Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
797 results · page 14 of 16
Feb 28, 2024Happy Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-0438 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age Gate in all versions up to, and including, 3.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-29108 is likely a duplicate of this issue.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.10.1
- What to do
- Affects up to 3.10.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 27, 2024Shariff Wrapper: Does not sanitise and escape some of its settingsCVE-2024-1106 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Shariff Wrapper
- Fixed in
- 4.6.10
- What to do
- Update Shariff Wrapper to 4.6.10 or newer.
Feb 12, 2024MapPress Maps for: Is affected by an IDORCVE-2024-0421 · WordPress plugins & themes · reported by WPScanMedium 5.3
The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.
- Product
- MapPress Maps for
- Fixed in
- 2.88.16
- What to do
- Update MapPress Maps for to 2.88.16 or newer.
Feb 12, 2024MapPress Maps for: Does not sanitize and escape the map titleCVE-2024-0420 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks
- Product
- MapPress Maps for
- Fixed in
- 2.88.15
- What to do
- Update MapPress Maps for to 2.88.15 or newer.
Feb 12, 2024WP Chat App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51370 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4.
- Product
- WP Chat App
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update WP Chat App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 5, 2024Booking for Appointments and Events Calendar – Amelia: Stored Cross-Site ScriptingCVE-2023-6808 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.93 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Booking for Appointments and Events Calendar – Amelia
- Affected
- up to 1.0.93
- What to do
- Affects up to 1.0.93. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Feb 1, 2024Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51695 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! allows Stored XSS.This issue affects Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!: from n/a through 2.0.4.1.
- Product
- Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!
- Affected
- up to 2.0.4.1
- What to do
- Affects up to 2.0.4.1. Update Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 30, 2024MapPress Maps for: Stored Cross-Site ScriptingCVE-2023-7225 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MapPress Maps for
- Affected
- up to 2.88.16
- What to do
- Affects up to 2.88.16. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordadvisory.abay.shplugins.trac.wordpress.org
Jan 15, 2024WP Custom Widget area: Does not properly apply capability and nonce checks on any of its AJAX action callback functionsCVE-2023-6066 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.
- Product
- WP Custom Widget area
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update WP Custom Widget area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 11, 2024Happy Addons for Elementor: Reflected Cross-Site ScriptingCVE-2023-6632 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 (versions up to 2.9.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.9.1.1
- What to do
- Affects up to 3.9.1.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6141 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.
- Product
- Essential Real Estate
- Fixed in
- 4.4.0
- What to do
- Update Essential Real Estate to 4.4.0 or newer.
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6139 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.
- Product
- Essential Real Estate
- Fixed in
- 4.4.0
- What to do
- Update Essential Real Estate to 4.4.0 or newer.
Jan 3, 2024MapPress Maps for: Stored Cross-Site ScriptingCVE-2023-6524 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the map title parameter in all versions up to and including 2.88.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MapPress Maps for
- Affected
- up to 2.88.13
- What to do
- Affects up to 2.88.13. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordadvisory.abay.shplugins.trac.wordpress.org
Dec 29, 2023Frontend Admin by DynamiApps: Unrestricted Upload of File with Dangerous TypeCVE-2023-51411 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.18.3
- What to do
- Affects up to 3.18.3. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Happy Addons for Elementor: Server-Side Request Forgery (SSRF)CVE-2023-51676 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1.
- Product
- Happy Addons for Elementor
- Affected
- up to 3.9.1.1
- What to do
- Affects up to 3.9.1.1. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Appointment & Event Booking Calendar Plugin – Webba Booking: Cross-Site Request Forgery (CSRF)CVE-2023-51354 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking.This issue affects Appointment & Event Booking Calendar Plugin – Webba Booking: from n/a through 4.5.33.
- Product
- Appointment & Event Booking Calendar Plugin – Webba Booking
- Affected
- up to 4.5.33
- What to do
- Affects up to 4.5.33. Update Appointment & Event Booking Calendar Plugin – Webba Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023New User Approve: Cross-Site Request Forgery (CSRF)CVE-2023-50902 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.This issue affects New User Approve: from n/a through 2.5.1.
- Product
- New User Approve
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update New User Approve to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger CVE-2023-51371 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS.This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget: from n/a through 1.1.9.
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023Booked - Appointment Booking for WordPress | Calendars: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-36399 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.
- Product
- Booked - Appointment Booking for WordPress | Calendars
- Fixed in
- 2.4.4
- What to do
- Update Booked - Appointment Booking for WordPress | Calendars to 2.4.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50841 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.72.
- Product
- BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
- Affected
- up to 1.0.72
- What to do
- Affects up to 1.0.72. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023Booking Calendar | Appointment Booking | BookIt: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50852 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.
- Product
- Booking Calendar | Appointment Booking | BookIt
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update Booking Calendar | Appointment Booking | BookIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023Appointment Booking Calendar — Simply Schedule Appointments Booking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50851 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in N Squared Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin.This issue affects Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin: from n/a before 1.6.6.1.
- Product
- Appointment Booking Calendar — Simply Schedule Appointments Booking
- Fixed in
- 1.6.6.1
- What to do
- Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.6.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 28, 2023Booking for Appointments and Events Calendar – Amelia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50860 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS.This issue affects Booking for Appointments and Events Calendar – Amelia: from n/a through 1.0.85.
- Product
- Booking for Appointments and Events Calendar – Amelia
- Affected
- up to 1.0.85
- What to do
- Affects up to 1.0.85. Update Booking for Appointments and Events Calendar – Amelia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023Loan Repayment Calculator and Application Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50829 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aerin Loan Repayment Calculator and Application Form allows Stored XSS.This issue affects Loan Repayment Calculator and Application Form: from n/a through 2.9.3.
- Product
- Loan Repayment Calculator and Application Form
- Affected
- up to 2.9.3
- What to do
- Affects up to 2.9.3. Update Loan Repayment Calculator and Application Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 21, 2023AppMySite – Create an app with the Best Mobile App Builder: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-49762 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AppMySite AppMySite – Create an app with the Best Mobile App Builder.This issue affects AppMySite – Create an app with the Best Mobile App Builder: from n/a through 3.11.0.
- Product
- AppMySite – Create an app with the Best Mobile App Builder
- Affected
- up to 3.11.0
- What to do
- Affects up to 3.11.0. Update AppMySite – Create an app with the Best Mobile App Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2023SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!: Cross-Site Request Forgery (CSRF)CVE-2023-49749 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in SureTriggers SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!.This issue affects SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!: from n/a through 1.0.23.
- Product
- SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 14, 2023Sign In Scheduling Online Appointment Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49173 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10to8 Sign In Scheduling Online Appointment Booking System allows Stored XSS.This issue affects Sign In Scheduling Online Appointment Booking System: from n/a through 1.0.9.
- Product
- Sign In Scheduling Online Appointment Booking System
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Sign In Scheduling Online Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48752 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms allows Reflected XSS.This issue affects Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: from n/a through 1.25.9.
- Product
- Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms
- Affected
- up to 1.25.9
- What to do
- Affects up to 1.25.9. Update Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023BookingPress – Appointment Booking Calendar Plugin and Online Scheduling: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-36507 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.64.
- Product
- BookingPress – Appointment Booking Calendar Plugin and Online Scheduling
- Affected
- up to 1.0.64
- What to do
- Affects up to 1.0.64. Update BookingPress – Appointment Booking Calendar Plugin and Online Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023eDoc Employee Job Application – Best WordPress Job Manager for Employees: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48322 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Application – Best WordPress Job Manager for Employees allows Reflected XSS.This issue affects eDoc Employee Job Application – Best WordPress Job Manager for Employees: from n/a through 1.13.
- Product
- eDoc Employee Job Application – Best WordPress Job Manager for Employees
- Affected
- up to 1.13
- What to do
- Affects up to 1.13. Update eDoc Employee Job Application – Best WordPress Job Manager for Employees to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 27, 2023gAppointments: Does not sanitise and escape some of its settingsCVE-2023-2707 · WordPress plugins & themes · reported by WPScanMedium 4.8
The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- gAppointments
- Affected
- up to 1.9.5.1
- What to do
- Affects up to 1.9.5.1. Update gAppointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 17, 2023AppPresser: Unauthorized password resetsCVE-2023-4214 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
- Product
- AppPresser
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update AppPresser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 7, 20231003 Mortgage Application: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45357 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Lenderd 1003 Mortgage Application.This issue affects 1003 Mortgage Application: from n/a through 1.75.
- Product
- 1003 Mortgage Application
- Affected
- up to 1.75
- What to do
- Affects up to 1.75. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023ImageMapper: Cross-Site Request ForgeryCVE-2023-5975 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to update the plugin settings via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ImageMapper
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update ImageMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 7, 2023ImageMapper: Cross-Site Request ForgeryCVE-2023-5532 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the 'imgmap_save_area_title' function. This makes it possible for unauthenticated attackers to update the post title and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ImageMapper
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update ImageMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 7, 2023ImageMapper: Stored Cross-Site ScriptingCVE-2023-5507 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ImageMapper
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update ImageMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 7, 2023ImageMapper: Unauthorized loss of dataCVE-2023-5506 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area_ajax' function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts and pages.
- Product
- ImageMapper
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update ImageMapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 6, 2023Booking calendar, Appointment Booking System: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2022-47428 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.7.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 3, 2023MapPress Maps for: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-26015 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for WordPress mappress-google-maps-for-wordpress allows SQL Injection.This issue affects MapPress Maps for WordPress: from n/a through 2.85.4.
- Product
- MapPress Maps for
- Affected
- up to 2.85.4
- What to do
- Affects up to 2.85.4. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Scientech It Solution Appointment Calendar plugin <= 2.9.6 versions.CVE-2023-46198 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Scientech It Solution Appointment Calendar plugin <= 2.9.6 versions.
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 20, 2023WhatsApp Share Button: Stored Cross-Site ScriptingCVE-2023-5668 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WhatsApp Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'whatsapp' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WhatsApp Share Button
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WhatsApp Share Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 16, 2023WP Job Openings: Does not block listing the contents of the directories where it stores attachments to job applicationsCVE-2023-4933 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job applications, allowing unauthenticated visitors to list and download private attachments if the autoindex feature of the web server is enabled.
- Product
- WP Job Openings
- Fixed in
- 3.4.3
- What to do
- Update WP Job Openings to 3.4.3 or newer.
Sep 11, 2023MapPress Maps for: Stored Cross-Site ScriptingCVE-2023-4840 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mappress' shortcode in versions up to, and including, 2.88.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MapPress Maps for
- Affected
- up to 2.88.4
- What to do
- Affects up to 2.88.4. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 11, 2023gAppointments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2705 · WordPress plugins & themes · reported by WPScanMedium 6.1
The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin
- Product
- gAppointments
- Fixed in
- 1.10.0
- What to do
- Update gAppointments to 1.10.0 or newer.
Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <= 3.11.9 versions.CVE-2022-36424 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nikola Loncar Easy Appointments plugin <= 3.11.9 versions.
- Affected
- up to 3.11.9
- What to do
- Affects up to 3.11.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions.CVE-2023-35091 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions.
- Affected
- up to 2.10.0
- What to do
- Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <CVE-2023-37391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <= 3.4.1 versions.
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions.CVE-2023-28989 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in weDevs Happy Addons for Elementor plugin <= 3.8.2 versions.
- Fixed in
- 3.8.3
- What to do
- Update the plugin to 3.8.3 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 1, 2023Menu Swapper: Cross-Site Request ForgeryCVE-2020-36746 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Menu Swapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.0.2. This is due to missing or incorrect nonce validation on the mswp_save_meta() function. This makes it possible for unauthenticated attackers to save meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Menu Swapper
- Affected
- up to 1.1.0.2
- What to do
- Affects up to 1.1.0.2. Update Menu Swapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
May 30, 2023Wordapp: Authorization bypassCVE-2023-2987 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wa_pdx_op_config_set' function in versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to the plugin to change the 'validation_token' in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access URL, which can be used for privilege escalation.
- Product
- Wordapp
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Wordapp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.reportplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.