Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
75 results · page 1 of 2
Oct 25, 2026Datawiza Proxy Auth: Does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxyCVE-2026-115214 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
- Product
- Datawiza Proxy Auth
- Fixed in
- 1.1.1
- What to do
- Update Datawiza Proxy Auth to 1.1.1 or newer.
Oct 15, 2026Easy HTTPS Redirection (SSL): Does not perform capability checks in some of its AJAX actionsCVE-2026-104643 · WordPress plugins & themes · reported by WPScanMedium 4.2
The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
- Product
- Easy HTTPS Redirection (SSL)
- Fixed in
- 2.0.2
- What to do
- Update Easy HTTPS Redirection (SSL) to 2.0.2 or newer.
Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.CVE-2026-39724 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.
- Affected
- up to 1.3.11
- What to do
- Affects up to 1.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Directory TraversalCVE-2026-17602 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- SSL Zen — SSL Certificate Installer & HTTPS Redirects
- Affected
- up to 4.7.42
- What to do
- Affects up to 4.7.42. Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Reflected Cross-Site ScriptingCVE-2026-15463 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage.
- Product
- SSL Zen — SSL Certificate Installer & HTTPS Redirects
- Affected
- up to 4.7.42
- What to do
- Affects up to 4.7.42. Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycleCVE-2026-86781 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
- Product
- SSL Zen — SSL Certificate Installer & HTTPS Redirects
- Fixed in
- 4.7.40
- What to do
- Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to 4.7.40 or newer.
Sep 5, 2026IPGP Visitors Origin: Does not sanitise or escape user input before reflecting it back in the HTTP responseCVE-2026-81404 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request.
- Product
- IPGP Visitors Origin
- Fixed in
- 1.6
- What to do
- Update IPGP Visitors Origin to 1.6 or newer.
Sep 2, 2026Ajaxify Comments: Is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied dataCVE-2026-2811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers.
- Product
- Ajaxify Comments
- Fixed in
- 3.2
- What to do
- Update Ajaxify Comments to 3.2 or newer.
Aug 19, 2026Animation Addons for Elementor: Does not validate a user-supplied value before using it to build the host of a server-side HTTP requestCVE-2026-17565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.
- Product
- Animation Addons for Elementor
- Fixed in
- 2.7.2
- What to do
- Update Animation Addons for Elementor to 2.7.2 or newer.
Jul 30, 2026WP Ghost (Hide My WP Ghost): Does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headersCVE-2026-11870 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05's own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.
- Product
- WP Ghost (Hide My WP Ghost)
- Fixed in
- 7.0.05
- What to do
- Update WP Ghost (Hide My WP Ghost) to 7.0.05 or newer.
Jul 23, 2026WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan: Directory TraversalCVE-2026-15786 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Although file write content is passed through esc_html(), which encodes angle brackets and prevents direct PHP execution, plaintext configuration files such as .htaccess are fully writable and exploitable for denial-of-service or redirect attacks. This is only exploitable when the premium version of the software is enabled and active.
- Product
- WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan
- Affected
- up to 7.8.6.6
- What to do
- Affects up to 7.8.6.6. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2026WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan: Unauthorized modification of dataCVE-2026-3829 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'wple_basic_get_requests' function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.
- Product
- WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan
- Affected
- up to 7.8.5.10
- What to do
- Affects up to 7.8.5.10. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 22, 2026HTTP Headers: External Control of File Name or Path leading to Remote Code ExecutionCVE-2026-4132 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The HTTP Headers plugin for WordPress is vulnerable to External Control of File Name or Path leading to Remote Code Execution in all versions up to and including 1.19.2. This is due to insufficient validation of the file path stored in the 'hh_htpasswd_path' option and lack of sanitization on the 'hh_www_authenticate_user' option value. The plugin allows administrators to set an arbitrary file path for the htpasswd file location and does not validate that the path has a safe file extension (e.g., restricting to .htpasswd). Additionally, the username field used for HTTP Basic Authentication is written directly into the file without sanitization. The apache_auth_credentials() function constructs the file content using the unsanitized username via sprintf('%s:{SHA}%s', $user, ...), and update_auth_credentials() writes this content to the attacker-controlled path via file_put_contents(). This makes it possible for authenticated attackers, with Administrator-level access and above, to write arbitrary content (including PHP code) to arbitrary file paths on the server, effectively achieving Remote Code Execution.
- Product
- HTTP Headers
- Affected
- up to 1.19.2
- What to do
- Affects up to 1.19.2. Update HTTP Headers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 22, 2026HTTP Headers: CRLF InjectionCVE-2026-2717 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2. This is due to insufficient sanitization of custom header name and value fields before writing them to the Apache .htaccess file via `insert_with_markers()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary newline characters and additional Apache directives into the .htaccess configuration file via the 'Custom Headers' settings, leading to Apache configuration parse errors and potential site-wide denial of service.
- Product
- HTTP Headers
- Affected
- up to 1.19.2
- What to do
- Affects up to 1.19.2. Update HTTP Headers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 22, 2026HTTP Headers: Stored Cross-Site ScriptingCVE-2026-1379 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The HTTP Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- HTTP Headers
- Affected
- up to 1.19.2
- What to do
- Affects up to 1.19.2. Update HTTP Headers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2025Mavis HTTPS to HTTP Redirection: Cross-Site Request Forgery (CSRF)CVE-2025-58261 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc Mavis HTTPS to HTTP Redirection mavis-https-to-http-redirect allows Stored XSS.This issue affects Mavis HTTPS to HTTP Redirection: from n/a through <= 1.4.3.
- Product
- Mavis HTTPS to HTTP Redirection
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Mavis HTTPS to HTTP Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025HTTP to HTTPS link changer by Eyga.net: Cross-Site Request Forgery (CSRF)CVE-2025-23677 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in DSmidge HTTP to HTTPS link changer by Eyga.net https-links-in-content allows Stored XSS.This issue affects HTTP to HTTPS link changer by Eyga.net: from n/a through <= 0.2.4.
- Product
- HTTP to HTTPS link changer by Eyga.net
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update HTTP to HTTPS link changer by Eyga.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: Missing AuthorizationCVE-2024-44020 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through <= 1.2.7.
- Product
- WP Free SSL – Free SSL Certificate for WordPress and force HTTPS
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update WP Free SSL – Free SSL Certificate for WordPress and force HTTPS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 23, 2024Ditty: Re-introduced a previously fixed security issue (https://wpscanCVE-2024-6715 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ditty WordPress plugin before 3.1.46 re-introduced a previously fixed security issue (https://wpscan.com/vulnerability/80a9eb3a-2cb1-4844-9004-ba2554b2d46c/) in v3.1.39
- Product
- Ditty
- Fixed in
- 3.1.46
- What to do
- Update Ditty to 3.1.46 or newer.
Jun 8, 2024WP Force SSL & HTTPS SSL Redirect: Unauthorized modification of dataCVE-2024-5770 · WordPress plugins & themes · reported by WordfenceMedium 4.2
The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticated attackers, subscriber-level permissions and above, to update the plugin settings.
- Product
- WP Force SSL & HTTPS SSL Redirect
- Affected
- up to 1.66
- What to do
- Affects up to 1.66. Update WP Force SSL & HTTPS SSL Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2024WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score: Sensitive Information ExposureCVE-2023-7046 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0 via exposed Private key files. This makes it possible for unauthenticated attackers to extract sensitive data including TLS Certificate Private Keys
- Product
- WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 12, 2024EazyDocs: Re-introduced CVE-2023-6029 (https://wpscanCVE-2024-0248 · WordPress plugins & themes · reported by WPScanMedium 4.3
The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 (https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/) in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was partially fixed in 2.3.9.
- Product
- EazyDocs
- Fixed in
- 2.4.0
- What to do
- Update EazyDocs to 2.4.0 or newer.
Nov 12, 2023HTTP Headers: Server-Side Request Forgery (SSRF)CVE-2023-37978 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Dimitar Ivanov HTTP Headers.This issue affects HTTP Headers: from n/a through 1.18.11.
- Product
- HTTP Headers
- Affected
- up to 1.18.11
- What to do
- Affects up to 1.18.11. Update HTTP Headers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin <= 0.3.2 versions.CVE-2023-27435 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin <= 0.3.2 versions.
- Fixed in
- 1.0.0
- What to do
- Update the plugin to 1.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 30, 2023User Access Manager: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1601 · WordPress plugins & themes · reported by WPScanMedium 5.3
The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations.
- Product
- User Access Manager
- Fixed in
- 2.2.18
- What to do
- Update User Access Manager to 2.2.18 or newer.
Jul 10, 2023This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.CVE-2023-1208 · WordPress plugins & themes · reported by WPScanHigh 7.2
This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution vulnerability.
- Fixed in
- 1.18.11
- What to do
- Update the plugin to 1.18.11 or newer.
May 15, 2023This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerabiliCVE-2023-1207 · WordPress plugins & themes · reported by WPScanHigh 7.2
This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerability.
- Fixed in
- 1.18.8
- What to do
- Update the plugin to 1.18.8 or newer.
Apr 3, 2023Shopping Cart & eCommerce Store: Does not validate HTTP requestsCVE-2023-1124 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.
- Product
- Shopping Cart & eCommerce Store
- Fixed in
- 5.4.3
- What to do
- Update Shopping Cart & eCommerce Store to 5.4.3 or newer.
Jan 23, 2023FluentAuth: Prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-4746 · WordPress plugins & themes · reported by WPScanHigh 7.5
The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.
- Product
- FluentAuth
- Fixed in
- 1.0.2
- What to do
- Update FluentAuth to 1.0.2 or newer.
Jan 23, 2023WP Limit Login Attempts: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-4303 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms.
- Product
- WP Limit Login Attempts
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update WP Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 15, 2022RSFirewall tries to identify the original IP address by looking at different HTTP headers.CVE-2021-4226 · WordPress plugins & themes · reported by WPScanCritical 9.8
RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented.
- Fixed in
- 1.1.25
- What to do
- Update the plugin to 1.1.25 or newer.
Nov 21, 2022WP-Polls: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1581 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
- Product
- WP-Polls
- Fixed in
- 2.76.0
- What to do
- Update WP-Polls to 2.76.0 or newer.
Full record and what to do →NVD recordwpscan.comhightechdad.com
Oct 28, 2022Log HTTP Requests: Stored Cross-Site ScriptingCVE-2022-3402 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers who can trick a site's administrator into performing an action like clicking on a link, or an authenticated user with access to a page that sends a request using user-supplied data via the server, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Log HTTP Requests
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Log HTTP Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 26, 2022Restricted Site Access: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1613 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations.
- Product
- Restricted Site Access
- Fixed in
- 7.3.2
- What to do
- Update Restricted Site Access to 7.3.2 or newer.
Sep 16, 2022Titan Anti-spam & Security: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-2877 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- Titan Anti-spam & Security
- Fixed in
- 7.3.1
- What to do
- Update Titan Anti-spam & Security to 7.3.1 or newer.
Aug 22, 2022Download Manager: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-2362 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions.
- Product
- Download Manager
- Fixed in
- 3.2.50
- What to do
- Update Download Manager to 3.2.50 or newer.
Aug 1, 2022YOP Poll: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1600 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
- Product
- YOP Poll
- Fixed in
- 6.4.3
- What to do
- Update YOP Poll to 6.4.3 or newer.
Jun 27, 2022Import Export All WordPress Images, Users & Post Types: Does not fully validate the file to be imported via an URL before making an HTTP request to itCVE-2022-1977 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
- Product
- Import Export All WordPress Images, Users & Post Types
- Fixed in
- 6.5.3
- What to do
- Update Import Export All WordPress Images, Users & Post Types to 6.5.3 or newer.
Jun 20, 2022WP-EMail: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1614 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based anti-spamming restrictions.
- Product
- WP-EMail
- Fixed in
- 2.69.0
- What to do
- Update WP-EMail to 2.69.0 or newer.
Jun 13, 2022iQ Block Country: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-1762 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- iQ Block Country
- Fixed in
- 1.2.20
- What to do
- Update iQ Block Country to 1.2.20 or newer.
Jul 12, 2021The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request.CVE-2021-24385 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.
- Affected
- 4.7.3 to 4.7.3
- What to do
- Affects 4.7.3 to 4.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 27, 2021Requests is a HTTP library written in PHP.CVE-2021-29476 · WordPress plugins & themes · reported by GitHubCritical 9.8
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
- Product
- Requests
- What to do
- Update Requests to the newest version.
Apr 5, 2021WooCommerce Help Scout: (https://woocommerceCVE-2021-24212 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp.
- Product
- WooCommerce Help Scout
- Fixed in
- 2.9.1
- What to do
- Update WooCommerce Help Scout to 2.9.1 or newer.
Full record and what to do →NVD recorddzv365zjfbd8v.cloudfront.netwpscan.com
Apr 5, 2021When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wtsCVE-2021-24167 · WordPress plugins & themes · reported by WPScanHigh 7.5
When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookup_WP_account.
- Fixed in
- 1.4.1
- What to do
- Update the plugin to 1.4.1 or newer.
May 13, 2020The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.CVE-2020-12742 · WordPress plugins & themes · reported by MITREMedium 6.1
The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.
- Product
- iubenda-cookie-law-solution
- Fixed in
- 2.3.5
- What to do
- Update iubenda-cookie-law-solution to 2.3.5 or newer.
Full record and what to do →NVD recordgithub.comwordpress.org
Oct 10, 2019The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header.CVE-2015-9472 · WordPress plugins & themes · reported by MITREMedium 6.1
The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header.
- Product
- incoming-links
- Fixed in
- 0.9.10b
- What to do
- Update incoming-links to 0.9.10b or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 10, 2019The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTCVE-2015-9466 · WordPress plugins & themes · reported by MITRECritical 9.8
The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable.
- Product
- wti-like-post
- Fixed in
- 1.4.3
- What to do
- Update wti-like-post to 1.4.3 or newer.
Oct 7, 2019The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.CVE-2015-9453 · WordPress plugins & themes · reported by MITREMedium 6.1
The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
- Product
- broken-link-manager
- Fixed in
- 0.6.0
- What to do
- Update broken-link-manager to 0.6.0 or newer.
Oct 6, 2019The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.CVE-2019-17213 · WordPress plugins & themes · reported by MITREMedium 6.1
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
- Affected
- 1.3.0 to 1.3.0
- What to do
- Affects 1.3.0 to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comacunetix.com
Sep 25, 2019The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.CVE-2015-9430 · WordPress plugins & themes · reported by MITREMedium 6.1
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.
- Product
- crazy-bone
- Fixed in
- 0.6.0
- What to do
- Update crazy-bone to 0.6.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.