Overview 682 matches · 0 in Waratek scope · 0 protected · 29 exploited · 5 CISA KEV · 107 public PoC · 19 EPSS ≥ 0.5
682matches
0in Waratek scope0.0%
0protected0.0%
29exploited4.3%
5CISA KEV0.7%
107public PoC15.7%
19EPSS ≥ 0.52.8%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
0.1%
Not applicable
681
99.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
682
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 96 / year
20042
Not applicable2
Medium2
not blocked2
Working exploit published2
200510
Not applicable10
High4
Medium6
not blocked10
Working exploit published2
No public exploit8
200619
Not applicable19
Critical1
High4
Medium13
Low1
not blocked19
Working exploit published6
No public exploit13
200743
Not applicable43
Critical1
High6
Medium33
Low3
not blocked43
Working exploit published15
No public exploit28
200821
Not applicable21
High8
Medium13
not blocked21
Working exploit published7
No public exploit14
200917
Not applicable17
High4
Medium12
Low1
not blocked17
Working exploit published8
No public exploit9
20102
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
201113
Not applicable13
High5
Medium7
Low1
not blocked13
No public exploit13
201226
Not applicable26
High5
Medium17
Low4
not blocked26
Working exploit published6
No public exploit20
201320
Not applicable20
High2
Medium15
Low3
not blocked20
Working exploit published3
No public exploit17
201440
Not applicable40
High4
Medium34
Low2
not blocked40
Working exploit published3
Proof of concept only1
No public exploit36
201519
Not applicable19
High3
Medium15
Low1
not blocked19
Exploited1
Working exploit published4
No public exploit14
201622
Not applicable22
Critical2
High10
Medium10
not blocked22
Exploited1
Working exploit published1
No public exploit20
201749
Outside Waratek scope1
Not applicable48
Critical3
High14
Medium32
not blocked49
Exploited5
Working exploit published5
No public exploit39
201823
Not applicable23
Critical2
High10
Medium11
not blocked23
Exploited1
Working exploit published4
Forecast only1
No public exploit17
201935
Not applicable35
Critical4
High11
Medium20
not blocked35
Exploited1
Working exploit published4
No public exploit30
202029
Not applicable29
Critical9
High7
Medium11
Low2
not blocked29
Exploited2
Working exploit published2
No public exploit25
202127
Not applicable27
Critical5
High11
Medium11
not blocked27
Exploited1
Working exploit published2
No public exploit24
202243
Not applicable43
Critical1
High14
Medium28
not blocked43
Exploited6
Working exploit published5
Proof of concept only1
No public exploit31
202396
Not applicable96
Critical6
High31
Medium59
not blocked96
Exploited4
Working exploit published3
Proof of concept only17
No public exploit72
202486
Not applicable86
Critical20
High29
Medium37
not blocked86
Exploited3
Working exploit published3
Proof of concept only13
No public exploit67
202536
Not applicable36
Critical4
High10
Medium22
not blocked36
Working exploit published1
Proof of concept only10
No public exploit25
20264
Not applicable4
Critical1
High2
Medium1
not blocked4
Exploited4
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-23806 | Medium | 2023-04-23 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Davinder Singh Custom Settings plugin <= 1.0 versions. |
| CVE-2022-44743 | Medium | 2023-04-23 | Not applicable | No public exploit | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.11.2 versions. |
| CVE-2023-0423 | Medium | 2023-04-10 | Not applicable | Proof of concept only | The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin |
| CVE-2023-28789 | High | 2023-04-07 | Not applicable | No public exploit | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions. |
| CVE-2023-28781 | High | 2023-04-07 | Not applicable | No public exploit | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions. |
| CVE-2023-26536 | Medium | 2023-04-05 | Not applicable | No public exploit | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.05 versions. |
| CVE-2023-1840 | Medium | 2023-04-04 | Not applicable | No public exploit | The Sp*tify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.07 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. |
| CVE-2022-30705 | High | 2023-03-27 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions. |
| CVE-2023-28664 | Medium | 2023-03-22 | Not applicable | Proof of concept only | The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user. |
| CVE-2023-1431 | Medium | 2023-03-16 | Not applicable | No public exploit | The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 due to the plugin saving shopping cart data exports in a publicly accessible location (/wp-content/plugins/wordpress-simple-paypal-shopping-cart/includes/admin/). This makes it possible for unauthenticated attackers to view information that should be limited to administrators only and can include data like first name, last name, email, address, IP Address, and more. |
| CVE-2022-4931 | Medium | 2023-03-07 | Not applicable | Exploited | The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up. |
| CVE-2023-0063 | Medium | 2023-03-06 | Not applicable | Proof of concept only | The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. |
| CVE-2022-4626 | Medium | 2023-02-06 | Not applicable | Proof of concept only | The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. |
| CVE-2022-4321 | Medium | 2023-02-06 | Not applicable | Working exploit published | The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin |
| CVE-2022-4794 | High | 2023-01-30 | Not applicable | Proof of concept only | The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies. |
| CVE-2022-4672 | Medium | 2023-01-23 | Not applicable | Proof of concept only | The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. |
| CVE-2022-4383 | Critical | 2023-01-23 | Not applicable | Proof of concept only | The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. |
| CVE-2022-4507 | Medium | 2023-01-16 | Not applicable | Proof of concept only | The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins. |
| CVE-2022-4320 | Medium | 2023-01-16 | Not applicable | Working exploit published | The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin). |
| CVE-2022-4392 | Medium | 2023-01-09 | Not applicable | Proof of concept only | The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. |
| CVE-2023-22622 | Medium | 2023-01-05 | Not applicable | No public exploit | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits. |
| CVE-2022-4142 | Medium | 2023-01-02 | Not applicable | Proof of concept only | The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled. |
| CVE-2022-2536 | High | 2022-12-15 | Not applicable | No public exploit | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php." |
| CVE-2022-3590 | Medium | 2022-12-14 | Not applicable | Exploited | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. |
| CVE-2022-43468 | High | 2022-12-07 | Not applicable | No public exploit | External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input. |
| CVE-2022-43504 | Medium | 2022-12-05 | Not applicable | No public exploit | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7. |
| CVE-2022-43500 | Medium | 2022-12-05 | Not applicable | No public exploit | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. |
| CVE-2022-43497 | Medium | 2022-12-05 | Not applicable | No public exploit | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. |
| CVE-2022-45073 | High | 2022-11-18 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress. |
| CVE-2022-41135 | Medium | 2022-11-18 | Not applicable | No public exploit | Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress. |
| CVE-2022-1591 | Medium | 2022-09-19 | Not applicable | No public exploit | The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack |
| CVE-2022-2462 | Medium | 2022-09-06 | Not applicable | Working exploit published | The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text. |
| CVE-2022-2461 | Medium | 2022-09-06 | Not applicable | Exploited | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site. |
| CVE-2022-25812 | High | 2022-08-22 | Not applicable | No public exploit | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE |
| CVE-2022-25811 | High | 2022-08-22 | Not applicable | No public exploit | The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection |
| CVE-2022-25810 | Medium | 2022-08-22 | Not applicable | No public exploit | The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and backup/restore operations. |
| CVE-2022-2557 | High | 2022-08-22 | Not applicable | No public exploit | The Team WordPress plugin before 4.1.2 contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user |
| CVE-2021-24912 | Medium | 2022-08-22 | Not applicable | No public exploit | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in admin |
| CVE-2021-24911 | Medium | 2022-08-22 | Not applicable | No public exploit | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting. |
| CVE-2021-24910 | Medium | 2022-08-22 | Not applicable | Working exploit published | The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue |
| CVE-2022-2398 | Medium | 2022-08-08 | Not applicable | No public exploit | The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed |
| CVE-2022-2181 | Medium | 2022-08-01 | Not applicable | No public exploit | The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting |
| CVE-2022-1028 | Medium | 2022-06-27 | Not applicable | No public exploit | The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup) |
| CVE-2022-1010 | Medium | 2022-06-27 | Not applicable | No public exploit | The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) |
| CVE-2022-1800 | High | 2022-06-13 | Not applicable | No public exploit | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability. |
| CVE-2021-36833 | Medium | 2022-05-20 | Not applicable | No public exploit | Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress. |
| CVE-2022-28290 | Medium | 2022-04-25 | Not applicable | Exploited | Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request |
| CVE-2021-25111 | Medium | 2022-04-25 | Not applicable | Working exploit published | The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue |
| CVE-2011-1762 | Medium | 2022-04-18 | Not applicable | No public exploit | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission. |
| CVE-2022-0770 | High | 2022-03-28 | Not applicable | No public exploit | The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access to a logged in admin cookies by making them open a malicious link or page |
| CVE-2021-24962 | High | 2022-03-28 | Not applicable | No public exploit | The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution. |
| CVE-2021-25026 | Medium | 2022-03-14 | Not applicable | No public exploit | The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed |
| CVE-2022-0445 | Medium | 2022-03-07 | Not applicable | No public exploit | The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack |
| CVE-2021-24961 | Medium | 2022-03-07 | Not applicable | No public exploit | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks |
| CVE-2021-24960 | Medium | 2022-03-07 | Not applicable | No public exploit | The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks |
| CVE-2022-0345 | Medium | 2022-02-28 | Not applicable | No public exploit | The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.). |
| CVE-2021-25055 | Medium | 2022-02-21 | Not applicable | Working exploit published | The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility" parameter. |
| CVE-2021-25103 | Medium | 2022-02-07 | Not applicable | No public exploit | The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCE_SALT and NONCE_KEY |
| CVE-2022-0218 | High | 2022-02-04 | Not applicable | Exploited | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site. |
| CVE-2022-0220 | Medium | 2022-02-01 | Not applicable | Working exploit published | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce) |
| CVE-2021-24814 | Critical | 2022-02-01 | Not applicable | No public exploit | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction). |
| CVE-2022-21664 | High | 2022-01-06 | Not applicable | No public exploit | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue. |
| CVE-2022-21663 | High | 2022-01-06 | Not applicable | Proof of concept only | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue. |
| CVE-2022-21662 | High | 2022-01-06 | Not applicable | Exploited | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue. |
| CVE-2022-21661 | High | 2022-01-06 | Not applicable | Exploited | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability. |
| CVE-2021-24718 | Medium | 2021-12-06 | Not applicable | No public exploit | The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed |
| CVE-2021-44223 | Critical | 2021-11-25 | Not applicable | No public exploit | WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory. |
| CVE-2021-20846 | High | 2021-11-24 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker to hijack the authentication of an administrator and conduct an arbitrary operation via a specially crafted web page. |
| CVE-2021-43409 | Critical | 2021-11-19 | Not applicable | No public exploit | The “WPO365 | LOGIN” WordPress plugin (up to and including version 15.3) by wpo365.com is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability (also known as Stored or Second-Order XSS). Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous content. This type of XSS vulnerability is exploited by submitting malicious script content to the application which is then retrieved and executed by other application users. The attacker could exploit this to conduct a range of attacks against users of the affected application such as session hijacking, account take over and accessing sensitive data. In this case, the XSS payload can be submitted by any anonymous user, the payload then renders and executes when a WordPress administrator authenticates and accesses the WordPress Dashboard. The injected payload can carry out actions on behalf of the administrator including adding other administrative users and changing application settings. This flaw could be exploited to ultimately provide full control of the affected system to the attacker. |
| CVE-2021-42362 | High | 2021-11-17 | Not applicable | Working exploit published | The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2. |
| CVE-2021-36872 | Medium | 2021-09-23 | Not applicable | No public exploit | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type]. |
| CVE-2021-24623 | Medium | 2021-09-13 | Not applicable | No public exploit | The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. |
| CVE-2021-38340 | Medium | 2021-09-10 | Not applicable | No public exploit | The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2. |
| CVE-2021-39203 | Medium | 2021-09-09 | Not applicable | No public exploit | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release. |
| CVE-2021-39202 | High | 2021-09-09 | Not applicable | No public exploit | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8. |
| CVE-2021-39201 | High | 2021-09-09 | Not applicable | No public exploit | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress) |
| CVE-2021-39200 | Medium | 2021-09-09 | Not applicable | No public exploit | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. |
| CVE-2021-24380 | Medium | 2021-08-16 | Not applicable | No public exploit | The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values. |
| CVE-2021-32770 | High | 2021-07-15 | Not applicable | No public exploit | Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the `auth: { }` section. Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`. One may manually edit the app.js file post-build as a workaround. |
| CVE-2021-20781 | High | 2021-07-14 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions prior to v.2.2.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors. |
| CVE-2021-20780 | High | 2021-07-07 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. |
| CVE-2021-20779 | High | 2021-07-07 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote attackers to hijack the authentication of administrators via unspecified vectors. |
| CVE-2021-20746 | Medium | 2021-06-28 | Not applicable | No public exploit | Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. |
| CVE-2020-36326 | Critical | 2021-04-28 | Not applicable | No public exploit | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation. |
| CVE-2021-29450 | Medium | 2021-04-15 | Not applicable | No public exploit | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. |
| CVE-2021-29447 | High | 2021-04-15 | Not applicable | Working exploit published | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled. |
| CVE-2021-24231 | Medium | 2021-04-12 | Not applicable | No public exploit | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged administrator disconnect the site from Patreon by visiting a specially crafted link. |
| CVE-2021-24230 | High | 2021-04-12 | Not applicable | No public exploit | The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content. |
| CVE-2021-24229 | Critical | 2021-04-12 | Not applicable | No public exploit | The Jetpack Scan team identified a Reflected Cross-Site Scripting via the patreon_save_attachment_patreon_level AJAX action of the Patreon WordPress plugin before 1.7.2. This AJAX hook is used to update the pledge level required by Patreon subscribers to access a given attachment. This action is accessible for user accounts with the ‘manage_options’ privilege (i.e.., only administrators). Unfortunately, one of the parameters used in this AJAX endpoint is not sanitized before being printed back to the user, so the risk it represents is the same as the previous XSS vulnerability. |
| CVE-2021-24228 | Critical | 2021-04-12 | Not applicable | No public exploit | The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized. |
| CVE-2021-24227 | High | 2021-04-12 | Not applicable | Exploited | The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies. |
| CVE-2021-24211 | Medium | 2021-04-05 | Not applicable | No public exploit | The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser. |
| CVE-2020-28040 | Medium | 2020-11-02 | Not applicable | No public exploit | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. |
| CVE-2020-28039 | Critical | 2020-11-02 | Not applicable | No public exploit | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. |
| CVE-2020-28038 | Medium | 2020-11-02 | Not applicable | No public exploit | WordPress before 5.5.2 allows stored XSS via post slugs. |
| CVE-2020-28037 | Critical | 2020-11-02 | Not applicable | No public exploit | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). |
| CVE-2020-28036 | Critical | 2020-11-02 | Not applicable | No public exploit | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. |
| CVE-2020-28035 | Critical | 2020-11-02 | Not applicable | No public exploit | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. |
| CVE-2020-28034 | Medium | 2020-11-02 | Not applicable | Exploited | WordPress before 5.5.2 allows XSS associated with global variables. |
| CVE-2020-28033 | High | 2020-11-02 | Not applicable | No public exploit | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. |