Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,116 results · page 12 of 23
Oct 31, 2023Royal Elementor Addons and Templates: Does not properly validate uploaded filesCVE-2023-5360 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.
- Product
- Royal Elementor Addons and Templates
- Fixed in
- 1.3.79
- What to do
- Update Royal Elementor Addons and Templates to 1.3.79 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Oct 31, 2023Memberlite Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-5237 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Memberlite Shortcodes
- Fixed in
- 1.3.9
- What to do
- Update Memberlite Shortcodes to 1.3.9 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Oct 26, 2023Assistant: Does not validate a parameter before making a request to it via wp_remote_get()CVE-2023-5798 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wp_remote_get(), which could allow users with a role as low as Editor to perform SSRF attacks
- Product
- Assistant
- Fixed in
- 1.4.4
- What to do
- Update Assistant to 1.4.4 or newer.
Oct 16, 2023File Manager Pro: Does not adequately validate and escape some inputsCVE-2023-4862 · WordPress plugins & themes · reported by WPScanMedium 4.8
The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
- Product
- File Manager Pro
- Fixed in
- 1.8.1
- What to do
- Update File Manager Pro to 1.8.1 or newer.
Oct 16, 2023Testimonial Slider Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-4795 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Testimonial Slider Shortcode
- Fixed in
- 1.1.9
- What to do
- Update Testimonial Slider Shortcode to 1.1.9 or newer.
Oct 16, 2023Magee Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4783 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Magee Shortcodes
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Magee Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2023Form Maker by 10Web: Does not validate signaturesCVE-2023-4666 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.20
- What to do
- Update Form Maker by 10Web to 1.15.20 or newer.
Oct 16, 2023Simple Posts Ticker: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4646 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Simple Posts Ticker
- Fixed in
- 1.1.6
- What to do
- Update Simple Posts Ticker to 1.1.6 or newer.
Oct 16, 2023WP Matterport Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4289 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.8
- What to do
- Update WP Matterport Shortcode to 2.1.8 or newer.
Oct 16, 2023WordPress Gallery: Does not validate some block attributes before using them to generate paths passed to include function/sCVE-2023-3279 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
- Product
- WordPress Gallery
- Fixed in
- 3.39
- What to do
- Update WordPress Gallery to 3.39 or newer.
Oct 16, 2023WordPress Gallery: Is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` functionCVE-2023-3155 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
- Product
- WordPress Gallery
- Fixed in
- 3.39
- What to do
- Update WordPress Gallery to 3.39 or newer.
Oct 16, 2023WordPress Gallery: Is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` functionCVE-2023-3154 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WordPress Gallery Plugin WordPress plugin before 3.39 is vulnerable to PHAR Deserialization due to a lack of input parameter validation in the `gallery_edit` function, allowing an attacker to access arbitrary resources on the server.
- Product
- WordPress Gallery
- Fixed in
- 3.39
- What to do
- Update WordPress Gallery to 3.39 or newer.
Sep 25, 2023Prevent files / folders access: Does not validate files to be uploadedCVE-2023-4238 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.
- Product
- Prevent files / folders access
- Fixed in
- 2.5.2
- What to do
- Update Prevent files / folders access to 2.5.2 or newer.
Sep 19, 2023Serial Codes Generator and Validator with WooCommerce Support: Does not sanitise and escape some of its settingsCVE-2023-4376 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Serial Codes Generator and Validator with WooCommerce Support
- Fixed in
- 2.4.15
- What to do
- Update Serial Codes Generator and Validator with WooCommerce Support to 2.4.15 or newer.
Sep 11, 2023wpDataTables: Does not validate the "Serialized PHP array" input data before deserializing the dataCVE-2023-4314 · WordPress plugins & themes · reported by WPScanHigh 7.2
The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.
- Product
- wpDataTables
- Fixed in
- 2.1.66
- What to do
- Update wpDataTables to 2.1.66 or newer.
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settingsCVE-2023-3170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- tagDiv Composer
- Fixed in
- 4.2
- What to do
- Update tagDiv Composer to 4.2 or newer.
Sep 4, 2023Orders Tracking for WooCommerce: Doesn't validate the file_url parameterCVE-2023-4216 · WordPress plugins & themes · reported by WPScanLow 2.7
The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowing high privilege users with the manage_woocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file.
- Product
- Orders Tracking for WooCommerce
- Fixed in
- 1.2.6
- What to do
- Update Orders Tracking for WooCommerce to 1.2.6 or newer.
Aug 30, 2023Simple Blog Card: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4035 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Simple Blog Card
- Fixed in
- 1.31
- What to do
- Update Simple Blog Card to 1.31 or newer.
Aug 16, 2023Booking Manager: Does not validate URLs input in it's admin panel or in shortcodes for showing events from a remoteCVE-2023-1977 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
- Product
- Booking Manager
- Fixed in
- 2.0.29
- What to do
- Update Booking Manager to 2.0.29 or newer.
Aug 16, 2023Yellow Yard Searchbar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1110 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Yellow Yard Searchbar
- Fixed in
- 2.8.12
- What to do
- Update Yellow Yard Searchbar to 2.8.12 or newer.
Aug 16, 2023YARPP: Does not validate and escape some of its shortcode attributes before using them in SQL statement/sCVE-2023-0579 · WordPress plugins & themes · reported by WPScanHigh 8.8
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks.
- Product
- YARPP
- Fixed in
- 5.30.3
- What to do
- Update YARPP to 5.30.3 or newer.
Aug 16, 2023URL Params: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0274 · WordPress plugins & themes · reported by WPScanMedium 5.4
The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- URL Params
- Fixed in
- 2.5
- What to do
- Update URL Params to 2.5 or newer.
Aug 16, 2023ClickFunnels: Does not validate and escape one of its shortcode attributesCVE-2022-4782 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- ClickFunnels
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update ClickFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023EventON: Does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid EventCVE-2023-3219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
- Product
- EventON
- Fixed in
- 2.1.2
- What to do
- Update EventON to 2.1.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 10, 2023Simple Iframe: Does not properly validate one of its WordPress block attribute's contentCVE-2023-2964 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks.
- Product
- Simple Iframe
- Fixed in
- 1.2.0
- What to do
- Update Simple Iframe to 1.2.0 or newer.
Jul 4, 2023ND Shortcodes: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2023-1273 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
- Product
- ND Shortcodes
- Fixed in
- 7.0
- What to do
- Update ND Shortcodes to 7.0 or newer.
Jul 4, 2023ND Shortcodes: Does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4623 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- ND Shortcodes
- Fixed in
- 7.0
- What to do
- Update ND Shortcodes to 7.0 or newer.
Jun 27, 2023Jetpack: Does not validate uploaded filesCVE-2023-2996 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
- Product
- Jetpack
- Fixed in
- 12.1.1
- What to do
- Update Jetpack to 12.1.1 or newer.
Jun 27, 2023Formidable Forms: Does not adequately authorize the user or validate the plugin URL in its functionality for installing add-onsCVE-2023-2877 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
- Product
- Formidable Forms
- Fixed in
- 6.3.1
- What to do
- Update Formidable Forms to 6.3.1 or newer.
Jun 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide CrossCVE-2023-32960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).
- Affected
- up to 1.23.3
- What to do
- Affects up to 1.23.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 19, 2023Google Map Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-2899 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Google Map Shortcode
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Google Map Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023Upload Resume: Does not validate the captcha parameterCVE-2023-2751 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the resume_upload_form shortcode, allowing unauthenticated visitors to upload arbitrary media files to the site.
- Product
- Upload Resume
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Upload Resume to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023SlideOnline: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0489 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- SlideOnline
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update SlideOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023Responsive Tabs For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0368 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2023File Away: Does not validate and escape one of its shortcode attributesCVE-2023-0431 · WordPress plugins & themes · reported by WPScanMedium 5.4
The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- File Away
- Affected
- up to 3.9.9.0.1
- What to do
- Affects up to 3.9.9.0.1. Update File Away to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 6, 2023uListing: Authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validatedCVE-2021-4370 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to conduct numerous administrative actions, including those less critical than the explicitly outlined ones in our detection.
- Product
- uListing
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 5, 2023WP Multi Store Locator: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0152 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Multi Store Locator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update WP Multi Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023Frontend Post: Does not validate an attribute of one of its shortcodeCVE-2022-4946 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role as low as contributor to add a malicious shortcode to a page/post, which will redirect users to an arbitrary domain.
- Product
- Frontend Post
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update Frontend Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Download Manager: Does not adequately validate passwords for password-protected filesCVE-2023-1524 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's password.
- Product
- Download Manager
- Fixed in
- 3.2.71
- What to do
- Update Download Manager to 3.2.71 or newer.
May 30, 2023OSM: Does not validate and escape some of its shortcode attributesCVE-2022-4676 · WordPress plugins & themes · reported by WPScanMedium 5.4
The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- OSM
- Affected
- up to 6.01
- What to do
- Affects up to 6.01. Update OSM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in Manoj Thulasidas Theme Tweaker plugin <= 5.20 versions.CVE-2023-23713 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Manoj Thulasidas Theme Tweaker plugin <= 5.20 versions.
- Affected
- up to 5.20
- What to do
- Affects up to 5.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 15, 2023KIWIZ Invoices Certification & PDF System: Does not validate the path of files to be downloadedCVE-2023-2180 · WordPress plugins & themes · reported by WPScanHigh 7.5
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization (assuming they can upload a file on the server)
- Product
- KIWIZ Invoices Certification & PDF System
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update KIWIZ Invoices Certification & PDF System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023f(x) TOC: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0490 · WordPress plugins & themes · reported by WPScanMedium 5.4
The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- f(x) TOC
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update f(x) TOC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023ActiveCampaign: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0233 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- ActiveCampaign
- Fixed in
- 8.1.12
- What to do
- Update ActiveCampaign to 8.1.12 or newer.
May 15, 2023Bit Form: Does not validate the file types uploaded via it's file upload form fieldCVE-2022-4774 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.
- Product
- Bit Form
- Fixed in
- 1.9
- What to do
- Update Bit Form to 1.9 or newer.
May 8, 2023Avirato hotels online booking engine: Does not validate and escape some of its shortcode attributes before using them in SQL statement/sCVE-2023-0768 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
- Product
- Avirato hotels online booking engine
- Affected
- up to 5.0.5
- What to do
- Affects up to 5.0.5. Update Avirato hotels online booking engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Custom Post Type List Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0542 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Custom Post Type List Shortcode
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Custom Post Type List Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Product Slider For WooCommerce Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0537 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Product Slider For WooCommerce Lite
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Product Slider For WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Wp-D3: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wp-D3 WordPress plugin through 2.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Wp-D3
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Wp-D3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Post Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0526 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Post Shortcode
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.