Vulnerability database

5,867 results · page 116 of 118

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codez Quick Call Button plugin <= 1.2.9 versions.CVE-2023-47829 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codez Quick Call Button plugin <= 1.2.9 versions.

  Affected

  up to 1.2.9

  What to do

  Affects up to 1.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.CVE-2023-47821 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.

  Affected

  up to 2.1.8

  What to do

  Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions.CVE-2023-47817 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions.

  Affected

  up to 2023.10.13

  What to do

  Affects up to 2023.10.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by CVE-2023-47816 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.13 versions.

  Affected

  up to 1.7.0.13

  What to do

  Affects up to 1.7.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra plugin <= 2.5.2 versiCVE-2023-47815 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra plugin <= 2.5.2 versions.

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Waterloo Plugins BMI Calculator Plugin plugin <= 1.0.3 verCVE-2023-47814 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Waterloo Plugins BMI Calculator Plugin plugin <= 1.0.3 versions.

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.CVE-2023-47813 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.

  Affected

  up to 2.8.1

  What to do

  Affects up to 2.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns plugin <= 1.6.1 versions.CVE-2023-47812 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns plugin <= 1.6.1 versions.

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5 CVE-2023-47811 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5 versions.

  Affected

  up to 1.0.5

  What to do

  Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin <= 1.3.0 versions.CVE-2023-47810 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin <= 1.3.0 versions.

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions.CVE-2023-47809 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions.

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versioCVE-2023-47808 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versions.

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions.CVE-2023-47786 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions.

  Affected

  up to 7.7.9

  What to do

  Affects up to 7.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versCVE-2023-47773 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions.

  Affected

  up to 2.8.2

  What to do

  Affects up to 2.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter plugin <= 1.17 versions.CVE-2023-47768 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter plugin <= 1.17 versions.

  Affected

  up to 1.17

  What to do

  Affects up to 1.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versionCVE-2023-47767 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versions.

  Affected

  up to 3.2.0

  What to do

  Affects up to 3.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versCVE-2023-47766 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 versions.

  Fixed in

  1.11.1

  What to do

  Update the plugin to 1.11.1 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Chaty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47759 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty allows DOM-Based XSS.This issue affects Chaty: from n/a through <= 3.1.2.

  Product

  Chaty

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update Chaty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions.CVE-2023-30496 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions.

  Fixed in

  5.2.6

  What to do

  Update the plugin to 5.2.6 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <= 3.3CVE-2023-47755 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <= 3.3.5 versions.

  Affected

  up to 3.3.5

  What to do

  Affects up to 3.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 20, 2023Five Star Restaurant Menu and Food Ordering: Unserializes user input via an AJAX action available to unauthenticated usersCVE-2023-5340 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog.

  Product

  Five Star Restaurant Menu and Food Ordering

  Fixed in

  2.4.11

  What to do

  Update Five Star Restaurant Menu and Food Ordering to 2.4.11 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Nov 16, 2023Raise Mag: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-28621 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wishfulthemes Raise Mag, Wishfulthemes Wishful Blog themes allows Reflected XSS.This issue affects Raise Mag: from n/a through 1.0.7; Wishful Blog: from n/a through 2.0.1.

  Product

  Raise Mag

  Affected

  up to 1.0.7

  What to do

  Affects up to 1.0.7. Update Raise Mag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Nov 7, 2023Social Sharing Plugin - Social Warfare: Stored Cross-Site ScriptingCVE-2023-4842 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Social Sharing Plugin - Social Warfare

  Affected

  up to 4.4.3

  What to do

  Affects up to 4.4.3. Update Social Sharing Plugin - Social Warfare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 31, 2023Campaign Monitor Forms by Optin Cat: Does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true"CVE-2023-5098 · WordPress plugins & themes · reported by WPScanHigh 8.1

  The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.

  Product

  Campaign Monitor Forms by Optin Cat

  Fixed in

  2.5.6

  What to do

  Update Campaign Monitor Forms by Optin Cat to 2.5.6 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Oct 31, 2023WordPress File Sharing: Does not check authorization before displaying files and foldersCVE-2023-4836 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced

  Product

  WordPress File Sharing

  Fixed in

  2.0.5

  What to do

  Update WordPress File Sharing to 2.0.5 or newer.

  Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com

• Oct 31, 2023WP Meta and Date Remover: Provides an AJAX endpoint for configuring the plugin settingsCVE-2023-4823 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.

  Product

  WP Meta and Date Remover

  Fixed in

  2.2.0

  What to do

  Update WP Meta and Date Remover to 2.2.0 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Oct 25, 2023Easy Testimonial Slider and Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-45754 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form allows Stored XSS.This issue affects Easy Testimonial Slider and Form: from n/a through 1.0.18.

  Product

  Easy Testimonial Slider and Form

  Affected

  up to 1.0.18

  What to do

  Affects up to 1.0.18. Update Easy Testimonial Slider and Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Oct 20, 2023Social Media Share Buttons & Social Sharing Icons: Cross-Site Request ForgeryCVE-2023-5602 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Social Media Share Buttons & Social Sharing Icons

  Affected

  up to 2.8.5

  What to do

  Affects up to 2.8.5. Update Social Media Share Buttons & Social Sharing Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 20, 2023Social Media Share Buttons & Social Sharing Icons: Sensitive Information ExposureCVE-2023-5070 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.

  Product

  Social Media Share Buttons & Social Sharing Icons

  Affected

  up to 2.8.5

  What to do

  Affects up to 2.8.5. Update Social Media Share Buttons & Social Sharing Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Oct 2, 2023Rescue Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-41728 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through 2.5.

  Product

  Rescue Shortcodes

  Affected

  up to 2.5

  What to do

  Affects up to 2.5. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Sep 11, 2023MasterStudy LMS: Does not have proper checks in place during registration allowing anyone to register on the siteCVE-2023-4278 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.

  Product

  MasterStudy LMS

  Fixed in

  3.0.18

  What to do

  Update MasterStudy LMS to 3.0.18 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com

• Sep 4, 2023WordPress File Sharing: Stored Cross-Site ScriptingCVE-2023-4636 · WordPress plugins & themes · reported by WordfenceMedium 4.4

  The WordPress File Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Product

  WordPress File Sharing

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update WordPress File Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org

• Aug 16, 2023Image Optimizer by 10web: Does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panelCVE-2023-2122 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.

  Product

  Image Optimizer by 10web

  Fixed in

  1.0.27

  What to do

  Update Image Optimizer by 10web to 1.0.27 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jul 25, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions.CVE-2023-36502 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions.

  Affected

  up to 1.3.2

  What to do

  Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in FiveStarPlugins Restaurant Menu and Food Ordering plugin <= 2.4.6 versions.CVE-2023-37985 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in FiveStarPlugins Restaurant Menu and Food Ordering plugin <= 2.4.6 versions.

  Fixed in

  2.4.7

  What to do

  Update the plugin to 2.4.7 or newer.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jun 26, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PI Websolution Conditional cart fee plugin <= 1.0.96 versiCVE-2023-29093 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PI Websolution Conditional cart fee plugin <= 1.0.96 versions.

  Affected

  up to 1.0.96

  What to do

  Affects up to 1.0.96. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• May 15, 2023RapidExpCart: Does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the pageCVE-2023-0520 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection means an attacker can trick a logged in admin to perform the attack by submitting a hidden form.

  Product

  RapidExpCart

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update RapidExpCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• May 10, 2023Yatra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-47436 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Yatra allows Stored XSS.This issue affects Yatra: from n/a through 2.1.14.

  Product

  Yatra

  Affected

  up to 2.1.14

  What to do

  Affects up to 2.1.14. Update Yatra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 10, 2023JetEngine: Includes uploaded files without adequately ensuring that they are not executableCVE-2023-1406 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.

  Product

  JetEngine

  Fixed in

  3.1.3.1

  What to do

  Update JetEngine to 3.1.3.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 23, 2023Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous TypeCVE-2023-23707 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.

  Product

  Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 20, 2023Paid Memberships Pro: Does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL queryCVE-2023-0631 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.

  Product

  Paid Memberships Pro

  Fixed in

  2.9.12

  What to do

  Update Paid Memberships Pro to 2.9.12 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 20, 2023Slimstat Analytics: Does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL queryCVE-2023-0630 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.

  Product

  Slimstat Analytics

  Fixed in

  4.9.3.3

  What to do

  Update Slimstat Analytics to 4.9.3.3 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 16, 2023Forminator: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2021-36821 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.

  Product

  Forminator

  Affected

  up to 1.14.11

  What to do

  Affects up to 1.14.11. Update Forminator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 15, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin CVE-2022-34148 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.

  Affected

  up to 1.6.9.0

  What to do

  Affects up to 1.6.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 14, 2023Paul C: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-47171 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin <= 1.1 versions.

  Product

  Paul C

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update Paul C to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 6, 2023Scriptless Social Sharing: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0377 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

  Product

  Scriptless Social Sharing

  Fixed in

  3.2.2

  What to do

  Update Scriptless Social Sharing to 3.2.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 30, 2023Social Sharing Toolkit: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4835 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

  Product

  Social Sharing Toolkit

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update Social Sharing Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 16, 2023Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4451 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

  Product

  Social Sharing

  Fixed in

  3.3.45

  What to do

  Update Social Sharing to 3.3.45 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 2, 2023WP Social Sharing: Does not sanitise and escape some of its settingsCVE-2022-4198 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

  Product

  WP Social Sharing

  Affected

  up to 2.2

  What to do

  Affects up to 2.2. Update WP Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecurity.gentoo.orgwpscan.com

• Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-loginCVE-2022-4158 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.

  Product

  Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro

  Fixed in

  19.1.5.1

  What to do

  Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.

  Full record and what to do →NVD recordbulletin.iese.dewpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.