress.org
Oct 23, 2019The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5CVE-2015-9507 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Sep 13, 2019The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.CVE-2017-18614 · WordPress plugins & themes · reported by MITREHigh 8.1
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseclists.orgwordpress.org
Sep 13, 2019The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.CVE-2016-10940 · WordPress plugins & themes · reported by MITREHigh 7.2
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
- Affected
- 1.0 to 1.0
- What to do
- Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlenonleite.com.brwordpress.org
Sep 3, 2019The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] paramCVE-2019-15889 · WordPress plugins & themes · reported by MITREMedium 6.1
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.
- Product
- download-manager
- Fixed in
- 2.9.94
- What to do
- Update download-manager to 2.9.94 or newer.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.