Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

472 results · page 9 of 10

Nov 30, 2023YASR – Yet Another Star Rating Plugin for: Time-of-check Time-of-use (TOCTOU) Race ConditionCVE-2023-37867 · WordPress plugins & themes · reported by PatchstackLow 3.7
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue affects YASR – Yet Another Star Rating Plugin for WordPress: from n/a through 3.3.8.
Product
YASR – Yet Another Star Rating Plugin for
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update YASR – Yet Another Star Rating Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023WassUp Real Time Analytics: Does not escape IP address provided via some headers before outputting them back in an admin pageCVE-2023-5653 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins
Product
WassUp Real Time Analytics
Affected
up to 1.9.4.5
What to do
Affects up to 1.9.4.5. Update WassUp Real Time Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions.CVE-2023-47817 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions.
Affected
up to 2023.10.13
What to do
Affects up to 2023.10.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Advanced Local Pickup for WooCommerce: Time-based SQL InjectionCVE-2023-2841 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with admin-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Advanced Local Pickup for WooCommerce
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update Advanced Local Pickup for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.03.08 versions.CVE-2023-27632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.03.08 versions.
Affected
up to 2023.03.08
What to do
Affects up to 2023.03.08. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio PlayeCVE-2023-25989 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 4, 2023Post Timeline: Does not sanitise and escape an invalid nonce before outputting it back in an AJAX responseCVE-2023-4284 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Post Timeline
Fixed in
2.2.6
What to do
Update Post Timeline to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.CVE-2022-45828 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2023WP EasyCart: Time-based SQL InjectionCVE-2023-3023 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP EasyCart plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in versions up to, and including, 5.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level or above permissions, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP EasyCart
Affected
up to 5.4.10
What to do
Affects up to 5.4.10. Update WP EasyCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 1, 2023Cool Timeline (Horizontal & Vertical Timeline): Cross-Site Request ForgeryCVE-2020-36738 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the ctl_save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Cool Timeline (Horizontal & Vertical Timeline)
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Cool Timeline (Horizontal & Vertical Timeline) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 9, 2023Multiple Page Generator: Time-based SQL InjectionCVE-2023-2607 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Multiple Page Generator
Affected
up to 3.3.17
What to do
Affects up to 3.3.17. Update Multiple Page Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Active Directory Integration: Cross-Site Request Forgery leading to time-based SQL InjectionCVE-2023-2599 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to missing nonce verification on the get_users function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to cause resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Product
Active Directory Integration
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Active Directory Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Active Directory Integration: Time-based SQL InjectionCVE-2023-2484 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Active Directory Integration
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Active Directory Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions.CVE-2022-41987 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions.
Affected
up to 3.7.1.6
What to do
Affects up to 3.7.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 16, 2023Multiple Page Generator: Cross-Site Request Forgery leading to time-based SQL InjectionCVE-2023-2608 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Multiple Page Generator Plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 3.3.17 due to missing nonce verification on the projects_list function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries leading to resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link. Version 3.3.18 addresses the SQL Injection, which drastically reduced the severity.
Product
Multiple Page Generator
Affected
up to 3.3.17
What to do
Affects up to 3.3.17. Update Multiple Page Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 15, 2023WP Visitor Statistics (Real Time Traffic): Does not escape user inputCVE-2023-0600 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
6.9
What to do
Update WP Visitor Statistics (Real Time Traffic) to 6.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Pickup | Delivery | Dine-in date time: Does not sanitise and escape some of its settingsCVE-2023-0894 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Pickup | Delivery | Dine-in date time
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Pickup | Delivery | Dine-in date time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Time Sheets: Does not sanitise and escape some of its settingsCVE-2023-0893 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Time Sheets
Fixed in
1.29.3
What to do
Update Time Sheets to 1.29.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Timed Content: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Timed Content
Fixed in
2.73
What to do
Update Timed Content to 2.73 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 17, 2023WP Coder – add custom html, css and js code: Time-based SQL InjectionCVE-2023-0895 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Coder – add custom html, css and js code
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update WP Coder – add custom html, css and js code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 13, 2023WP Visitor Statistics (Real Time Traffic): Does not validate and escape one of its shortcode attributesCVE-2022-4656 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
6.5
What to do
Update WP Visitor Statistics (Real Time Traffic) to 6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023Bold Timeline Lite: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4828 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Bold Timeline Lite
Fixed in
1.1.5
What to do
Update Bold Timeline Lite to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023multimedial images: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4370 · WordPress plugins & themes · reported by WPScanHigh 7.2
The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
Product
multimedial images
Affected
up to 1.0b
What to do
Affects up to 1.0b. Update multimedial images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 5, 2022Clerk: Is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site optionsCVE-2022-3907 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.
Product
Clerk
Fixed in
4.0.0
What to do
Update Clerk to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Salat Times: Does not sanitize and escapes its settingsCVE-2022-2983 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Salat Times
Fixed in
3.2.2
What to do
Update Salat Times to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2022WP 2FA: Uses comparison operators that don't mitigate time-based attacksCVE-2022-2891 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.
Product
WP 2FA
Fixed in
2.3.0
What to do
Update WP 2FA to 2.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.CVE-2022-37328 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 1, 2022Event Timeline: Does not sanitize and escape Timeline TextCVE-2022-1324 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Event Timeline
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Event Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2022-27854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher role via &wpt_test_page_submit_button_caption parameter.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 26, 2022Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with coCVE-2021-36867 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher user rights.
Affected
up to 0.21.19
What to do
Affects up to 0.21.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 18, 2022Daily Prayer Time: Does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users)CVE-2022-0785 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
Product
Daily Prayer Time
Fixed in
2022.03.01
What to do
Update Daily Prayer Time to 2022.03.01 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022WP Visitor Statistics (Real Time Traffic): Does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX actionCVE-2022-0410 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
5.6
What to do
Update WP Visitor Statistics (Real Time Traffic) to 5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022WP Time Slots Booking Form: Does not sanitise and escape Calendar namesCVE-2022-0389 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WP Time Slots Booking Form
Fixed in
1.1.63
What to do
Update WP Time Slots Booking Form to 1.1.63 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2022WP Visitor Statistics (Real Time Traffic): Does not have authorisation and CSRF checks in the updateIpAddress AJAX actionCVE-2021-25042 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
5.5
What to do
Update WP Visitor Statistics (Real Time Traffic) to 5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 24, 2022Backup and Staging by WP Time Capsule: Does not sanitise and escape the error parameter before outputting it back in an admin pageCVE-2021-25035 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.7 does not sanitise and escape the error parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Backup and Staging by WP Time Capsule
Fixed in
1.22.7
What to do
Update Backup and Staging by WP Time Capsule to 1.22.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jan 3, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pagesCVE-2021-25022 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues
Product
UpdraftPlus WordPress Backup
Fixed in
1.16.66
What to do
Update UpdraftPlus WordPress Backup to 1.16.66 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 21, 2021WP Visitor Statistics (Real Time Traffic): Does not properly sanitise and escape the refUrl in the refDetails AJAX actionCVE-2021-24750 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
4.8
What to do
Update WP Visitor Statistics (Real Time Traffic) to 4.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Dec 13, 2021Modern Events Calendar Lite: Does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX actionCVE-2021-24946 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
Product
Modern Events Calendar Lite
Fixed in
6.1.5
What to do
Update Modern Events Calendar Lite to 6.1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com github.com
Nov 29, 2021Bulk Datetime Change: Does not enforce capability checksCVE-2021-24842 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.
Product
Bulk Datetime Change
Fixed in
1.12
What to do
Update Bulk Datetime Change to 1.12 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Visitor Traffic Real Time Statistics: Does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statementCVE-2021-24829 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue
Product
Visitor Traffic Real Time Statistics
Fixed in
3.9
What to do
Update Visitor Traffic Real Time Statistics to 3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 28, 2021Countdown and CountUp, WooCommerce Sales Timers: Cross-Site Request ForgeryCVE-2021-34636 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.7.
Product
Countdown and CountUp, WooCommerce Sales Timers
Affected
up to 1.5.7
What to do
Affects up to 1.5.7. Update Countdown and CountUp, WooCommerce Sales Timers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 27, 2021MX Time Zone Clocks: Does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcodeCVE-2021-24671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
MX Time Zone Clocks
Fixed in
3.4.1
What to do
Update MX Time Zone Clocks to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Timetable and Event Schedule: Outputs the Hashed PasswordCVE-2021-24585 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Timetable and Event Schedule WordPress plugin before 2.4.0 outputs the Hashed Password, Username and Email Address (along other less sensitive data) of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the edit_posts capability. Combined with the other Unauthorised Event Timeslot Modification issue (https://wpscan.com/reports/submissions/4699/) where an arbitrary user ID can be set, this could allow low privilege users with the edit_posts capability (such as author) to retrieve sensitive User data by iterating over the user_id
Product
Timetable and Event Schedule
Fixed in
2.4.0
What to do
Update Timetable and Event Schedule to 2.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24584 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot, allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19, the lack of sanitisation and escaping in some of the fields, like the descritption could also lead to Stored XSS issues
Product
Timetable and Event Schedule
Fixed in
2.4.2
What to do
Update Timetable and Event Schedule to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Timetable and Event Schedule: Does not have proper access controlCVE-2021-24583 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when deleting a timeslot, allowing any user with the edit_posts capability (contributor+) to delete arbitrary timeslot from any events. Furthermore, no CSRF check is in place as well, allowing such attack to be performed via CSRF against a logged in with such capability
Product
Timetable and Event Schedule
Fixed in
2.4.2
What to do
Update Timetable and Event Schedule to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021Timetable and Event Schedule by MotoPress: Does not sanitise some of its parametersCVE-2021-24724 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
Product
Timetable and Event Schedule by MotoPress
Fixed in
2.3.19
What to do
Update Timetable and Event Schedule by MotoPress to 2.3.19 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Sep 13, 2021Daily Prayer Time: Does not sanitise or escape some of its settings before outputting them in the pageCVE-2021-24523 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.
Product
Daily Prayer Time
Fixed in
2021.08.10
What to do
Update Daily Prayer Time to 2021.08.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 23, 2021Timeline Calendar: Does not sanitiseCVE-2021-24553 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin
Product
Timeline Calendar
Affected
up to 1.2
What to do
Affects up to 1.2. Update Timeline Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com wpscan.com
Aug 2, 2021User Registration & User Profile – Profile Builder: Does not sanitise or escape its 'Modify default Redirect Delay timer' settingCVE-2021-24448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Product
User Registration & User Profile – Profile Builder
Fixed in
3.4.8
What to do
Update User Registration & User Profile – Profile Builder to 3.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 1, 2021The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super CaCVE-2021-24312 · WordPress plugins & themes · reported by WPScanHigh 7.2
The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_pages used in the settings of WP Super Cache WordPress plugin before 1.7.3 result in RCE because they allow input of '$' and '\n'. This is due to an incomplete fix of CVE-2021-24209.
Fixed in
1.7.3
What to do
Update the plugin to 1.7.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.