Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
596 results · page 10 of 12
Jul 11, 2022Rename wp-login.php: Does not have CSRF check in placeCVE-2022-1732 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Rename wp-login.php
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Rename wp-login.php to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022Sharebar: Does not have CSRF check in placeCVE-2022-1626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and also lead to Stored Cross-Site Scripting issue due to the lack of sanitisation and escaping in some of them
- Product
- Sharebar
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Sharebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 4, 2022WP Championship: Is lacking CSRF checks in various placesCVE-2022-1967 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- WP Championship
- Fixed in
- 9.3
- What to do
- Update WP Championship to 9.3 or newer.
Jun 27, 2022MyCSS: Does not have CSRF check in placeCVE-2022-1960 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- MyCSS
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MyCSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Clean-Contact: Does not have CSRF check in placeCVE-2022-1914 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS due to the lack of sanitisation and escaping as well
- Product
- Clean-Contact
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Clean-Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Add Post URL: Does not have CSRF check in placeCVE-2022-1913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Add Post URL
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Add Post URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Cimy Header Image Rotator: Does not have CSRF check in placeCVE-2022-1885 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Cimy Header Image Rotator
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update Cimy Header Image Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Rotating Posts: Does not have CSRF check in placeCVE-2022-1847 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Rotating Posts
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update Rotating Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Tiny Contact Form: Does not have CSRF check in placeCVE-2022-1846 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Tiny Contact Form
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Tiny Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022WP Sentry: Does not have CSRF check in placeCVE-2022-1844 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- WP Sentry
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Sentry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022MailPress: Does not have CSRF checks in various placesCVE-2022-1843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks
- Product
- MailPress
- Affected
- up to 7.2.1
- What to do
- Affects up to 7.2.1. Update MailPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022OpenBook Book Data: Does not have CSRF check in placeCVE-2022-1842 · WordPress plugins & themes · reported by WPScanMedium 4.3
The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- OpenBook Book Data
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update OpenBook Book Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022My Private Site: Does not have CSRF check in placeCVE-2022-1627 · WordPress plugins & themes · reported by WPScanMedium 4.3
The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- My Private Site
- Fixed in
- 3.0.8
- What to do
- Update My Private Site to 3.0.8 or newer.
Jun 27, 2022New User Approve: Does not have CSRF check in placeCVE-2022-1625 · WordPress plugins & themes · reported by WPScanMedium 4.3
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.
- Product
- New User Approve
- Fixed in
- 2.4
- What to do
- Update New User Approve to 2.4 or newer.
Jun 27, 2022Site Offline or Coming Soon: Does not have CSRF check in placeCVE-2022-1593 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack
- Product
- Site Offline or Coming Soon
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Site Offline or Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022HTML2WP: Does not have CSRF check in placeCVE-2022-1573 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022underConstruction: Does not have CSRF check in placeCVE-2022-1895 · WordPress plugins & themes · reported by WPScanMedium 4.3
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- underConstruction
- Fixed in
- 1.20
- What to do
- Update underConstruction to 1.20 or newer.
Jun 20, 2022CaPa Protect: Does not have CSRF check in placeCVE-2022-1832 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection.
- Product
- CaPa Protect
- Affected
- up to 0.5.8.2
- What to do
- Affects up to 0.5.8.2. Update CaPa Protect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022WPlite: Does not have CSRF check in placeCVE-2022-1831 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WPlite
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update WPlite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Amazon Einzeltitellinks: Does not have CSRF check in placeCVE-2022-1830 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Amazon Einzeltitellinks
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Amazon Einzeltitellinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Inline Google Maps: Does not have CSRF check in placeCVE-2022-1829 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Inline Google Maps
- Affected
- up to 5.11
- What to do
- Affects up to 5.11. Update Inline Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022PDF24 Articles To PDF: Does not have CSRF check in placeCVE-2022-1828 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- PDF24 Articles To PDF
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update PDF24 Articles To PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022PDF24 Article To PDF: Does not have CSRF check in placeCVE-2022-1827 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- PDF24 Article To PDF
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update PDF24 Article To PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Cross-Linker: Does not have CSRF check in placeCVE-2022-1826 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- Cross-Linker
- Affected
- up to 3.0.1.9
- What to do
- Affects up to 3.0.1.9. Update Cross-Linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Multi-page Toolkit: Does not have CSRF check in placeCVE-2022-1818 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- Multi-page Toolkit
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Multi-page Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Seamless Donations: Does not have CSRF check in placeCVE-2022-1610 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Seamless Donations
- Fixed in
- 5.1.9
- What to do
- Update Seamless Donations to 5.1.9 or newer.
Jun 20, 2022Mail Subscribe List: Does not have CSRF check in placeCVE-2022-1603 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list
- Product
- Mail Subscribe List
- Fixed in
- 2.1.4
- What to do
- Update Mail Subscribe List to 2.1.4 or newer.
Jun 20, 2022Better Find and Replace: Does not properly sanitiseCVE-2022-1472 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
- Product
- Better Find and Replace
- Fixed in
- 1.3.6
- What to do
- Update Better Find and Replace to 1.3.6 or newer.
Jun 13, 2022Quick Subscribe: Does not have CSRF check in placeCVE-2022-1792 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them
- Product
- Quick Subscribe
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Quick Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022One Click Plugin Updater: Does not have CSRF check in placeCVE-2022-1791 · WordPress plugins & themes · reported by WPScanHigh 8.1
The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.
- Product
- One Click Plugin Updater
- Affected
- up to 2.4.14
- What to do
- Affects up to 2.4.14. Update One Click Plugin Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022New User Email Set Up: Does not have CSRF check in placeCVE-2022-1790 · WordPress plugins & themes · reported by WPScanMedium 6.5
The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- New User Email Set Up
- Affected
- up to 0.5.2
- What to do
- Affects up to 0.5.2. Update New User Email Set Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Sideblog: Does not have CSRF check in placeCVE-2022-1787 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Sideblog
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update Sideblog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022postTabs: Does not have CSRF check in placeCVE-2022-1781 · WordPress plugins & themes · reported by WPScanMedium 5.4
The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- postTabs
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update postTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022LaTeX for: Does not have CSRF check in placeCVE-2022-1780 · WordPress plugins & themes · reported by WPScanMedium 5.4
The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack which could also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- LaTeX for
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update LaTeX for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Auto Delete Posts: Does not have CSRF check in placeCVE-2022-1779 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.
- Product
- Auto Delete Posts
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Auto Delete Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Google Places Reviews: Does not properly escape its Google API key settingCVE-2022-1772 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.
- Product
- Google Places Reviews
- Fixed in
- 2.0.0
- What to do
- Update Google Places Reviews to 2.0.0 or newer.
Jun 13, 2022WP-chgFontSize: Does not have CSRF check in placeCVE-2022-1764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- WP-chgFontSize
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update WP-chgFontSize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022RB Internal Links: Does not have CSRF check in placeCVE-2022-1759 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as perform Stored Cross-Site Scripting attacks due to the lack of sanitisation and escaping
- Product
- RB Internal Links
- Affected
- up to 2.0.16
- What to do
- Affects up to 2.0.16. Update RB Internal Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Genki Pre-Publish Reminder: Does not have CSRF check in placeCVE-2022-1758 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS as well as RCE when custom code is added via the plugin settings.
- Product
- Genki Pre-Publish Reminder
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Genki Pre-Publish Reminder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Latest Tweets Widget: Does not have CSRF check in placeCVE-2022-1624 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Latest Tweets Widget
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Latest Tweets Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Webriti SMTP Mail: Does not have CSRF check in placeCVE-2022-1612 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Webriti SMTP Mail
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Webriti SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022OnePress Social Locker: Does not have CSRF check in placeCVE-2022-1608 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- OnePress Social Locker
- Affected
- up to 5.6.2
- What to do
- Affects up to 5.6.2. Update OnePress Social Locker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Email Users: Does not have CSRF check in placeCVE-2022-1605 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and change the notification settings of arbitrary users
- Product
- Email Users
- Affected
- up to 4.8.8
- What to do
- Affects up to 4.8.8. Update Email Users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022HC Custom WP-Admin URL: Does not have CSRF check in placeCVE-2022-1594 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL
- Product
- HC Custom WP-Admin URL
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HC Custom WP-Admin URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022LiveSync for: Does not have CSRF check in placeCVE-2022-1712 · WordPress plugins & themes · reported by WPScanMedium 4.3
The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- LiveSync for
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update LiveSync for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022Throws SPAM Away: Does not have CSRF checks in placeCVE-2022-1709 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers to make a logged in admin delete comments via a CSRF attack
- Product
- Throws SPAM Away
- Fixed in
- 3.3.1
- What to do
- Update Throws SPAM Away to 3.3.1 or newer.
Jun 8, 2022Database Backup for: Does not have CSRF check in placeCVE-2022-1577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
- Product
- Database Backup for
- Fixed in
- 2.5.2
- What to do
- Update Database Backup for to 2.5.2 or newer.
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
May 23, 2022Domain Replace: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1218 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Domain Replace
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update Domain Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022WPCargo Track & Trace: Does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the pageCVE-2022-1436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.