Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,507 results · page 13 of 31
Aug 14, 2023User Activity Log: Does not correctly sanitise and escape several parameters before using it in a SQL statementCVE-2023-3435 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
- Product
- User Activity Log
- Fixed in
- 1.6.5
- What to do
- Update User Activity Log to 1.6.5 or newer.
Aug 14, 2023Ultimate Addons for Contact Form 7: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2803 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Ultimate Addons for Contact Form 7
- Fixed in
- 3.1.29
- What to do
- Update Ultimate Addons for Contact Form 7 to 3.1.29 or newer.
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not sanitise and escape various parameters before outputting it back in the pageCVE-2023-3671 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- MultiParcels Shipping For WooCommerce
- Fixed in
- 1.15.4
- What to do
- Update MultiParcels Shipping For WooCommerce to 1.15.4 or newer.
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not properly sanitize and escape a parameter before using it in an SQL statementCVE-2023-2843 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
- Product
- MultiParcels Shipping For WooCommerce
- Fixed in
- 1.14.15
- What to do
- Update MultiParcels Shipping For WooCommerce to 1.14.15 or newer.
Jul 31, 2023grid-kit-premium: Does not escape some parametersCVE-2023-3292 · WordPress plugins & themes · reported by WPScanMedium 6.1
The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- grid-kit-premium
- Fixed in
- 2.2.0
- What to do
- Update grid-kit-premium to 2.2.0 or newer.
Jul 31, 2023Forminator: Does not properly escape values that are being reflected inside form fields that use pre-populated query parametersCVE-2023-3134 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
- Product
- Forminator
- Fixed in
- 1.24.4
- What to do
- Update Forminator to 1.24.4 or newer.
Jul 24, 2023User Activity Log: Does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pagesCVE-2023-2761 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- User Activity Log
- Fixed in
- 1.6.3
- What to do
- Update User Activity Log to 1.6.3 or newer.
Jul 24, 2023wpForo Forum: Does not escape some request parameters while in debug modeCVE-2023-2309 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.
- Product
- wpForo Forum
- Fixed in
- 2.1.9
- What to do
- Update wpForo Forum to 2.1.9 or newer.
Jul 17, 2023Membership: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3182 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Membership
- Fixed in
- 3.2.3
- What to do
- Update Membership to 3.2.3 or newer.
Jul 17, 2023AN_GradeBook: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2636 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
- Product
- AN_GradeBook
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2023Login Configurator: Does not properly escape a URL parameter before outputting it to the pageCVE-2023-1893 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
- Product
- Login Configurator
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Login Configurator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 12, 2023Getnet Argentina para Woocommerce: Authorization bypassCVE-2023-3525 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Getnet Argentina para Woocommerce plugin for WordPress is vulnerable to authorization bypass due to missing validation on the 'webhook' function in versions up to, and including, 0.0.4. This makes it possible for unauthenticated attackers to set their payment status to 'APPROVED' without payment.
- Product
- Getnet Argentina para Woocommerce
- Affected
- up to 0.0.4
- What to do
- Affects up to 0.0.4. Update Getnet Argentina para Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comyoutube.com
Jul 10, 2023EventON: Does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid EventCVE-2023-3219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
- Product
- EventON
- Fixed in
- 2.1.2
- What to do
- Update EventON to 2.1.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 10, 2023Export All URLs: Does not sanitise and escape a parameter before outputting them back in the pageCVE-2023-3118 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Export All URLs
- Fixed in
- 4.6
- What to do
- Update Export All URLs to 4.6 or newer.
Jul 10, 2023MStore API: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-3077 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
- Product
- MStore API
- Fixed in
- 3.9.8
- What to do
- Update MStore API to 3.9.8 or newer.
Jul 10, 2023All In One Redirection: Does not properly sanitise and escape multiple parameters before using them in an SQL statementCVE-2023-2493 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- All In One Redirection
- Fixed in
- 2.2.0
- What to do
- Update All In One Redirection to 2.2.0 or newer.
Jul 10, 2023Companion Sitemap Generator: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-1780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Companion Sitemap Generator
- Fixed in
- 4.5.3
- What to do
- Update Companion Sitemap Generator to 4.5.3 or newer.
Jul 4, 2023Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2333 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro
- Affected
- up to 1.2.7
- Fixed in
- 1.2.7
- What to do
- Update Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro to 1.2.7 or newer.
Jul 4, 2023Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro: Does not escape some parameters before outputting them back in attributesCVE-2023-2324 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro WordPress plugin through 1.0.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro
- Affected
- up to 1.0.7
- Fixed in
- 1.0.7
- What to do
- Update Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro to 1.0.7 or newer.
Jul 4, 2023WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro
- Affected
- up to 3.4.6
- Fixed in
- 3.4.6
- What to do
- Update WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro to 3.4.6 or newer.
Jul 4, 2023CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro
- Affected
- up to 5.0.2
- Fixed in
- 5.0.2
- What to do
- Update CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro to 5.0.2 or newer.
Jun 27, 2023ERP: Does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statementCVE-2023-2744 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- ERP
- Fixed in
- 1.12.4
- What to do
- Update ERP to 1.12.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023ERP: Does not sanitise and escape the employee_name parameter before outputting it back in the pageCVE-2023-2743 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ERP
- Fixed in
- 1.12.4
- What to do
- Update ERP to 1.12.4 or newer.
Jun 27, 2023KiviCare: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2624 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023wpbrutalai: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2605 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
- Product
- wpbrutalai
- Fixed in
- 2.0.1
- What to do
- Update wpbrutalai to 2.0.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023wpbrutalai: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2601 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin via CSRF.
- Product
- wpbrutalai
- Fixed in
- 2.0.0
- What to do
- Update wpbrutalai to 2.0.0 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023FormCraft: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2592 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- FormCraft
- Fixed in
- 3.9.7
- What to do
- Update FormCraft to 3.9.7 or newer.
Jun 27, 2023Responsive CSS EDITOR: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2482 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.
- Product
- Responsive CSS EDITOR
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Responsive CSS EDITOR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2023Catalyst Connect Zoho CRM Client Portal: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2023-0588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
- Product
- Catalyst Connect Zoho CRM Client Portal
- Fixed in
- 2.1.0
- What to do
- Update Catalyst Connect Zoho CRM Client Portal to 2.1.0 or newer.
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statementCVE-2023-2805 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- SupportCandy
- Fixed in
- 3.1.7
- What to do
- Update SupportCandy to 3.1.7 or newer.
Jun 19, 2023Social Share, Social Login and Social Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2779 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.52
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.52 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 19, 2023Upload Resume: Does not validate the captcha parameterCVE-2023-2751 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the resume_upload_form shortcode, allowing unauthenticated visitors to upload arbitrary media files to the site.
- Product
- Upload Resume
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Upload Resume to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statementCVE-2023-2719 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.
- Product
- SupportCandy
- Fixed in
- 3.1.7
- What to do
- Update SupportCandy to 3.1.7 or newer.
Jun 19, 2023Conditional Menus: Does not escape a parameter before outputting it back in an attributeCVE-2023-2654 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Conditional Menus
- Fixed in
- 1.2.1
- What to do
- Update Conditional Menus to 1.2.1 or newer.
Jun 19, 2023Integration for Contact Form 7 and Zoho CRM, Bigin: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2527 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Integration for Contact Form 7 and Zoho CRM, Bigin
- Fixed in
- 1.2.4
- What to do
- Update Integration for Contact Form 7 and Zoho CRM, Bigin to 1.2.4 or newer.
Jun 19, 2023QueryWall: Plug'n Play Firewall: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2492 · WordPress plugins & themes · reported by WPScanHigh 7.2
The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- QueryWall: Plug'n Play Firewall
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update QueryWall: Plug'n Play Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023WP Custom Cursors: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2221 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- WP Custom Cursors
- Fixed in
- 3.2
- What to do
- Update WP Custom Cursors to 3.2 or newer.
Jun 12, 2023Photo Gallery by Ays: Does not escape some parameters before outputting it back in attributesCVE-2023-2568 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Photo Gallery by Ays
- Fixed in
- 5.1.7
- What to do
- Update Photo Gallery by Ays to 5.1.7 or newer.
Jun 12, 2023Icegram Engage: Does not escape a parameter before outputting it back in an attributeCVE-2023-2398 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Icegram Engage
- Fixed in
- 3.1.12
- What to do
- Update Icegram Engage to 3.1.12 or newer.
Jun 12, 2023Easy Forms for Mailchimp: Does not sanitise and escape some of its from parametersCVE-2023-1323 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape some of its from parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.9
- What to do
- Update Easy Forms for Mailchimp to 6.8.9 or newer.
Jun 5, 2023Survey Maker: Does not escape some parameters before outputting them back in attributesCVE-2023-2572 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Survey Maker
- Fixed in
- 3.4.7
- What to do
- Update Survey Maker to 3.4.7 or newer.
Jun 5, 2023Quiz Maker: Does not escape some parameters before outputting them back in attributesCVE-2023-2571 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Quiz Maker
- Fixed in
- 6.4.2.7
- What to do
- Update Quiz Maker to 6.4.2.7 or newer.
Jun 5, 202310Web Social Post Feed: Does not sanitise and escape some parameter before outputting it back in a pageCVE-2023-2503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- 10Web Social Post Feed
- Fixed in
- 1.2.9
- What to do
- Update 10Web Social Post Feed to 1.2.9 or newer.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not sanitise and escape a parameter before outputting it back in the admin dashboardCVE-2023-2472 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.61
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.61 or newer.
Jun 5, 2023ConvertKit: Does not escape a parameter before outputting it back in an attributeCVE-2023-2337 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- ConvertKit
- Fixed in
- 2.2.1
- What to do
- Update ConvertKit to 2.2.1 or newer.
Jun 5, 2023Pricing Table Builder: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0900 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.
- Product
- Pricing Table Builder
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Pricing Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Easy Forms for Mailchimp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2518 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.9
- What to do
- Update Easy Forms for Mailchimp to 6.8.9 or newer.
May 30, 2023Loginizer: Does not escape a parameter before outputting it back in the pageCVE-2023-2296 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Loginizer
- Fixed in
- 1.7.9
- What to do
- Update Loginizer to 1.7.9 or newer.
May 30, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some URL parametersCVE-2023-2256 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.
- Product
- Product Addons & Fields for WooCommerce
- Fixed in
- 32.0.7
- What to do
- Update Product Addons & Fields for WooCommerce to 32.0.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.