Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

984 results · page 12 of 20

Nov 22, 2023LifterLMS – WordPress LMS Plugin for eLearning: Directory TraversalCVE-2023-6160 · WordPress plugins & themes · reported by WordfenceLow 3.3
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. This makes it possible for authenticated attackers, with administrator or LMS manager access and above, to read the contents of arbitrary CSV files on the server, which can contain sensitive information as well as removing those files from the server.
Product
LifterLMS – WordPress LMS Plugin for eLearning
Affected
up to 7.4.2
What to do
Affects up to 7.4.2. Update LifterLMS – WordPress LMS Plugin for eLearning to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023HTML filter and csv-file search: Stored Cross-Site ScriptingCVE-2023-5096 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HTML filter and csv-file search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'csvsearch' shortcode in versions up to, and including, 2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HTML filter and csv-file search
Affected
up to 2.7
What to do
Affects up to 2.7. Update HTML filter and csv-file search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.CVE-2023-28749 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.CVE-2023-32592 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023The School Management – Education & Learning Management: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-47430 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar The School Management – Education & Learning Management allows SQL Injection.This issue affects The School Management – Education & Learning Management: from n/a through 4.1.
Product
The School Management – Education & Learning Management
Affected
up to 4.1
What to do
Affects up to 4.1. Update The School Management – Education & Learning Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023LearnDash LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28777 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue affects LearnDash LMS: from n/a through 4.5.3.
Product
LearnDash LMS
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023HTML filter and csv-file search: Local File InclusionCVE-2023-5099 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of the 'csvsearch' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
HTML filter and csv-file search
Affected
up to 2.7
What to do
Affects up to 2.7. Update HTML filter and csv-file search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 27, 2023VK Filter Search: Stored Cross-Site ScriptingCVE-2023-5705 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
VK Filter Search
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update VK Filter Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Missing AuthorizationCVE-2023-4941 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_swap function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4926 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulk_delete_products function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Missing AuthorizationCVE-2023-4924 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to missing capability checks on the woobe_bulkoperations_delete function. This makes it possible for authenticated attackers, with subscriber access or higher, to delete products.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4923 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_delete function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Missing AuthorizationCVE-2023-4943 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4942 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_visibility function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4940 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4937 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_apply_default_combination function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4935 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the create_profile function. This makes it possible for unauthenticated attackers to create profiles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4920 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, input sanitization and escaping is insufficient resulting in the possibility of malicious script injection.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2023BEAR: Missing AuthorizationCVE-2023-4938 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of useCVE-2023-5561 · WordPress plugins & themes · reported by WPScanMedium 5.3
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lists.debian.org wpscan.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Codex-m Sort SearchResult By Title plugin <= 10.0 versions.CVE-2023-45639 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Codex-m Sort SearchResult By Title plugin <= 10.0 versions.
Affected
up to 10.0
What to do
Affects up to 10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <= 1.10.0 versions.CVE-2023-40607 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <= 1.10.0 versions.
Affected
up to 1.11.0
What to do
Affects up to 1.11.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 25, 2023Locatoraid Store Locator: Does not sanitise and escape the lpr-search parameter before outputting it back in the pageCVE-2023-4476 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Locatoraid Store Locator
Fixed in
3.9.24
What to do
Update Locatoraid Store Locator to 3.9.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2023Yellow Yard Searchbar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1110 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Yellow Yard Searchbar
Fixed in
2.8.12
What to do
Update Yellow Yard Searchbar to 2.8.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 24, 2023User Activity Log: Does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pagesCVE-2023-2761 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
Product
User Activity Log
Fixed in
1.6.3
What to do
Update User Activity Log to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 20, 2023TS Webfonts for SAKURA 3.1.2 and earlier: Cross-site request forgery (CSRF)CVE-2023-32625 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site request forgery (CSRF) vulnerability in TS Webfonts for SAKURA 3.1.2 and earlier allows a remote unauthenticated attacker to hijack the authentication of a user and to change settings by having a user view a malicious page.
Product
TS Webfonts for SAKURA 3.1.2 and earlier
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update TS Webfonts for SAKURA 3.1.2 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ja.wordpress.org jvn.jp
Jul 20, 2023TS Webfonts for SAKURA 3.1.0 and earlier: Cross-site scriptingCVE-2023-32624 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in TS Webfonts for SAKURA 3.1.0 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
Product
TS Webfonts for SAKURA 3.1.0 and earlier
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update TS Webfonts for SAKURA 3.1.0 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ja.wordpress.org jvn.jp
Jul 12, 2023LearnDash LMS: Insecure Direct Object ReferencesCVE-2023-3105 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for attackers with with existing account access at any level, to change user passwords and potentially take over administrator accounts.
Product
LearnDash LMS
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record learndash.com wordfence.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Danny Hearnah - ChubbyNinjaa Template Debugger plugin <= 3.1.2 versions.CVE-2023-35773 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Danny Hearnah - ChubbyNinjaa Template Debugger plugin <= 3.1.2 versions.
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 1, 2023Better Search: Cross-Site Request ForgeryCVE-2021-4400 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This is due to missing or incorrect nonce validation on the bsearch_process_settings_import() and bsearch_process_settings_export() functions. This makes it possible for unauthenticated attackers to import and export settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Better Search
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 9, 2023Advanced Woo Search: Stored Cross-Site ScriptingCVE-2023-2452 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.77 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Advanced Woo Search
Affected
up to 2.77
What to do
Affects up to 2.77. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023FiboSearch - AJAX Search for WooCommerce: Stored Cross-Site ScriptingCVE-2023-2450 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.23.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
FiboSearch - AJAX Search for WooCommerce
Affected
up to 1.23.0
What to do
Affects up to 1.23.0. Update FiboSearch - AJAX Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2023Better Search: Cross-Site Request ForgeryCVE-2021-4373 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to import settings via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Better Search
Affected
up to 2.5.2
What to do
Affects up to 2.5.2. Update Better Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023JobSearch WP Job Board: Authorization bypassCVE-2021-4364 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedule_call() function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls.
Product
JobSearch WP Job Board
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023JobSearch WP Job Board: Authorization bypassCVE-2021-4361 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on the site.
Product
JobSearch WP Job Board
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023JobSearch WP Job Board: Authorization bypassCVE-2021-4352 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in versions up to, and including, 1.8.1. This makes it possible for unauthenticated attackers to change the settings of the plugin.
Product
JobSearch WP Job Board
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update JobSearch WP Job Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions.CVE-2023-33314 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions.
Fixed in
1.1.3.2
What to do
Update the plugin to 1.1.3.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions.CVE-2023-23714 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions.
Affected
up to 3.6.4.1
What to do
Affects up to 3.6.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions.CVE-2022-41987 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions.
Affected
up to 3.7.1.6
What to do
Affects up to 3.7.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.CVE-2022-38356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 24, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.CVE-2022-47447 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Nicearma DNUI plugin <= 2.8.1 versions.CVE-2022-47609 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in Nicearma DNUI plugin <= 2.8.1 versions.
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2023Ajax Search Pro: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-1435 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ajax Search Pro
Fixed in
4.26.2
What to do
Update Ajax Search Pro to 4.26.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro: Does not sanitise and escape a parameter before outputting it back in a response of an AJAX actionCVE-2023-1420 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro
Fixed in
4.11.1
What to do
Update Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro to 4.11.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 22, 2023The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_rCVE-2023-28660 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action.
Affected
up to 2.3.14
What to do
Affects up to 2.3.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 15, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin <= 4.10.3 versions.CVE-2022-38456 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin <= 4.10.3 versions.
Affected
up to 4.10.3
What to do
Affects up to 4.10.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 8, 2023Yellow Yard Searchbar: Does not escape some URL parameters before outputting them back to the userCVE-2022-2094 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross-Site Scripting
Product
Yellow Yard Searchbar
Fixed in
2.8.2
What to do
Update Yellow Yard Searchbar to 2.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023WP Extended Search: Does not validate and escape one of its shortcode attributesCVE-2022-4649 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
WP Extended Search
Fixed in
2.1.2
What to do
Update WP Extended Search to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 26, 2023Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.CVE-2022-47615 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
Affected
up to 4.1.7.3.2
What to do
Affects up to 4.1.7.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 26, 2023SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.CVE-2022-45820 · WordPress plugins & themes · reported by PatchstackCritical 9.1
SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
Affected
up to 4.1.7.3.2
What to do
Affects up to 4.1.7.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.