Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

485new WordPress flaws this week

392,772entries in the database

6,587 results · page 126 of 132

Mar 13, 202310Web Map Builder for Google Maps: Does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated usersCVE-2023-0037 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
10Web Map Builder for Google Maps
Fixed in
1.0.73
What to do
Update 10Web Map Builder for Google Maps to 1.0.73 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.CVE-2022-47612 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.
Fixed in
2.4.6
What to do
Update the plugin to 2.4.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 19, 2023A vulnerability was found in madgicweb BuddyStream Plugin up to 3.2.7 on WordPress.CVE-2012-10007 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in madgicweb BuddyStream Plugin up to 3.2.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file ShareBox.php. The manipulation of the argument content/link/shares leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.8 is able to address this issue. The patch is named 7d5b9a89a27711aad76fd55ab4cc4185b545a1d0. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221479.
Product
madgicweb BuddyStream
Affected
up to 3.2.7
What to do
Affects up to 3.2.7. Update madgicweb BuddyStream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 8, 2023Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions.CVE-2022-41620 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SeoSamba for WordPress Webmasters plugin <= 1.0.5 versions.
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 23, 202310WebMapBuilder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4758 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
10WebMapBuilder
Fixed in
1.0.72
What to do
Update 10WebMapBuilder to 1.0.72 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 5, 2023A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress.CVE-2015-10013 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
Product
WebDevStudios taxonomy-switcher
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update WebDevStudios taxonomy-switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
Product
Web Invoice
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4371 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
Product
Web Invoice
Affected
up to 2.1.3
What to do
Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Sliderby10Web: Does not sanitise and escape some of its settingsCVE-2022-4197 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Sliderby10Web
Fixed in
1.2.53
What to do
Update Sliderby10Web to 1.2.53 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Photo Gallery by 10Web: Does not validate and escape some parameters before outputting them back in in JS code later on in another pageCVE-2022-4058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.
Product
Photo Gallery by 10Web
Fixed in
1.8.3
What to do
Update Photo Gallery by 10Web to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2022The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data.CVE-2021-31693 · WordPress plugins & themes · reported by MITREMedium 6.1
The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware information, previously connected to this CVE ID because of a typo, is at CVE-2022-31693.
Product
10Web Photo Gallery
Affected
up to 1.5.68
What to do
Affects up to 1.5.68. Update 10Web Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Nov 18, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.CVE-2022-38075 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
Affected
up to 0.13
What to do
Affects up to 0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 14, 2022Webmaster Tools Verification: Does not have authorisation and CSRF checksCVE-2022-3538 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
Product
Webmaster Tools Verification
Affected
up to 1.2
What to do
Affects up to 1.2. Update Webmaster Tools Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 28, 2022Web Stories: Server-Side Request ForgeryCVE-2022-3708 · WordPress plugins & themes · reported by WordfenceCritical 9.6
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Web Stories
Affected
up to 1.24.0
What to do
Affects up to 1.24.0. Update Web Stories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Oct 25, 2022Post to CSV by BestWebSoft: Does not properly escape fieldsCVE-2022-3393 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection
Product
Post to CSV by BestWebSoft
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Post to CSV by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2022Form Maker by 10Web: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3300 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Form Maker by 10Web
Fixed in
1.15.6
What to do
Update Form Maker by 10Web to 1.15.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 19, 2022Site Offline Or Coming Soon Or Maintenance Mode: Prevents users from accessing a website but does not do so if the URL contained certain keywordsCVE-2022-1580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
Product
Site Offline Or Coming Soon Or Maintenance Mode
Fixed in
1.5.3
What to do
Update Site Offline Or Coming Soon Or Maintenance Mode to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 6, 2022Visual Composer Website Builder: Stored Cross-Site ScriptingCVE-2022-2516 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visual Composer Website Builder
Affected
up to 45.0
What to do
Affects up to 45.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 6, 2022Visual Composer Website Builder: Stored Cross-Site ScriptingCVE-2022-2430 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visual Composer Website Builder
Affected
up to 45.0
What to do
Affects up to 45.0. Update Visual Composer Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 23, 2022Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.CVE-2022-36285 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 23, 2022Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.CVE-2022-34648 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 22, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.CVE-2021-36847 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.
Affected
up to 4.2.21
What to do
Affects up to 4.2.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 8, 2022WSM Downloader: Allows only specific popular websites to download images/files fromCVE-2022-2367 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WSM Downloader WordPress plugin through 1.4.0 allows only specific popular websites to download images/files from, this can be bypassed due to the lack of good "link" parameter validation
Product
WSM Downloader
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update WSM Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
Product
Website File Changes Monitor
Fixed in
1.8.3
What to do
Update Website File Changes Monitor to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPCVE-2022-36343 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 1, 2022Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.CVE-2022-34154 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 7, 2022In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application.CVE-2015-1785 · WordPress plugins & themes · reported by Red HatMedium 6.5
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Fixed in
2.0.77.3
What to do
Update the plugin to 2.0.77.3 or newer.
Full record and what to do →NVD record blog.nettitude.com wpscan.com
Jul 7, 2022In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application.CVE-2015-1784 · WordPress plugins & themes · reported by Red HatHigh 8.8
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Fixed in
2.0.77.3
What to do
Update the plugin to 2.0.77.3 or newer.
Full record and what to do →NVD record blog.nettitude.com wpscan.com
Jun 20, 2022Rating by BestWebSoft: Does not validate the submitted ratingCVE-2021-25121 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating
Product
Rating by BestWebSoft
Fixed in
1.6
What to do
Update Rating by BestWebSoft to 1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team Manager plugin <= 1CVE-2022-29406 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team Manager plugin <= 1.6.9 at WordPress.
Affected
up to 1.6.9
What to do
Affects up to 1.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 13, 2022DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.CVE-2022-29455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.
Affected
up to 3.5.5
What to do
Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com rotem-bar.com
Jun 13, 2022Webriti SMTP Mail: Does not have CSRF check in placeCVE-2022-1612 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Product
Webriti SMTP Mail
Affected
up to 1.0
What to do
Affects up to 1.0. Update Webriti SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022Five Minute Webshop: Does not sanitise and escape the id parameter before using it in a SQL statementCVE-2022-1686 · WordPress plugins & themes · reported by WPScanLow 2.7
The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection
Product
Five Minute Webshop
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jun 8, 2022Five Minute Webshop: Does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin pageCVE-2022-1685 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
Product
Five Minute Webshop
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jun 8, 2022Photo Gallery by 10Web: Does not properly validate and escape some of its settingsCVE-2022-1394 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
Product
Photo Gallery by 10Web
Fixed in
1.6.4
What to do
Update Photo Gallery by 10Web to 1.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022Form Maker by 10Web: Does not sanitize and escape the Custom Text settingsCVE-2022-1564 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Form Maker by 10Web
Fixed in
1.14.12
What to do
Update Form Maker by 10Web to 1.14.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Sliderby10Web: Does not properly sanitize and escape some of its settingsCVE-2022-1320 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Sliderby10Web
Fixed in
1.2.52
What to do
Update Sliderby10Web to 1.2.52 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
Product
Nirweb support
Fixed in
2.8.2
What to do
Update Nirweb support to 2.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 6, 2022Countdown & Clock (WordPress plugin): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2022-29420 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Adam Skaat Countdown & Clock (WordPress plugin) countdown-builder allows Stored XSS.This issue affects Countdown & Clock (WordPress plugin): from n/a through 2.3.2.
Product
Countdown & Clock (WordPress plugin)
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update Countdown & Clock (WordPress plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2022Photo Gallery by 10Web: Does not properly sanitize the $_GET['image_url'] variableCVE-2022-1282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.
Product
Photo Gallery by 10Web
Fixed in
1.6.3
What to do
Update Photo Gallery by 10Web to 1.6.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 25, 2022Web To Print Shop : uDraw: Does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function CVE-2022-0656 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
Product
Web To Print Shop : uDraw
Fixed in
3.3.3
What to do
Update Web To Print Shop : uDraw to 3.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 19, 2022Elementor Website Builder: Unauthorized execution of several AJAX actionsCVE-2022-1329 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2.
Product
Elementor Website Builder
Affected
3.6.0 to 3.6.2
What to do
Affects 3.6.0 to 3.6.2. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Apr 11, 2022Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion.CVE-2022-25615 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion.
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 11, 2022Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings.CVE-2022-25614 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings.
Affected
up to 1.3.7
What to do
Affects up to 1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 4, 2022Web-Settler Testimonial Slider – Free Testimonials Slider: Authenticated (editor or higher user role) Cross-Site Scripting (XSS)CVE-2021-36851 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color.
Product
Web-Settler Testimonial Slider – Free Testimonials Slider
Affected
up to 3.5.8.3
What to do
Affects up to 3.5.8.3. Update Web-Settler Testimonial Slider – Free Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Product
Photo Gallery by 10Web
Fixed in
1.6.0
What to do
Update Photo Gallery by 10Web to 1.6.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server CVE-2021-24689 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contact Forms - Drag & Drop Contact Form Builder WordPress plugin through 1.0.5 allows high privilege users to download arbitrary files from the web server via a path traversal attack
Product
Contact Forms - Drag & Drop Contact Form Builder
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update Contact Forms - Drag & Drop Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised.CVE-2021-24867 · WordPress plugins & themes · reported by WPScanCritical 9.8
Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jetpack.com wpscan.com
Jan 24, 2022WebP Converter for Media: Contains a file (passthruCVE-2021-25074 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue
Product
WebP Converter for Media
Fixed in
4.0.3
What to do
Update WebP Converter for Media to 4.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 10, 202210Web Social Photo Feed: Was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin pageCVE-2021-25047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Photo Feed WordPress plugin before 1.4.29 was affected by a reflected Cross-Site Scripting (XSS) vulnerability in the wdi_apply_changes admin page, allowing an attacker to perform such attack against any logged in users
Product
10Web Social Photo Feed
Fixed in
1.4.29
What to do
Update 10Web Social Photo Feed to 1.4.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.