Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
64 results · page 1 of 2
Oct 28, 2026Menu Cart for WooCommerce: Does not sanitise and escape cart item variation data before outputting it in its cart slide-outCVE-2026-105972 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator.
- Product
- Menu Cart for WooCommerce
- Fixed in
- 3.2.1
- What to do
- Update Menu Cart for WooCommerce to 3.2.1 or newer.
Oct 11, 2026Post Snippets: Does not properly escape variable values substituted into snippets before outputting themCVE-2026-12980 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
- Product
- Post Snippets
- Affected
- up to 4.2.4
- What to do
- Affects up to 4.2.4. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.CVE-2026-81282 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
- Affected
- up to 1.1.18
- What to do
- Affects up to 1.1.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026Tutor LMS: Does not prevent request data from overwriting internal variables while rendering templatesCVE-2026-19092 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
- Product
- Tutor LMS
- Fixed in
- 4.0.6
- What to do
- Update Tutor LMS to 4.0.6 or newer.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.CVE-2026-66605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
- Affected
- up to 1.4.13
- What to do
- Affects up to 1.4.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 14, 2026SureForms: Does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amountCVE-2026-11567 · WordPress plugins & themes · reported by WPScanMedium 5.9
The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variable/hidden) payment amount, allowing unauthenticated users to underpay for the configured product or subscription. Forms using a fixed configured price are not affected.
- Product
- SureForms
- Fixed in
- 2.11.1
- What to do
- Update SureForms to 2.11.1 or newer.
Jun 6, 2026Klamra Paycal for Aspaclaria: Insecure Direct Object ReferenceCVE-2026-8611 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.4 via the 'invoice_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to download arbitrary customer invoices by enumerating sequential post IDs, exposing sensitive billing PII including full name, email address, phone number, order total, line items, and customer notes belonging to other customers.
- Product
- Klamra Paycal for Aspaclaria
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Klamra Paycal for Aspaclaria to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 20, 2025Pure WC Variation Swatches: Does not have an authorization checkCVE-2025-12820 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.
- Product
- Pure WC Variation Swatches
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Pure WC Variation Swatches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Virtuaria PagBank / PagSeguro para Woocommerce: Missing AuthorizationCVE-2025-62151 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Virtuaria Virtuaria PagBank / PagSeguro para Woocommerce virtuaria-pagseguro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virtuaria PagBank / PagSeguro para Woocommerce: from n/a through <= 3.6.3.
- Product
- Virtuaria PagBank / PagSeguro para Woocommerce
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update Virtuaria PagBank / PagSeguro para Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Show Variations as Single Products Woocommerce: Missing AuthorizationCVE-2025-66114 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Show Variations as Single Products Woocommerce: from n/a through <= 2.0.
- Product
- Show Variations as Single Products Woocommerce
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Show Variations as Single Products Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2025Opal Woo Custom Product Variation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-47535 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through <= 1.2.0.
- Product
- Opal Woo Custom Product Variation
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Opal Woo Custom Product Variation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 7, 2025GS Variation Swatches for WooCommerce: Missing AuthorizationCVE-2025-47526 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in GS Plugins GS Variation Swatches for WooCommerce gs-woo-variation-swatches allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Variation Swatches for WooCommerce: from n/a through <= 3.0.4.
- Product
- GS Variation Swatches for WooCommerce
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update GS Variation Swatches for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 22, 2025Advanced Linked Variations for Woocommerce: Missing AuthorizationCVE-2025-46244 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce linked-variation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Linked Variations for Woocommerce: from n/a through <= 1.0.3.
- Product
- Advanced Linked Variations for Woocommerce
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Advanced Linked Variations for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2025IP2Location Variables: Cross-Site Request Forgery (CSRF)CVE-2025-39455 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through <= 2.9.5.
- Product
- IP2Location Variables
- Affected
- up to 2.9.5
- What to do
- Affects up to 2.9.5. Update IP2Location Variables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2025The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerableCVE-2025-2719 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in versions 1.2.8 to 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 1/true on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny access to legitimate users or be used to set some values to true, such as registration.
- Affected
- 1.2.8 to 1.4.0
- What to do
- Affects 1.2.8 to 1.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2025Aria Font: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32488 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in آریا وردپرس Aria Font aria-font allows Stored XSS.This issue affects Aria Font: from n/a through <= 1.4.
- Product
- Aria Font
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Aria Font to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Variable Inspector: Missing AuthorizationCVE-2025-32229 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Bowo Variable Inspector variable-inspector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Variable Inspector: from n/a through <= 2.6.3.
- Product
- Variable Inspector
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update Variable Inspector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2025Display product variations dropdown on shop page: Missing AuthorizationCVE-2025-32226 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Anzar Ahmed Display product variations dropdown on shop page display-product-variations-dropdown-on-shop-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display product variations dropdown on shop page: from n/a through <= 1.1.3.
- Product
- Display product variations dropdown on shop page
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Display product variations dropdown on shop page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Variable Inspector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-26914 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Variable Inspector variable-inspector allows Reflected XSS.This issue affects Variable Inspector: from n/a through <= 2.6.2.
- Product
- Variable Inspector
- Affected
- up to 2.6.2
- What to do
- Affects up to 2.6.2. Update Variable Inspector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Woo Update Variations In Cart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23829 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codingkart Woo Update Variations In Cart woo-update-variations-in-cart allows Stored XSS.This issue affects Woo Update Variations In Cart: from n/a through <= 0.0.9.
- Product
- Woo Update Variations In Cart
- Affected
- up to 0.0.9
- What to do
- Affects up to 0.0.9. Update Woo Update Variations In Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025Just Variables: Cross-Site Request Forgery (CSRF)CVE-2025-27336 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Alex Prokopenko / JustCoded Just Variables just-wp-variables allows Cross Site Request Forgery.This issue affects Just Variables: from n/a through <= 1.2.3.
- Product
- Just Variables
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Just Variables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in CVE-2024-13511 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in its settings reset functionality. The issue exists in the settings_init() function, which processes a reset action based on specific query parameters in the URL. The related delete_settings() function performs a faulty nonce validation check, making the reset operation insecure and susceptible to unauthorized access.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2024TH Variation Swatches: Cross-Site Request Forgery (CSRF)CVE-2023-28688 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.
- Product
- TH Variation Swatches
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update TH Variation Swatches to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Opal Woo Custom Product Variation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52444 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through <= 1.1.3.
- Product
- Opal Woo Custom Product Variation
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Opal Woo Custom Product Variation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Linked Variation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-48047 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request Forgery.This issue affects Linked Variation for WooCommerce: from n/a through <= 1.0.5.
- Product
- Linked Variation for WooCommerce
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Linked Variation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2024Travelpayouts: All Travel Brands in One Place: Is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variableCVE-2024-0337 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Product
- Travelpayouts: All Travel Brands in One Place
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update Travelpayouts: All Travel Brands in One Place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2024Essential Blocks: Does not prevent unauthenticated attackers from overwriting local variablesCVE-2023-6623 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.
- Product
- Essential Blocks
- Fixed in
- 4.4.3
- What to do
- Update Essential Blocks to 4.4.3 or newer.
Oct 16, 2023WP Matterport Shortcode: Does not escape the PHP_SELF server variableCVE-2023-4290 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.7
- What to do
- Update WP Matterport Shortcode to 2.1.7 or newer.
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Arian Khosravi, Norik Davtian BigContact Contact Page plugin <= 1.5.8 versions.CVE-2023-22694 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Arian Khosravi, Norik Davtian BigContact Contact Page plugin <= 1.5.8 versions.
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 6, 2022External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product CVE-2022-43468 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input.
- Affected
- up to 6.0.5
- What to do
- Affects up to 6.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Custom TinyMCE Shortcode Button: Does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin pageCVE-2022-1217 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
- Product
- Custom TinyMCE Shortcode Button
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Custom TinyMCE Shortcode Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Advanced Image Sitemap: Does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin pageCVE-2022-1216 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
- Product
- Advanced Image Sitemap
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Advanced Image Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2022Photo Gallery by 10Web: Does not properly sanitize the $_GET['image_url'] variableCVE-2022-1282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.3
- What to do
- Update Photo Gallery by 10Web to 1.6.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022WP Cerber Security, Anti-spam & Malware Scan: Does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboardCVE-2022-0429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 8.9.6
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 8.9.6 or newer.
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21664 · WordPress plugins & themes · reported by GitHubHigh 7.4
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- What to do
- Update the plugin to the newest version.
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21663 · WordPress plugins & themes · reported by GitHubMedium 6.6
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21662 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 6, 2022WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database.CVE-2022-21661 · WordPress plugins & themes · reported by GitHubHigh 8
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 14, 2021Variation Swatches for WooCommerce: Stored Cross-Site ScriptingCVE-2021-42367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization checks on the tawcvs_save_settings function, low-level authenticated users such as subscribers can exploit this vulnerability.
- Product
- Variation Swatches for WooCommerce
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Variation Swatches for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 8, 2021School Management System – WPSchoolPress: Does not properly sanitize or use prepared statements before using POST variable in SQL queriesCVE-2021-24575 · WordPress plugins & themes · reported by WPScanHigh 8.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.
- Product
- School Management System – WPSchoolPress
- Fixed in
- 2.1.10
- What to do
- Update School Management System – WPSchoolPress to 2.1.10 or newer.
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39203 · WordPress plugins & themes · reported by GitHubMedium 6.8
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comhackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39202 · WordPress plugins & themes · reported by GitHubHigh 7.6
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comhackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39201 · WordPress plugins & themes · reported by GitHubHigh 7.6
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress)
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comhackerone.com
Sep 9, 2021WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.CVE-2021-39200 · WordPress plugins & themes · reported by GitHubMedium 5.3
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordgithub.comhackerone.com
Aug 9, 2021Stock in & out: Lacks proper sanitization before passing variables to an SQL requestCVE-2021-24520 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Stock in & out WordPress plugin through 1.0.4 lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection attacks. Users with a role of contributor or higher can exploit this vulnerability.
- Product
- Stock in & out
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Stock in & out to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 2, 2020WordPress before 5.5.2 allows XSS associated with global variables.CVE-2020-28034 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.5.2 allows XSS associated with global variables.
- Fixed in
- 5.5.2
- What to do
- Update the plugin to 5.5.2 or newer.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Sep 3, 2019The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.CVE-2019-15863 · WordPress plugins & themes · reported by MITREHigh 7.5
The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
- Product
- ConvertPlus
- Fixed in
- 3.4.5
- What to do
- Update ConvertPlus to 3.4.5 or newer.
Full record and what to do →NVD recordconvertplug.comconvertplug.com
Aug 29, 2019The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.CVE-2019-15778 · WordPress plugins & themes · reported by MITREMedium 5.4
The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.
- Product
- woo-variation-gallery
- Fixed in
- 1.1.29
- What to do
- Update woo-variation-gallery to 1.1.29 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.CVE-2017-18540 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
- Product
- weblibrarian
- Fixed in
- 3.4.8.7
- What to do
- Update weblibrarian to 3.4.8.7 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 21, 2019The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.CVE-2017-18539 · WordPress plugins & themes · reported by MITREMedium 6.1
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
- Product
- weblibrarian
- Fixed in
- 3.4.8.6
- What to do
- Update weblibrarian to 3.4.8.6 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.