WordPress fixes multiple security vulnerabilities

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here. WordPress development team has released the security update to patch the following four vulnerabilities out of which three of them have high severity. CVE-2022-21661: A vulnerability exists in WPQuery class which is caused...

WordPress 5.8.3 Security Release

On January 6, 2022, the WordPress core team released WordPress version 5.8.3, which contains security patches for 4 high-severity vulnerabilities. These patches were backported to every version of WordPress since 3.7. WordPress has supported automatic core updates for security releases since...

WordPress 4.9.x < 4.9.19 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS vulnerability through post slugs. - An object injection vulnerability in some multisite installations. - A SQL injection vulnerability in...

WordPress 5.4.x < 5.4.9 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS vulnerability through post slugs. - An object injection vulnerability in some multisite installations. - A SQL injection vulnerability in...

WordPress 3.7.x < 3.7.37 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS vulnerability through post slugs. - An object injection vulnerability in some multisite installations. - A SQL injection vulnerability in...

WordPress 4.6.x < 4.6.22 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A stored Cross-Site Scripting XSS vulnerability through post slugs. - An object injection vulnerability in some multisite installations. - A SQL injection vulnerability in...

CVE-2022-21662 Stored XSS in WordPress

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users like author in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched...

CVE-2022-21663 Authenticated Object Injection in Multisites in WordPress

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3...

CVE-2022-21664 SQL injection in WordPress

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected...

CVE-2021-25022 UpdraftPlus < 1.16.66 - Reflected Cross-Site Scripting

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backuptimestamp and jobid parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues...

AF Companion 1.1.0 - 1.1.2 - Arbitrary Plugin Installation & Activation via CSRF

The plugin has a flawed CSRF check, allowing attackers to make logged in admin installs and activate arbitrary plugins from the WP repository PoC...

Wordpress Plugin Catch Themes Demo Import 1.6.1 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: Wordpress Plugin Catch Themes Demo Import 1.6.1 - Remote Code Execution RCE Authenticated Date 07.12.2021 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://wordpress.org/plugins/catch-themes-demo-import/ Software Link:...

WordPress Plugin Slider By Soliloquy Cross-Site Scripting Vulnerability

WordPress is a suite of blogging platforms from the Wordpress Foundation developed using the PHP language.WordPress Slider By Soliloquy is a drag-and-drop slider plugin that creates beautiful responsive image and video sliders for users' WordPress websites. A cross-site scripting vulnerability...

CVE-2021-36916 WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability

The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...

CVE-2021-20846

The CVE-2021-20846 entry concerns the WordPress plugin Push Notifications for WordPress (Lite) before version 6.0.1. The connected sources confirm a Cross-site Request Forgery (CSRF) vulnerability that can allow an authenticated administrator to be hijacked to perform arbitrary actions via a craf...

WordPress 5.5.x < 5.5.7 Expired DST Root CA X3 Certificate

According to its self-reported version number, the detected WordPress application is affected by an expired certificate. The wordpress/wp-includes/certificates/ca-bundle.crt file still contains the DST Root CA X3 expired certificate. Note that the scanner has not tested for these issues but has...

WordPress 5.3.x < 5.3.10 Expired DST Root CA X3 Certificate

According to its self-reported version number, the detected WordPress application is affected by an expired certificate. The wordpress/wp-includes/certificates/ca-bundle.crt file still contains the DST Root CA X3 expired certificate. Note that the scanner has not tested for these issues but has...

WordPress 5.7.x < 5.7.4 Expired DST Root CA X3 Certificate

According to its self-reported version number, the detected WordPress application is affected by an expired certificate. The wordpress/wp-includes/certificates/ca-bundle.crt file still contains the DST Root CA X3 expired certificate. Note that the scanner has not tested for these issues but has...

CVE-2021-39328 Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting

The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $jobboardprivacypolicylabel variable echo'd out via the /admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access t...

Unlimited PopUps <= 4.5.3 - Author+ SQL Injection

The plugin does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection PoC https://plugins.trac.wordpress.org/browser/unlimited-popups/trunk/popuplist.phpL16...