Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Aug 18, 2026Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.CVE-2026-32444 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 16, 2026Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types: Insecure Direct Object ReferenceCVE-2026-1883 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the delete_folders() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary folders created by other users.
- Product
- Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 1, 2025KiwiChat NextClient: Stored Cross-Site ScriptingCVE-2025-3670 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The KiwiChat NextClient plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- KiwiChat NextClient
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update KiwiChat NextClient to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Apr 9, 2025Sandwich Adsense: Missing AuthorizationCVE-2025-31042 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in rtakao Sandwich Adsense firsth3tagadsense allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sandwich Adsense: from n/a through <= 4.0.2.
- Product
- Sandwich Adsense
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Sandwich Adsense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Twice Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31543 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twice Commerce Twice Commerce embed-rentle allows DOM-Based XSS.This issue affects Twice Commerce: from n/a through <= 1.3.1.
- Product
- Twice Commerce
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Twice Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Page Builder Sandwich – Front-End Page Builder: Missing AuthorizationCVE-2024-37218 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WordPress Page Builder Sandwich Team Page Builder Sandwich – Front-End Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Builder Sandwich – Front-End Page Builder: from n/a through 5.1.0.
- Product
- Page Builder Sandwich – Front-End Page Builder
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Page Builder Sandwich – Front-End Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 22, 2024Page Builder Sandwich – Front-End Page Builder: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37219 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PBN Hosting SL Page Builder Sandwich – Front-End Page Builder allows Stored XSS.This issue affects Page Builder Sandwich – Front-End Page Builder: from n/a through 5.1.0.
- Product
- Page Builder Sandwich – Front-End Page Builder
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Page Builder Sandwich – Front-End Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 3, 2024Cwicly: Improper Control of Generation of Code ('Code Injection')CVE-2024-24707 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Cwicly Builder, SL. Cwicly allows Code Injection.This issue affects Cwicly: from n/a through 1.4.0.2.
- Product
- Cwicly
- Affected
- up to 1.4.0.2
- What to do
- Affects up to 1.4.0.2. Update Cwicly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comsnicco.io
Mar 4, 2024Page Builder Sandwich – Front End WordPress Page Builder: Sensitive Information ExposureCVE-2024-1381 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.0. This makes it possible for authenticated attackers, with subscriber access and higher, to extract sensitive user or configuration data.
- Product
- Page Builder Sandwich – Front End WordPress Page Builder
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Page Builder Sandwich – Front End WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 4, 2024Page Builder Sandwich – Front End WordPress Page Builder: Unauthorized modification of dataCVE-2024-1285 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Page Builder Sandwich – Front End WordPress Page Builder Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'gambit_builder_save_content' function in all versions up to, and including, 5.1.0. This makes it possible for authenticated attackers, with subscriber access and above, to insert arbitrary content into existing posts.
- Product
- Page Builder Sandwich – Front End WordPress Page Builder
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Page Builder Sandwich – Front End WordPress Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0729 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_sort_order function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0726 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_edit_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0725 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_clone_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0724 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_add_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0722 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_state function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0720 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0717 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0716 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0715 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0711 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the view state of the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0685 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_unassign_folders function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin..
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0684 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0718 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0730 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder_order function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0727 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_delete_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0723 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_move_object function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0719 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0712 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Cross-Site Request ForgeryCVE-2023-0728 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajax_save_folder function. This makes it possible for unauthenticated attackers to invoke this function via forged request granted they can trick a site administrator into performing an action such as clicking on a link leading them to perform actions intended for administrators such as changing the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0713 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
- Product
- Wicked Folders
- Affected
- up to 2.18.16
- What to do
- Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 1, 2022Wicked Folders: Does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX actionCVE-2021-24919 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection
- Product
- Wicked Folders
- Fixed in
- 2.8.10
- What to do
- Update Wicked Folders to 2.8.10 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.