Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,966 results · page 97 of 100
Nov 8, 2021Storefront Footer Text: Does not sanitize and escape the "Footer Credit Text" added to pagesCVE-2021-24607 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the "Footer Credit Text" added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed.
- Product
- Storefront Footer Text
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Storefront Footer Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2021Google Maps Easy: Stored Cross-Site ScriptingCVE-2021-39346 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/modules/marker_groups/views/tpl/mgrEditMarkerGroup.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.9.33. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Google Maps Easy
- Affected
- up to 1.9.33
- What to do
- Affects up to 1.9.33. Update Google Maps Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Nov 1, 2021Notification: Stored Cross-Site ScriptingCVE-2021-39340 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/classes/Utils/Settings.php file which made it possible for attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 7.2.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Notification
- Affected
- up to 7.2.4
- What to do
- Affects up to 7.2.4. Update Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 21, 2021Leaky Paywall: Stored Cross-Site ScriptingCVE-2021-39357 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the ~/class.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.16.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Leaky Paywall
- Affected
- up to 4.16.5
- What to do
- Affects up to 4.16.5. Update Leaky Paywall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 21, 2021Content Staging: Stored Cross-Site ScriptingCVE-2021-39356 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Content Staging WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via several parameters that are echo'd out via the ~/templates/settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Content Staging
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Content Staging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 21, 2021LearnPress: Stored Cross-Site ScriptingCVE-2021-39348 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Please note that this is seperate from CVE-2021-24702.
- Product
- LearnPress
- Affected
- up to 4.1.3.1
- What to do
- Affects up to 4.1.3.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 21, 2021Simple Job Board: Stored Cross-Site ScriptingCVE-2021-39328 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Simple Job Board
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update Simple Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 19, 2021Indeed Job Importer: Stored Cross-Site ScriptingCVE-2021-39355 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Indeed Job Importer WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/indeed-job-importer/trunk/indeed-job-importer.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Indeed Job Importer
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Indeed Job Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 19, 2021MPL-Publisher: Stored Cross-Site ScriptingCVE-2021-39343 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/libs/PublisherController.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.30.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- MPL-Publisher
- Affected
- up to 1.30.2
- What to do
- Affects up to 1.30.2. Update MPL-Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 19, 2021JobBoardWP: Stored Cross-Site ScriptingCVE-2021-39329 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-metabox.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- JobBoardWP
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update JobBoardWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 18, 2021Podcast Subscribe Buttons: Allows users with any role capable of editing or adding posts to perform stored XSSCVE-2021-24743 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS.
- Product
- Podcast Subscribe Buttons
- Fixed in
- 1.4.2
- What to do
- Update Podcast Subscribe Buttons to 1.4.2 or newer.
Oct 15, 2021Author Bio Box: Stored Cross-Site ScriptingCVE-2021-39349 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 3.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Author Bio Box
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Author Bio Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2021HAL: Stored Cross-Site ScriptingCVE-2021-39345 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The HAL WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/wp-hal.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.1.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- HAL
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update HAL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2021KJM Admin Notices: Stored Cross-Site ScriptingCVE-2021-39344 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/class-kjm-admin-notices-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- KJM Admin Notices
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update KJM Admin Notices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2021MyBB Cross-Poster: Stored Cross-Site ScriptingCVE-2021-39338 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The MyBB Cross-Poster WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/classes/MyBBXPSettings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- MyBB Cross-Poster
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update MyBB Cross-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2021job-portal: Stored Cross-Site ScriptingCVE-2021-39337 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin/jobs_function.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 0.0.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- job-portal
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update job-portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2021Job Manager: Stored Cross-Site ScriptingCVE-2021-39336 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Job Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/admin-jobs.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 0.7.25. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Job Manager
- Affected
- up to 0.7.25
- What to do
- Affects up to 0.7.25. Update Job Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2021WpGenius Job Listing: Stored Cross-Site ScriptingCVE-2021-39335 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WpGenius Job Listing WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/src/admin/class/class-wpgenious-job-listing-options.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- WpGenius Job Listing
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WpGenius Job Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2021Job Board Vanila: Stored Cross-Site ScriptingCVE-2021-39334 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjb_exp_in and the psjb_curr_in parameters found in the ~/job-settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Job Board Vanila
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Job Board Vanila to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 15, 2021Business Manager: Stored Cross-Site ScriptingCVE-2021-39332 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Business Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization found throughout the plugin which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.4.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
- Product
- Business Manager
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Business Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers.CVE-2021-38344 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add malicious JavaScript to a page by modifying the request sent to update the page via the brizy_update_item AJAX action and adding JavaScript to the data parameter, which would be executed in the session of any visitor viewing or previewing the post or page.
- Product
- Brizy Page Builder
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Brizy Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Oct 11, 2021GeoDirectory Business Directory: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS)CVE-2021-24720 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GeoDirectory Business Directory WordPress plugin before 2.1.1.3 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS).
- Product
- GeoDirectory Business Directory
- Fixed in
- 2.1.1.3
- What to do
- Update GeoDirectory Business Directory to 2.1.1.3 or newer.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 27, 2021Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable CVE-2021-36845 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.8, there are 46 vulnerable parameters that were missed by the vendor while patching the 1.3.7 version to 1.3.8. Vulnerable parameters: 1 - "Newsletter" tab, &yith_maintenance_newsletter_submit_label parameter: payload should start with a single quote (') symbol to break the context, i.e.: NOTIFY ME' autofocus onfocus=alert(/Visse/);// v=' - this payload will be auto triggered while admin visits this page/tab. 2 - "General" tab issues, vulnerable parameters: &yith_maintenance_message, &yith_maintenance_custom_style, &yith_maintenance_mascotte, &yith_maintenance_title_font[size], &yith_maintenance_title_font[family], &yith_maintenance_title_font[color], &yith_maintenance_paragraph_font[size], &yith_maintenance_paragraph_font[family], &yith_maintenance_paragraph_font[color], &yith_maintenance_border_top. 3 - "Background" tab issues, vulnerable parameters: &yith_maintenance_background_image, &yith_maintenance_background_color. 4 - "Logo" tab issues, vulnerable parameters: &yith_maintenance_logo_image, &yith_maintenance_logo_tagline, &yith_maintenance_logo
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 27, 2021YITH Maintenance Mode: Authenticated Stored Cross-Site Scripting (XSS)CVE-2021-36841 · WordPress plugins & themes · reported by PatchstackMedium 6.9
Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configuration.
- Product
- YITH Maintenance Mode
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update YITH Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 20, 2021Shortcodes Ultimate: Allows users with Contributor roles to perform stored XSS via shortcode attributesCVE-2021-24525 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).
- Product
- Shortcodes Ultimate
- Fixed in
- 5.10.2
- What to do
- Update Shortcodes Ultimate to 5.10.2 or newer.
Aug 30, 2021WordPress Real Media Library: Stored Cross-Site ScriptingCVE-2021-34668 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1.
- Product
- WordPress Real Media Library
- Affected
- up to 4.14.1
- What to do
- Affects up to 4.14.1. Update WordPress Real Media Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Aug 30, 2021A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below).CVE-2021-24667 · WordPress plugins & themes · reported by WPScanMedium 5.4
A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below). The vulnerability exists in the Lightbox functionality where a user with low privileges is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of image parameters in meta data.
- Fixed in
- 2.2.1
- What to do
- Update the plugin to 2.2.1 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Aug 23, 2021KN Fix Your Title: Was vulnerable to Authenticated Stored XSS in the separator fieldCVE-2021-24547 · WordPress plugins & themes · reported by WPScanMedium 5.4
The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field.
- Product
- KN Fix Your Title
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update KN Fix Your Title to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2021Charitable – Donation: Is affected by an authenticated stored cross-site scripting vulnerabilityCVE-2021-24531 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature.
- Product
- Charitable – Donation
- Fixed in
- 1.6.51
- What to do
- Update Charitable – Donation to 1.6.51 or newer.
Full record and what to do →NVD recordwpscan.comwpcharitable.com
Aug 19, 2021Shopping Cart & eCommerce Store: Cross-Site Request ForgeryCVE-2021-34645 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_currency_settings function found in the ~/admin/inc/wp_easycart_admin_initial_setup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0.
- Product
- Shopping Cart & eCommerce Store
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 16, 2021SEOPress: Stored Cross-Site-ScriptingCVE-2021-34641 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the ~/src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3.
- Product
- SEOPress
- Affected
- 5.0.0 to 5.0.3
- What to do
- Affects 5.0.0 to 5.0.3. Update SEOPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 16, 2021Mimetic Books: Was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings pageCVE-2021-24548 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page.
- Product
- Mimetic Books
- Affected
- up to 0.2.13
- What to do
- Affects up to 0.2.13. Update Mimetic Books to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2021Backup by 10Web – Backup and Restore: Does not sanitise or escape the tab parameter before outputting it back in the pageCVE-2021-24426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
- Product
- Backup by 10Web – Backup and Restore
- Affected
- up to 1.0.20
- What to do
- Affects up to 1.0.20. Update Backup by 10Web – Backup and Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2021Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outsiCVE-2020-24144 · WordPress plugins & themes · reported by MITREHigh 8.6
Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files that are stored outside the web root folder via the items[] parameter in a move operation.
- Product
- Media File Organizer (aka media-file-organizer)
- Affected
- 1.0.1 to 1.0.1
- What to do
- Affects 1.0.1 to 1.0.1. Update Media File Organizer (aka media-file-organizer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comru.wordpress.org
Jul 7, 2021Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outCVE-2020-24143 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter.
- Product
- Video Downloader for TikTok (aka downloader-tiktok)
- Affected
- 1.3 to 1.3
- What to do
- Affects 1.3 to 1.3. Update Video Downloader for TikTok (aka downloader-tiktok) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 7, 2021WP Fluent Forms plugin < 3.6.67: Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege EscalationCVE-2021-34620 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
- Product
- WP Fluent Forms plugin < 3.6.67
- What to do
- Update WP Fluent Forms plugin < 3.6.67 to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 21, 2021WP Config File Editor: Was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2021-24367 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting (XSS) vulnerability.
- Product
- WP Config File Editor
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update WP Config File Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameterCVE-2021-24339 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Menu Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 21, 2021Pods – Custom Content Types and Fields: Was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameterCVE-2021-24338 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability within the 'Singular Label' field parameter.
- Product
- Pods – Custom Content Types and Fields
- Fixed in
- 2.7.27
- What to do
- Update Pods – Custom Content Types and Fields to 2.7.27 or newer.
Full record and what to do →NVD recordwpscan.comwhitesourcesoftware.com
Jun 14, 2021The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored CrCVE-2021-24382 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesser privileged users to access the plugin's functionality, in which case, privilege escalation could be performed.
- Fixed in
- 3.5.0.9
- What to do
- Update the plugin to 3.5.0.9 or newer.
Full record and what to do →NVD recordsmartslider.helpscoutdocs.comwpscan.com
Jun 14, 2021Visitors: Is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2021-24350 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.
- Product
- Visitors
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update Visitors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2021WP Prayer: Provides the functionality to store requested prayers/praises and list them on a WordPress websiteCVE-2021-24313 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.
- Product
- WP Prayer
- Fixed in
- 1.6.2
- What to do
- Update WP Prayer to 1.6.2 or newer.
Full record and what to do →NVD recordbastijnouwendijk.comwpscan.com
May 24, 2021The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability.CVE-2021-24305 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized.
- Affected
- 2.0 to 2.0
- What to do
- Affects 2.0 to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comtargetfirst.com
May 24, 2021Hana Flv Player: Is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' fieldCVE-2021-24302 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hana Flv Player WordPress plugin through 3.1.3 is vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the 'Default Skin' field.
- Product
- Hana Flv Player
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Hana Flv Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 24, 2021Hotjar Connecticator: Is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textareaCVE-2021-24301 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hotjar Connecticator WordPress plugin through 1.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) in the 'hotjar script' textarea. The request did include a CSRF nonce that was properly verified by the server and this vulnerability could only be exploited by administrator users.
- Product
- Hotjar Connecticator
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Hotjar Connecticator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2021Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor: Have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users suchCVE-2021-24292 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method: The “Card” widget accepts a “title_tag” parameter. Although the element control lists a fixed set of possible html tags, it is possible to send a ‘save_builder’ request with the “heading_tag” set to “script”, and the actual “title” parameter set to JavaScript to be executed within the script tags added by the “heading_tag” parameter.
- Product
- Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor
- Fixed in
- 2.24.0
- What to do
- Update Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor to 2.24.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 17, 2021There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicCVE-2021-24290 · WordPress plugins & themes · reported by WPScanMedium 6.1
There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.
- Product
- Store Locator Plus for
- Affected
- up to 5.5.15
- What to do
- Affects up to 5.5.15. Update Store Locator Plus for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 17, 2021There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta datCVE-2021-24289 · WordPress plugins & themes · reported by WPScanHigh 8.8
There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
- Product
- Store Locator Plus for
- Affected
- up to 5.5.14
- What to do
- Affects up to 5.5.14. Update Store Locator Plus for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021Clever Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Clever Addons for Elementor” WordPress Plugin before 2.1.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- Clever Addons for Elementor
- Fixed in
- 2.1.0
- What to do
- Update Clever Addons for Elementor to 2.1.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021Ultimate Addons for Elementor: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “Ultimate Addons for Elementor” WordPress Plugin before 1.30.0 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- Ultimate Addons for Elementor
- Fixed in
- 1.30.0
- What to do
- Update Ultimate Addons for Elementor to 1.30.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.