Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,155 results · page 11 of 24
Aug 29, 2022WPIDE: Does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboardCVE-2022-2261 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue.
- Product
- WPIDE
- Fixed in
- 3.0
- What to do
- Update WPIDE to 3.0 or newer.
Aug 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress.CVE-2022-36347 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 23, 2022Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.CVE-2022-35235 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 22, 2022WP phpMyAdmin: Does not escape some of its settingsCVE-2022-2407 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP phpMyAdmin
- Fixed in
- 5.2.0.4
- What to do
- Update WP phpMyAdmin to 5.2.0.4 or newer.
Aug 22, 2022Transposh WordPress Translation: Exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/adminCVE-2022-25810 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and backup/restore operations.
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.CVE-2021-36847 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.
- Affected
- up to 4.2.21
- What to do
- Affects up to 4.2.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 15, 2022WP-DBManager: Does not prevent administrators from running arbitrary commands on the server in multisite installationsCVE-2022-2354 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.
- Product
- WP-DBManager
- Fixed in
- 2.80.8
- What to do
- Update WP-DBManager to 2.80.8 or newer.
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
- Product
- Website File Changes Monitor
- Fixed in
- 1.8.3
- What to do
- Update Website File Changes Monitor to 1.8.3 or newer.
Aug 8, 2022Directorist: Allows administrators to download other plugins from the same vendor directly to the siteCVE-2022-2046 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.
- Product
- Directorist
- Fixed in
- 7.2.3
- What to do
- Update Directorist to 7.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Aug 1, 2022CAPTCHA 4WP: Lets user input reach a sensitive require_once call in one of its admin-side templatesCVE-2022-2184 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.
- Product
- CAPTCHA 4WP
- Fixed in
- 7.1.0
- What to do
- Update CAPTCHA 4WP to 7.1.0 or newer.
Aug 1, 2022Advanced WordPress Reset: Does not escape some generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2181 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced WordPress Reset
- Fixed in
- 1.6
- What to do
- Update Advanced WordPress Reset to 1.6 or newer.
Jul 25, 2022Header Footer Code Manager: Does not escape generated URLs before outputting them back in attributes in an admin pageCVE-2022-0899 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Header Footer Code Manager
- Fixed in
- 1.1.24
- What to do
- Update Header Footer Code Manager to 1.1.24 or newer.
Jul 20, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress.CVE-2021-36849 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress.
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 17, 2022Advanced Database Cleaner: Does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced Database Cleaner
- Fixed in
- 3.1.1
- What to do
- Update Advanced Database Cleaner to 3.1.1 or newer.
Jul 11, 2022Admin Management Xtended: Does not have CSRF checks in some of its AJAX actionsCVE-2022-1599 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.
- Product
- Admin Management Xtended
- Fixed in
- 2.4.5
- What to do
- Update Admin Management Xtended to 2.4.5 or newer.
Jul 11, 2022FoxyShop: Does not sanitise and escape a parameter before outputting it back in an admin pageCVE-2022-1220 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- FoxyShop
- Fixed in
- 4.8.2
- What to do
- Update FoxyShop to 4.8.2 or newer.
Jul 6, 2022custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.CVE-2015-3173 · WordPress plugins & themes · reported by Red HatHigh 7.2
custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.
- Fixed in
- 0.9.8.6
- What to do
- Update the plugin to 0.9.8.6 or newer.
Full record and what to do →NVD recordblog.nettitude.comgithub.com
Jun 27, 2022ARMember: Is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated usersCVE-2022-1903 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
- Product
- ARMember
- Fixed in
- 3.4.8
- What to do
- Update ARMember to 3.4.8 or newer.
Jun 27, 2022Social Share Buttons by Supsystic: Does not perform CSRF checks in it's ajax endpoints and admin pagesCVE-2022-1653 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks.
- Product
- Social Share Buttons by Supsystic
- Fixed in
- 2.2.4
- What to do
- Update Social Share Buttons by Supsystic to 2.2.4 or newer.
Jun 16, 2022Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36827 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
- Product
- Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at
- Affected
- up to 3.6.9
- What to do
- Affects up to 3.6.9. Update Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 15, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.CVE-2022-29450 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compatchstack.com
Jun 13, 2022Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrCVE-2022-1654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions
- Affected
- up to 6.10.1
- What to do
- Affects up to 6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022WP Admin Style: Does not sanitise and escape some of its settingsCVE-2022-1814 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- WP Admin Style
- Affected
- up to 0.1.2
- What to do
- Affects up to 0.1.2. Update WP Admin Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022WP Athletics: Does not sanitise and escape a parameter before outputting back in an admin pageCVE-2022-1773 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- WP Athletics
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update WP Athletics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Newsletter: Does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pagesCVE-2022-1756 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
- Product
- Newsletter
- Fixed in
- 7.4.5
- What to do
- Update Newsletter to 7.4.5 or newer.
Jun 13, 2022Useful Banner Manager: Does not perform CSRF checks on POST requests to its admin pageCVE-2022-1694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.
- Product
- Useful Banner Manager
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Useful Banner Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022HC Custom WP-Admin URL: Leaks the secret login URLCVE-2022-1595 · WordPress plugins & themes · reported by WPScanMedium 5.3
The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
- Product
- HC Custom WP-Admin URL
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HC Custom WP-Admin URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022HC Custom WP-Admin URL: Does not have CSRF check in placeCVE-2022-1594 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL
- Product
- HC Custom WP-Admin URL
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HC Custom WP-Admin URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a RCVE-2022-1532 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Fixed in
- 1.3.8
- What to do
- Update the plugin to 1.3.8 or newer.
Jun 13, 2022Advanced Admin Search: Does not sanitize and escape some parameters before outputting them back in an admin pageCVE-2022-0626 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Advanced Admin Search
- Fixed in
- 1.1.6
- What to do
- Update Advanced Admin Search to 1.1.6 or newer.
Jun 8, 2022WP Simple Adsense Insertion: Does not perform CSRF checks on updates to its admin pageCVE-2022-1695 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form.
- Product
- WP Simple Adsense Insertion
- Fixed in
- 2.1
- What to do
- Update WP Simple Adsense Insertion to 2.1 or newer.
Jun 8, 2022Note Press: Does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin pageCVE-2022-1690 · WordPress plugins & themes · reported by WPScanLow 2.7
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection
- Product
- Note Press
- Affected
- up to 0.1.10
- What to do
- Affects up to 0.1.10. Update Note Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Note Press: Does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboardCVE-2022-1688 · WordPress plugins & themes · reported by WPScanLow 2.7
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections
- Product
- Note Press
- Affected
- up to 0.1.10
- What to do
- Affects up to 0.1.10. Update Note Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Logo Slider: Does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin pageCVE-2022-1687 · WordPress plugins & themes · reported by WPScanLow 2.7
The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection
- Product
- Logo Slider
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Five Minute Webshop: Does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin pageCVE-2022-1685 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
- Product
- Five Minute Webshop
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 30, 2022WP 2FA: Does not sanitise and escape a parameter before outputting it back in an admin pageCVE-2022-1527 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- WP 2FA
- Fixed in
- 2.2.1
- What to do
- Update WP 2FA to 2.2.1 or newer.
May 30, 2022Smush: Does not sanitise and escape a configuration parameter before outputting it back in an admin pageCVE-2022-1009 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
- Product
- Smush
- Fixed in
- 3.9.9
- What to do
- Update Smush to 3.9.9 or newer.
May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
- Product
- JivoChat Live Chat
- Fixed in
- 1.3.5.4
- What to do
- Update JivoChat Live Chat to 1.3.5.4 or newer.
May 23, 2022Check & Log Email: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1547 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Check & Log Email
- Fixed in
- 1.0.6
- What to do
- Update Check & Log Email to 1.0.6 or newer.
May 23, 2022Domain Replace: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1218 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Domain Replace
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update Domain Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Turn off all comments: Does not sanitise and escape the rows parameter before outputting it back in an admin pageCVE-2022-1192 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Turn off all comments
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Turn off all comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 20, 2022Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.CVE-2022-29447 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 onCVE-2022-29432 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters.
- Affected
- up to 2.1.27
- What to do
- Affects up to 2.1.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.CVE-2022-29448 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1 aCVE-2022-29424 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1 at WordPress.
- Affected
- up to 9.7.1
- What to do
- Affects up to 9.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress.CVE-2021-36833 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress.
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 19, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.CVE-2022-29446 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 18, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.CVE-2022-29445 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 16, 2022Custom TinyMCE Shortcode Button: Does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin pageCVE-2022-1217 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
- Product
- Custom TinyMCE Shortcode Button
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Custom TinyMCE Shortcode Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.