Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

523new WordPress flaws this week

391,883entries in the database

4,962 results · page 96 of 100

Apr 18, 2022Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9CVE-2022-27853 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9
Affected
up to 13.1.0.9
What to do
Affects up to 13.1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 15, 2022Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions.CVE-2022-27852 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions.
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions.CVE-2021-36828 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions.
Affected
up to 6.0.7
What to do
Affects up to 6.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 14, 2022Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1CVE-2022-27848 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1
Affected
up to 6.5.1
What to do
Affects up to 6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 11, 2022Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2CVE-2022-27845 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 11, 2022Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.CVE-2021-36910 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.
Affected
up to 4.3.20
What to do
Affects up to 4.3.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 11, 2022Pricing Table: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS)CVE-2021-36896 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2
Product
Pricing Table
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 11, 2022Responsive Tabs: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS)CVE-2021-36893 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress plugin) <= 4.0.5
Product
Responsive Tabs
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Responsive Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 11, 2022Social Media Feather: Authenticated (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36848 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Feather (WordPress plugin) versions <= 2.0.4
Product
Social Media Feather
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Social Media Feather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 11, 2022Premio Chaty: Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS)CVE-2021-36846 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3
Product
Premio Chaty
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update Premio Chaty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 4, 2022wpDataTables: Authenticated (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-25618 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27
Product
wpDataTables
Affected
up to 2.1.27
What to do
Affects up to 2.1.27. Update wpDataTables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 4, 2022Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager pluginCVE-2021-36826 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions.
Affected
up to 2.4.13
What to do
Affects up to 2.4.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 25, 2022Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malCVE-2022-25611 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated Stored Cross-Site Scripting (XSS) in Simple Event Planner plugin <= 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter &custom[add_seg][].
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 25, 2022Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code.CVE-2022-25610 · WordPress plugins & themes · reported by PatchstackLow 3.4
Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit.
Affected
up to 20220115
What to do
Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 25, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25606 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vulnerable parameters &download_path, &download_path_url, &download_page_url, &download_categories.
Affected
up to 1.68.6
What to do
Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 23, 2022Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to injectCVE-2022-25609 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 21, 2022Amelia: Stores image blobs into actual files whose extension is controlled by the userCVE-2022-0687 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
Product
Amelia
Fixed in
1.0.47
What to do
Update Amelia to 1.0.47 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6).CVE-2022-25605 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities discovered in WP-DownloadManager WordPress plugin (versions <= 1.68.6). Vvulnerable parameters &download_path, &download_path_url, &download_page_url.
Affected
up to 1.68.6
What to do
Affects up to 1.68.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2).CVE-2022-25604 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor of higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Price Table plugin (versions <= 0.2.2).
Affected
up to 0.2.2
What to do
Affects up to 0.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).CVE-2022-25603 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5).
Affected
6.2.5 to 6.2.5
What to do
Affects 6.2.5 to 6.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 18, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.CVE-2021-23150 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 versions.
Affected
up to 1.0.77.31
What to do
Affects up to 1.0.77.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 7, 2022test parameter of the xmlfeed in the Tradetracker-Store: Is not sanitisedCVE-2021-24778 · WordPress plugins & themes · reported by WPScanHigh 7.2
The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Product
test parameter of the xmlfeed in the Tradetracker-Store
Fixed in
4.6.60
What to do
Update test parameter of the xmlfeed in the Tradetracker-Store to 4.6.60 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).CVE-2021-26256 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <= 2.0.6).
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
Product
Buffer Button
Affected
up to 1.0
What to do
Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Translation Exchange: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settingsCVE-2021-25057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) within the Project Key text field found in the plugin's settings.
Product
Translation Exchange
Affected
up to 1.0.14
What to do
Affects up to 1.0.14. Update Translation Exchange to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022WP Photo Album Plus: Was vulnerable to Stored Cross-Site Scripting (XSS)CVE-2021-25115 · WordPress plugins & themes · reported by WPScanMedium 6.4
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
Product
WP Photo Album Plus
Fixed in
8.0.10
What to do
Update WP Photo Album Plus to 8.0.10 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022Form Store to DB: Does not sanitise and escape parameter keys before outputting it back in the created entryCVE-2021-25107 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
Product
Form Store to DB
Fixed in
1.1.1
What to do
Update Form Store to DB to 1.1.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022WooCommerce Stored Exporter: Was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin pageCVE-2022-0149 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
Product
WooCommerce Stored Exporter
Fixed in
2.7.1
What to do
Update WooCommerce Stored Exporter to 2.7.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022Store Toolkit for WooCommerce: Does not sanitise and escape the tab parameter before outputting it back in an admin page in an error messageCVE-2021-25077 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting
Product
Store Toolkit for WooCommerce
Fixed in
2.3.2
What to do
Update Store Toolkit for WooCommerce to 2.3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 1, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore pageCVE-2021-25089 · WordPress plugins & themes · reported by WPScanMedium 6.1
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore page, leading to a Reflected Cross-Site Scripting
Product
UpdraftPlus WordPress Backup
Fixed in
1.16.69
What to do
Update UpdraftPlus WordPress Backup to 1.16.69 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 28, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).CVE-2022-23979 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
Affected
up to 3.0.15
What to do
Affects up to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jan 18, 2022ProfileGrid – User Profiles, Memberships, Groups and Communities: Stored Cross-Site ScriptingCVE-2022-0233 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
Product
ProfileGrid – User Profiles, Memberships, Groups and Communities
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update ProfileGrid – User Profiles, Memberships, Groups and Communities to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 18, 2022User Registration, Login & Landing Pages: Stored Cross-Site ScriptingCVE-2022-0232 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
User Registration, Login & Landing Pages
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update User Registration, Login & Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 18, 2022Random Banner: Stored Cross-Site ScriptingCVE-2022-0210 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/models/model.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Random Banner
Affected
up to 4.1.4
What to do
Affects up to 4.1.4. Update Random Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jan 18, 2022WHMCS Bridge: Stored Cross-Site ScriptingCVE-2021-4074 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter found in the ~/whmcs-bridge/bridge_cp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1. Due to missing authorization checks on the cc_whmcs_bridge_add_admin function, low-level authenticated users such as subscribers can exploit this vulnerability.
Product
WHMCS Bridge
Affected
up to 6.1
What to do
Affects up to 6.1. Update WHMCS Bridge to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 17, 2022Quiz And Survey Master versions prior to 7.3.7: Stored cross-site scriptingCVE-2022-0182 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.
Product
Quiz And Survey Master versions prior to 7.3.7
Fixed in
7.3.7
What to do
Update Quiz And Survey Master versions prior to 7.3.7 to 7.3.7 or newer.
Full record and what to do →NVD record jvn.jp quizandsurveymaster.com
Dec 22, 2021Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).CVE-2021-36885 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
Affected
up to 1.2.6.1
What to do
Affects up to 1.2.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 20, 2021Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versCVE-2021-36889 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
Affected
up to 1.6
What to do
Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Dec 14, 2021Variation Swatches for WooCommerce: Stored Cross-Site ScriptingCVE-2021-42367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization checks on the tawcvs_save_settings function, low-level authenticated users such as subscribers can exploit this vulnerability.
Product
Variation Swatches for WooCommerce
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Variation Swatches for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Fathom Analytics: Stored Cross-Site ScriptingCVE-2021-41836 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the $site_id parameter found in the ~/fathom-analytics.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.0.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Fathom Analytics
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Fathom Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 10, 2021Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or CVE-2021-36911 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 29, 2021Asgaros Forums: Stored Cross-Site ScriptingCVE-2021-42365 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Asgaros Forums
Affected
up to 1.15.13
What to do
Affects up to 1.15.13. Update Asgaros Forums to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 26, 2021Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media ConfiguCVE-2021-36843 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
Affected
up to 4.3.5
What to do
Affects up to 4.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 17, 2021Contact Form Email: Stored Cross-Site ScriptingCVE-2021-42361 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Contact Form Email
Affected
up to 1.3.24
What to do
Affects up to 1.3.24. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24834 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in the Create Poll - Options module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of custom label parameters - vote button label , results link label and back to vote caption label.
Product
YOP Poll
Fixed in
6.3.1
What to do
Update YOP Poll to 6.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 17, 2021YOP Poll: Is affected by a stored Cross-Site Scripting vulnerabilityCVE-2021-24833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in the Admin preview module where a user with a role as low as author is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of question and answer text parameters in Create Poll module.
Product
YOP Poll
Fixed in
6.3.1
What to do
Update YOP Poll to 6.3.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Storefront Footer Text: Does not sanitize and escape the "Footer Credit Text" added to pagesCVE-2021-24607 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed.
Product
Storefront Footer Text
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Storefront Footer Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Google Maps Easy: Stored Cross-Site ScriptingCVE-2021-39346 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/modules/marker_groups/views/tpl/mgrEditMarkerGroup.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.9.33. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Google Maps Easy
Affected
up to 1.9.33
What to do
Affects up to 1.9.33. Update Google Maps Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 1, 2021Notification: Stored Cross-Site ScriptingCVE-2021-39340 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/classes/Utils/Settings.php file which made it possible for attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 7.2.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Notification
Affected
up to 7.2.4
What to do
Affects up to 7.2.4. Update Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 21, 2021Leaky Paywall: Stored Cross-Site ScriptingCVE-2021-39357 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the ~/class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.16.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Product
Leaky Paywall
Affected
up to 4.16.5
What to do
Affects up to 4.16.5. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.