Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
726 results · page 13 of 15
Jun 6, 2023WP Quick FrontEnd Editor: Page content injectionCVE-2021-4383 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to edit/create any page or post on the blog.
- Product
- WP Quick FrontEnd Editor
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update WP Quick FrontEnd Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Jun 6, 2023Frontend File Manager: Unauthenticated Content InjectionCVE-2021-4369 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to edit the content and title of every page on the site.
- Product
- Frontend File Manager
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPJoli Joli Table Of Contents plugin <= 1.3.9 versions.CVE-2022-46820 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WPJoli Joli Table Of Contents plugin <= 1.3.9 versions.
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 8, 2023The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password.CVE-2023-1979 · WordPress plugins & themes · reported by cve-coordination@google.comMedium 4.9
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68
- What to do
- Update the plugin to the newest version.
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.CVE-2023-23790 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.
- Fixed in
- 2.9.11
- What to do
- Update the plugin to 2.9.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 17, 2023W4 Post List: Does not ensure that password protected posts can be accessed before displaying their contentCVE-2023-1371 · WordPress plugins & themes · reported by WPScanMedium 6.5
The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content, which could allow any authenticated users to access them
- Product
- W4 Post List
- Fixed in
- 2.4.6
- What to do
- Update W4 Post List to 2.4.6 or newer.
Apr 15, 2023A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress.CVE-2015-10101 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
- Product
- Google Analytics Top Content Widget
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Google Analytics Top Content Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2023All-In-One Security (AIOS): Does not escape the content of log files before outputting it to the plugin admin pageCVE-2023-0157 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.5
- What to do
- Update All-In-One Security (AIOS) to 5.1.5 or newer.
Mar 20, 2023Custom Content Shortcode: Does not validate one of its shortcode attributeCVE-2023-0340 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
- Product
- Custom Content Shortcode
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023Custom Content Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Custom Content Shortcode
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 16, 2023Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User SubmissiCVE-2022-38971 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5 versions.
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin <= 2.6 versionCVE-2022-47163 · WordPress plugins & themes · reported by PatchstackLow 3.1
Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin <= 2.6 versions.
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023FluentSMTP: Does not sanitize or escape email contentCVE-2023-0219 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.
- Product
- FluentSMTP
- Fixed in
- 2.2.3
- What to do
- Update FluentSMTP to 2.2.3 or newer.
Feb 21, 2023Timed Content: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Timed Content
- Fixed in
- 2.73
- What to do
- Update Timed Content to 2.73 or newer.
Feb 13, 2023GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training: Does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary postsCVE-2023-0405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.
- Product
- GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training
- Fixed in
- 1.4.38
- What to do
- Update GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training to 1.4.38 or newer.
Feb 13, 2023Rich Table of Contents: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4551 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rich Table of Contents WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Rich Table of Contents
- Fixed in
- 1.3.9
- What to do
- Update Rich Table of Contents to 1.3.9 or newer.
Feb 2, 2023All-in-One WP Migration: Uses the wrong content typeCVE-2022-2546 · WordPress plugins & themes · reported by WPScanMedium 4.7
The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key
- Product
- All-in-One WP Migration
- Fixed in
- 7.63
- What to do
- Update All-in-One WP Migration to 7.63 or newer.
Jan 30, 2023PrivateContent: Protection mechanism bypassCVE-2023-0581 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it possible for unauthenticated attackers to bypass any login restrictions that may prevent a brute force attack.
- Product
- PrivateContent
- Affected
- up to 8.4.3
- What to do
- Affects up to 8.4.3. Update PrivateContent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2023ContentStudio: Authorization bypassCVE-2023-0558 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys.
- Product
- ContentStudio
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 27, 2023ContentStudio: Sensitive Information ExposureCVE-2023-0557 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
- Product
- ContentStudio
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 27, 2023ContentStudio: Authorization bypassCVE-2023-0556 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.
- Product
- ContentStudio
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2023Structured Content: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4715 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Structured Content
- Fixed in
- 1.5.1
- What to do
- Update Structured Content to 1.5.1 or newer.
Jan 23, 2023Content Control: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.
- Product
- Content Control
- Fixed in
- 1.1.10
- What to do
- Update Content Control to 1.1.10 or newer.
Jan 9, 2023Table of Contents Plus: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4479 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Table of Contents Plus
- Fixed in
- 2212
- What to do
- Update Table of Contents Plus to 2212 or newer.
Jan 9, 2023Starter Templates by Kadence WP: Unserialises the content of an imported fileCVE-2022-3679 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Starter Templates by Kadence WP
- Fixed in
- 1.2.17
- What to do
- Update Starter Templates by Kadence WP to 1.2.17 or newer.
Jan 9, 2023WPtouch: Unserialises the content of an imported settings fileCVE-2022-3417 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.
- Product
- WPtouch
- Fixed in
- 4.3.45
- What to do
- Update WPtouch to 4.3.45 or newer.
Jan 2, 2023Custom Field Template: Unserialises the content of an imported fileCVE-2022-4324 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.
- Product
- Custom Field Template
- Fixed in
- 2.5.8
- What to do
- Update Custom Field Template to 2.5.8 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated usersCVE-2022-4236 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a fileCVE-2022-4140 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Dec 12, 2022Shortcodes and extra features for Phlox: Unserializes the content of an imported fileCVE-2022-3359 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Shortcodes and extra features for Phlox
- Fixed in
- 2.10.7
- What to do
- Update Shortcodes and extra features for Phlox to 2.10.7 or newer.
Nov 3, 2022Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress.CVE-2022-25952 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress.
- Affected
- up to 5.4.0
- What to do
- Affects up to 5.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 31, 2022Customizer Export/Import: Unserializes the content of an imported fileCVE-2022-3380 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Customizer Export/Import
- Fixed in
- 0.9.5
- What to do
- Update Customizer Export/Import to 0.9.5 or newer.
Oct 31, 2022Ocean Extra: Unserialises the content of an imported fileCVE-2022-3374 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.
- Product
- Ocean Extra
- Fixed in
- 2.0.5
- What to do
- Update Ocean Extra to 2.0.5 or newer.
Oct 31, 2022PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro: Unserializes the content of imported filesCVE-2022-3366 · WordPress plugins & themes · reported by WPScanHigh 7.2
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
- Product
- PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro
- Fixed in
- 2.5.2
- What to do
- Update PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro to 2.5.2 or newer.
Oct 31, 2022Smart Slider 3: Unserialises the content of an imported fileCVE-2022-3357 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally or not) a malicious file, and a suitable gadget chain is present on the site.
- Product
- Smart Slider 3
- Fixed in
- 3.5.1.11
- What to do
- Update Smart Slider 3 to 3.5.1.11 or newer.
Oct 31, 2022Easy WP SMTP: Unserialises the content of an imported fileCVE-2022-3334 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Easy WP SMTP
- Fixed in
- 1.5.0
- What to do
- Update Easy WP SMTP to 1.5.0 or newer.
Oct 25, 2022WP All Export Pro: Uses the contents of the cc_sql POST parameter directlyCVE-2022-3395 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been given permission to run exports to execute arbitrary SQL statements, leading to a SQL Injection vulnerability. By default only users with the Administrator role can perform exports, but this can be delegated to lower privileged users as well.
- Product
- WP All Export Pro
- Fixed in
- 1.7.9
- What to do
- Update WP All Export Pro to 1.7.9 or newer.
Oct 25, 2022Kadence WooCommerce Email Designer: Unserialises the content of an imported fileCVE-2022-3335 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Kadence WooCommerce Email Designer
- Fixed in
- 1.5.7
- What to do
- Update Kadence WooCommerce Email Designer to 1.5.7 or newer.
Oct 11, 2022Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at: Unauthenticated Options Change and Content InjectionCVE-2021-36913 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) AccessiBe.
- Product
- Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 26, 2022Ninja Forms Contact Form: Unserialises the content of an imported fileCVE-2022-2903 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.13
- What to do
- Update Ninja Forms Contact Form to 3.6.13 or newer.
Sep 16, 2022Migration, Backup, Staging: Does not sanitise and validate a parameter before using it to read the content of a fileCVE-2022-2863 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.76
- What to do
- Update Migration, Backup, Staging to 0.9.76 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 6, 2022custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.CVE-2015-3173 · WordPress plugins & themes · reported by Red HatHigh 7.2
custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.
- Fixed in
- 0.9.8.6
- What to do
- Update the plugin to 0.9.8.6 or newer.
Full record and what to do →NVD recordblog.nettitude.comgithub.com
Jun 27, 2022Brizy: Does not sanitise and escape some element contentCVE-2022-2041 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- Brizy
- Fixed in
- 2.4.2
- What to do
- Update Brizy to 2.4.2 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
May 30, 2022Content Mask: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2022-1203 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
- Product
- Content Mask
- Fixed in
- 1.8.4.1
- What to do
- Update Content Mask to 1.8.4.1 or newer.
May 2, 2022Content Egg: Does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboardCVE-2022-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Content Egg
- Fixed in
- 5.3.0
- What to do
- Update Content Egg to 5.3.0 or newer.
Apr 25, 2022Web To Print Shop : uDraw: Does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function CVE-2022-0656 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
- Product
- Web To Print Shop : uDraw
- Fixed in
- 3.3.3
- What to do
- Update Web To Print Shop : uDraw to 3.3.3 or newer.
Apr 19, 2022MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6: Cross-site request forgery (CSRF)CVE-2022-27629 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 allows a remote unauthenticated attacker to hijack the authentication of an administrator and perform unintended operation via unspecified vectors.
- Product
- MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6
- Fixed in
- 1.9.6
- What to do
- Update MicroPayments - Paid Author Subscriptions, Content, Downloads, Membership' versions prior to 1.9.6 to 1.9.6 or newer.
Full record and what to do →NVD recordjvn.jpplugins.trac.wordpress.org
Apr 18, 2022sanitisation step of the Safe SVG: Can be bypassed by spoofing the content-type in the POST request to upload a fileCVE-2022-1091 · WordPress plugins & themes · reported by WPScanMedium 6.1
The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).
- Product
- sanitisation step of the Safe SVG
- Fixed in
- 1.9.10
- What to do
- Update sanitisation step of the Safe SVG to 1.9.10 or newer.
Apr 4, 2022The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess fCVE-2022-1166 · WordPress plugins & themes · reported by WPScanMedium 5.3
The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.
- Fixed in
- 4.6.6.1
- What to do
- Update the plugin to 4.6.6.1 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Mar 14, 2022WordPress Multisite Content Copier/Updater: Does not sanitise and escape the s parameter before outputting it back in an attributeCVE-2022-0503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in the network dashboard
- Product
- WordPress Multisite Content Copier/Updater
- Fixed in
- 2.1.2
- What to do
- Update WordPress Multisite Content Copier/Updater to 2.1.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.