Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6,299 results · page 121 of 126
Jun 6, 2023uListing: Authorization bypassCVE-2021-4339 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to retrieve the list of all users and their email address in the database.
- Product
- uListing
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023404 to 301: Authorization bypassCVE-2021-4338 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in versions up to, and including, 3.0.7. This makes it possible for authenticated attackers to view, create and edit redirections.
- Product
- 404 to 301
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update 404 to 301 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023CMP: Authorization bypassCVE-2020-36730 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.
- Product
- CMP
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update CMP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
Jun 6, 20232J-SlideShow: Authorization bypassCVE-2020-36729 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' function called via the wp_ajax_twoj_slideshow_setup AJAX action in versions up to, and including, 1.3.31. This makes it possible for authenticated attackers (Subscriber, or above level access) to allow attackers to perform otherwise restricted actions and subsequently deactivate any plugins on the blog.
- Product
- 2J-SlideShow
- Affected
- up to 1.3.31
- What to do
- Affects up to 1.3.31. Update 2J-SlideShow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023WP Activity Log: Authorization bypassCVE-2020-36716 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.
- Product
- WP Activity Log
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023Login/Signup Popup: Authorization bypassCVE-2020-36715 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arbitrary web scripts into the plugin settings that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Login/Signup Popup
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Login/Signup Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023Page Builder: KingComposer: Authorization bypassCVE-2020-36700 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress options, delete arbitrary files/folders, and inject arbitrary content.
- Product
- Page Builder: KingComposer
- Affected
- up to 2.9.3
- What to do
- Affects up to 2.9.3. Update Page Builder: KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023Quick Page/Post Redirect: Authorization bypassCVE-2020-36699 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax and qppr_delete_quick_redirect functions in versions up to, and including, 5.1.9. This makes it possible for low-privileged attackers to interact with the plugin settings and to create a redirect link that would forward all traffic to an external malicious website.
- Product
- Quick Page/Post Redirect
- Affected
- up to 5.1.9
- What to do
- Affects up to 5.1.9. Update Quick Page/Post Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
Jun 6, 2023WP GDPR: Authorization bypassCVE-2020-36697 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings.
- Product
- WP GDPR
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update WP GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comacunetix.com
Jun 6, 2023Product Input Fields for WooCommerce: Authorization bypassCVE-2020-36696 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.
- Product
- Product Input Fields for WooCommerce
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023Funnel Builder: Authorization bypassCVE-2019-25151 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service.
- Product
- Funnel Builder
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Funnel Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
Jun 6, 2023GDPR Cookie Compliance: Authorization bypassCVE-2019-25143 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_settings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings.
- Product
- GDPR Cookie Compliance
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update GDPR Cookie Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
Jun 6, 2023Easy WP SMTP: Authorization bypassCVE-2019-25141 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.
- Product
- Easy WP SMTP
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Easy WP SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 3, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized modification of dataCVE-2023-2415 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and including, 4.2.10. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to logout a vctia connected account which would cause a denial of service on the appointment scheduler.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.2.10
- What to do
- Affects up to 4.2.10. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jonh.euplugins.trac.wordpress.org
Jun 3, 2023Online Booking & Scheduling Calendar for WordPress by vcita: Unauthorized medication of dataCVE-2023-2299 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.2 due to a missing capability check on the processAction function. This makes it possible for unauthenticated attackers modify the plugin's settings.
- Product
- Online Booking & Scheduling Calendar for WordPress by vcita
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update Online Booking & Scheduling Calendar for WordPress by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jonh.euplugins.trac.wordpress.org
Jun 2, 2023VK Blocks: Improper authorizationCVE-2023-0584 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_font_awesome_version' option to an arbitrary value.
- Product
- VK Blocks
- Affected
- up to 1.57.0.5
- What to do
- Affects up to 1.57.0.5. Update VK Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2023VK Blocks: Improper authorizationCVE-2023-0583 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change plugin settings including default icons.
- Product
- VK Blocks
- Affected
- up to 1.57.0.5
- What to do
- Affects up to 1.57.0.5. Update VK Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2023Page Builder by AZEXO: Unauthorized modification of dataCVE-2023-3053 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and post status.
- Product
- Page Builder by AZEXO
- Affected
- up to 1.27.133
- What to do
- Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 31, 2023Nested Pages: Unauthorized loss of dataCVE-2023-2434 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with editor-level permissions and above, to reset plugin settings.
- Product
- Nested Pages
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Nested Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 30, 2023Wordapp: Authorization bypassCVE-2023-2987 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation.
- Product
- Wordapp
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Wordapp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.reportplugins.trac.wordpress.org
May 30, 2023Feather Login Page: Unauthorized loss of dataCVE-2023-2547 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the temp user generated by the plugin.
- Product
- Feather Login Page
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2023Feather Login Page: Unauthorized access of dataCVE-2023-2545 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to access the login links, which can be used for privilege escalation.
- Product
- Feather Login Page
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Feather Login Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.CVE-2022-46866 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <= 1.1 versions.CVE-2022-46865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <= 1.1 versions.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 23, 2023Go Pricing - WordPress Responsive Pricing Tables: Unauthorized arbitrary file uploadsCVE-2023-2496 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validate_upload' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Go Pricing - WordPress Responsive Pricing Tables
- Affected
- up to 3.3.19
- What to do
- Affects up to 3.3.19. Update Go Pricing - WordPress Responsive Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
May 23, 2023Go Pricing - WordPress Responsive Pricing Tables: Unauthorized modification of dataCVE-2023-2494 · WordPress plugins & themes · reported by WordfenceMedium 4.6
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible for authenticated attackers with a role that the administrator previously granted access to the plugin to modify access to the plugin when it should only be the administrator's privilege.
- Product
- Go Pricing - WordPress Responsive Pricing Tables
- Affected
- up to 3.3.19
- What to do
- Affects up to 3.3.19. Update Go Pricing - WordPress Responsive Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
May 19, 2023Groundhogg: Unauthorized access of data and modification of dataCVE-2023-2716 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload_file' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload a file to the contact, and then lists all the other uploaded files related to the contact.
- Product
- Groundhogg
- Affected
- up to 2.7.9.8
- What to do
- Affects up to 2.7.9.8. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2023Groundhogg: Unauthorized modification of dataCVE-2023-2715 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers to create a support ticket that sends the website's data to the plugin developer, and it is also possible to create an admin access with an auto login link that is also sent to the plugin developer with the ticket. It only works if the plugin is activated with a valid license.
- Product
- Groundhogg
- Affected
- up to 2.7.9.8
- What to do
- Affects up to 2.7.9.8. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2023Groundhogg: Unauthorized modification of dataCVE-2023-2714 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the license key and support license key, but it can only be changed to a valid license key.
- Product
- Groundhogg
- Affected
- up to 2.7.9.8
- What to do
- Affects up to 2.7.9.8. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 17, 2023Waiting: One-click countdowns: Authorization bypassCVE-2023-2757 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' functions in versions up to, and including, 0.6.2. This could lead to Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for subscriber-level attackers to access functions to save plugin data that can potentially lead to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Waiting: One-click countdowns
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update Waiting: One-click countdowns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 15, 2023WooCommerce Order Status Change Notifier: Does not have authorisation and CSRFCVE-2023-2179 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
- Product
- WooCommerce Order Status Change Notifier
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WooCommerce Order Status Change Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Active Directory Integration / LDAP Integration: Does not have proper authorization or nonce values for some POST requestsCVE-2023-0812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.
- Product
- Active Directory Integration / LDAP Integration
- Fixed in
- 4.1.1
- What to do
- Update Active Directory Integration / LDAP Integration to 4.1.1 or newer.
May 9, 2023Sk: Auth. (author+) Stored Cross-Site Scripting (XSS)CVE-2023-23647 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Team Member – Team with Slider plugin <= 4.4 versions.
- Product
- Sk
- Affected
- up to 4.4
- What to do
- Affects up to 4.4. Update Sk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 8, 2023AI ChatBot: Does not have authorisation and CSRF in a function hooked to initCVE-2023-1660 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard
- Product
- AI ChatBot
- Fixed in
- 4.4.9
- What to do
- Update AI ChatBot to 4.4.9 or newer.
May 8, 2023AI ChatBot: Does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settingsCVE-2023-1651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS
- Product
- AI ChatBot
- Fixed in
- 4.4.9
- What to do
- Update AI ChatBot to 4.4.9 or newer.
May 2, 2023WP Custom Author URL: Does not sanitise and escape some of its settingsCVE-2023-1614 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Custom Author URL
- Fixed in
- 1.0.5
- What to do
- Update WP Custom Author URL to 1.0.5 or newer.
Apr 26, 2023Profile Builder – User Profile & User Registration Forms: Unauthorized password resetsCVE-2023-2297 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Apr 24, 2023WP VR: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2023-1414 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow any authenticated users, such as subscriber to update arbitrary tours
- Product
- WP VR
- Fixed in
- 8.3.0
- What to do
- Update WP VR to 8.3.0 or newer.
Apr 17, 2023Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updCVE-2023-0889 · WordPress plugins & themes · reported by WPScanMedium 6.5
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
- Fixed in
- 2.0.1
- What to do
- Update the plugin to 2.0.1 or newer.
Apr 6, 2023WP Fastest Cache: Unauthorized data lossCVE-2023-1931 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the deleteCssAndJsCacheToolbar function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers with subscriber-level access to perform cache deletion.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 6, 2023WP Fastest Cache: Unauthorized data deletionCVE-2023-1930 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the wpfc_clear_cache_of_allsites_callback function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers with subscriber-level access to delete caches.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 6, 2023WP Fastest Cache: Unauthorized data modificationCVE-2023-1929 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_purgecache_varnish_callback function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers with subscriber-level access to purge the varnish cache.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 6, 2023WP Fastest Cache: Unauthorized data modificationCVE-2023-1928 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_preload_single_callback function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers with subscriber-level access to initiate cache creation.
- Product
- WP Fastest Cache
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 5, 2023WCFM Membership: Unauthorized modification and access of dataCVE-2022-4940 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more.
- Product
- WCFM Membership
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 5, 2023WCFM Frontend Manager: Unauthorized modification and access of dataCVE-2022-4937 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying knowledge bases, modifying notices, modifying payments, managing vendors, capabilities, and so much more. There were hundreds of AJAX endpoints affected.
- Product
- WCFM Frontend Manager
- Affected
- up to 6.6.0
- What to do
- Affects up to 6.6.0. Update WCFM Frontend Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 5, 2023WCFM Marketplace: Unauthorized modification and access of dataCVE-2022-4935 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying shipping method details, modifying products, deleting arbitrary posts, and privilege escalation (via the wp_ajax_wcfm_vendor_store_online AJAX action).
- Product
- WCFM Marketplace
- Affected
- up to 3.4.11
- What to do
- Affects up to 3.4.11. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 5, 2023YourChannel: Unauthorized loss of dataCVE-2023-1868 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_clear_cache GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to clear the plugin's cache.
- Product
- YourChannel
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 5, 2023YourChannel: Unauthorized loss of dataCVE-2023-1865 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin settings via the yrc_nuke GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to delete YouTube channels from the plugin.
- Product
- YourChannel
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2023ProfileGrid: Provides an AJAX endpoint for resetting a user password but does not implement proper authorizationCVE-2023-0940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
- Product
- ProfileGrid
- Fixed in
- 5.3.1
- What to do
- Update ProfileGrid to 5.3.1 or newer.
Mar 20, 2023WP Meta SEO: Does not authorize several ajax actionsCVE-2023-0876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability.
- Product
- WP Meta SEO
- Fixed in
- 4.5.3
- What to do
- Update WP Meta SEO to 4.5.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.