Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,328 results · page 14 of 27
Jan 16, 2024Calculated Fields Form: Does not sanitise and escape some of its form settingsCVE-2023-0389 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Calculated Fields Form
- Fixed in
- 1.1.151
- What to do
- Update Calculated Fields Form to 1.1.151 or newer.
Jan 16, 2024Seed Social: Does not sanitise and escape some of its settingsCVE-2022-3836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Seed Social
- Fixed in
- 2.0.4
- What to do
- Update Seed Social to 2.0.4 or newer.
Jan 16, 2024Font Awesome 4 Menus: Does not sanitise and escape some of its settingsCVE-2022-3829 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Font Awesome 4 Menus
- Affected
- up to 4.7.0
- What to do
- Affects up to 4.7.0. Update Font Awesome 4 Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024WP Fastest Cache: Does not escape user input in the set_urls_with_terms method before using it in a SQL statementCVE-2021-24869 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber
- Product
- WP Fastest Cache
- Fixed in
- 0.9.5
- What to do
- Update WP Fastest Cache to 0.9.5 or newer.
Jan 16, 2024WP Editor: Did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameterCVE-2021-24151 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.
- Product
- WP Editor
- Fixed in
- 1.2.7
- What to do
- Update WP Editor to 1.2.7 or newer.
Jan 15, 2024Keap Official Opt-in Forms: Does not sanitise and escape some of its settingsCVE-2023-6941 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Keap Official Opt-in Forms
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2024WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-6163 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Crowdfunding
- Fixed in
- 2.1.10
- What to do
- Update WP Crowdfunding to 2.1.10 or newer.
Jan 15, 2024Easy Forms for Mailchimp: Does not sanitise and escape some of its settingsCVE-2023-4925 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Easy Forms for Mailchimp
- Affected
- up to 6.8.10
- What to do
- Affects up to 6.8.10. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 11, 2024Hostinger: Unauthorized plugin settings updateCVE-2023-6751 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The Hostinger plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the function publish_website in all versions up to, and including, 1.9.7. This makes it possible for unauthenticated attackers to enable and disable maintenance mode.
- Product
- Hostinger
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update Hostinger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 8, 2024Ni Purchase Order(PO) For WooCommerce: Does not validate logo and signature image files uploaded in the settingsCVE-2023-5957 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ni Purchase Order(PO) For WooCommerce WordPress plugin through 1.2.1 does not validate logo and signature image files uploaded in the settings, allowing high privileged user to upload arbitrary files to the web server, triggering an RCE vulnerability by uploading a web shell.
- Product
- Ni Purchase Order(PO) For WooCommerce
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Ni Purchase Order(PO) For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2024WP Custom Cursors | WordPress Cursor: Does not sanitise and escape some of its settingsCVE-2023-5911 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Custom Cursors | WordPress Cursor
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update WP Custom Cursors | WordPress Cursor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2024RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator: Unauthorized settings updateCVE-2023-6798 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with author-level access or above to change the plugin's settings including proxy settings, which are also exposed to authors.
- Product
- RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- Affected
- up to 4.3.2
- What to do
- Affects up to 4.3.2. Update RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 1, 2024Html5 Video Player: Does not sanitise and escape some of its player settingsCVE-2023-6485 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins
- Product
- Html5 Video Player
- Fixed in
- 2.5.19
- What to do
- Update Html5 Video Player to 2.5.19 or newer.
Jan 1, 2024WP TripAdvisor Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6037 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP TripAdvisor Review Slider
- Fixed in
- 11.9
- What to do
- Update WP TripAdvisor Review Slider to 11.9 or newer.
Dec 26, 2023BSK Forms Blacklist: Does not sanitise and escape some of its settingsCVE-2023-5980 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- BSK Forms Blacklist
- Fixed in
- 3.7
- What to do
- Update BSK Forms Blacklist to 3.7 or newer.
Dec 23, 2023Widget Settings Importer/Exporter: Stored Cross-Site ScriptingCVE-2020-36769 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_dataparameter AJAX action in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Widget Settings Importer/Exporter
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Widget Settings Importer/Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Dec 18, 2023Swift Performance Lite: Does not prevent users from exporting the plugin's settingsCVE-2023-6289 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.
- Product
- Swift Performance Lite
- Fixed in
- 2.3.6.15
- What to do
- Update Swift Performance Lite to 2.3.6.15 or newer.
Dec 18, 2023Product Catalog Mode For WooCommerce: Does not properly authorize settings updates or escape settings valuesCVE-2023-5348 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
- Product
- Product Catalog Mode For WooCommerce
- Fixed in
- 5.0.3
- What to do
- Update Product Catalog Mode For WooCommerce to 5.0.3 or newer.
Dec 18, 2023Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro: Does not sanitise and escape some of its settingsCVE-2023-5005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro
- Fixed in
- 3.0
- What to do
- Update Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro to 3.0 or newer.
Dec 11, 2023Contact Form Email: Does not sanitise and escape some of its settingsCVE-2023-5955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Contact Form Email
- Fixed in
- 1.3.44
- What to do
- Update Contact Form Email to 1.3.44 or newer.
Dec 11, 2023WP Not Login Hide (WPNLH): Does not sanitise and escape some of its settingsCVE-2023-5940 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Not Login Hide (WPNLH)
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Not Login Hide (WPNLH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 11, 2023WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-5757 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Crowdfunding
- Fixed in
- 2.1.8
- What to do
- Update WP Crowdfunding to 2.1.8 or newer.
Dec 7, 2023Password Reset with Code for WordPress REST API: Improper Restriction of Excessive Authentication AttemptsCVE-2023-35039 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.
- Product
- Password Reset with Code for WordPress REST API
- Affected
- up to 0.0.15
- What to do
- Affects up to 0.0.15. Update Password Reset with Code for WordPress REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Popup box
- Fixed in
- 3.8.6
- What to do
- Update Popup box to 3.8.6 or newer.
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5809 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Popup box
- Fixed in
- 3.8.6
- What to do
- Update Popup box to 3.8.6 or newer.
Dec 4, 2023Simply Excerpts: Does not sanitize and escape some fields in the plugin settingsCVE-2023-5137 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
- Product
- Simply Excerpts
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Simply Excerpts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2023WordPress Online Booking and Scheduling: Does not sanitise and escape some of its settingsCVE-2023-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Online Booking and Scheduling
- Fixed in
- 22.5
- What to do
- Update WordPress Online Booking and Scheduling to 22.5 or newer.
Nov 27, 2023gAppointments: Does not sanitise and escape some of its settingsCVE-2023-2707 · WordPress plugins & themes · reported by WPScanMedium 4.8
The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- gAppointments
- Affected
- up to 1.9.5.1
- What to do
- Affects up to 1.9.5.1. Update gAppointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 22, 2023UserPro: Unauthorized password resetsCVE-2023-2449 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_process_form). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-2448 and CVE-2023-2446, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
- Product
- UserPro
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 20, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5343 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Popup box
- Fixed in
- 3.7.9
- What to do
- Update Popup box to 3.7.9 or newer.
Nov 20, 2023Forminator: Does not properly sanitize the redirect-url field in the form submission settingsCVE-2023-5119 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
- Product
- Forminator
- Fixed in
- 1.27.0
- What to do
- Update Forminator to 1.27.0 or newer.
Nov 20, 2023PubyDoc: Does not sanitise and escape some of its settingsCVE-2023-4970 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- PubyDoc
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update PubyDoc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2023The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change tCVE-2023-4824 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- What to do
- Update the plugin to the newest version.
Nov 17, 2023AppPresser: Unauthorized password resetsCVE-2023-4214 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
- Product
- AppPresser
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update AppPresser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2023URL Shortify: Does not sanitise and escape some of its settingsCVE-2023-5605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- URL Shortify
- Fixed in
- 1.7.9.1
- What to do
- Update URL Shortify to 1.7.9.1 or newer.
Nov 6, 2023User Registration: Does not sanitize and escape some of its settingsCVE-2023-5228 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- User Registration
- Fixed in
- 3.0.4.2
- What to do
- Update User Registration to 3.0.4.2 or newer.
Nov 6, 2023WP Discord Invite: Does not sanitise and escape some of its settingsCVE-2023-5181 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Discord Invite
- Fixed in
- 2.5.2
- What to do
- Update WP Discord Invite to 2.5.2 or newer.
Nov 6, 2023Simple Table Manager: Does not sanitise and escape some of its settingsCVE-2023-4858 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Table Manager
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Simple Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2023Responsive Pricing Table: Does not sanitise and escape some of its settingsCVE-2023-4810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Pricing Table
- Fixed in
- 5.1.8
- What to do
- Update Responsive Pricing Table to 5.1.8 or newer.
Full record and what to do →NVD recordportswigger.netwpscan.com
Oct 31, 2023Login Screen Manager: Does not sanitize and escape some of its settingsCVE-2023-5243 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login Screen Manager
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update Login Screen Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2023E2Pdf: Does not sanitize and escape some of its settingsCVE-2023-5229 · WordPress plugins & themes · reported by WPScanMedium 4.8
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- E2Pdf
- Fixed in
- 1.20.20
- What to do
- Update E2Pdf to 1.20.20 or newer.
Oct 31, 2023WP Meta and Date Remover: Provides an AJAX endpoint for configuring the plugin settingsCVE-2023-4823 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability checks and does not sanitize the user input, which is then later output unescaped. Allowing any authenticated users, such as subscriber change them and perform Stored Cross-Site Scripting.
- Product
- WP Meta and Date Remover
- Fixed in
- 2.2.0
- What to do
- Update WP Meta and Date Remover to 2.2.0 or newer.
Oct 20, 2023WooCommerce Dynamic Pricing and Discounts: Unauthenticated settings exportCVE-2021-4353 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings.
- Product
- WooCommerce Dynamic Pricing and Discounts
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Oct 20, 2023Fancy Product Designer: Unauthorized access to data and modification of plugin settingsCVE-2021-4335 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a missing capability check on multiple AJAX functions in versions up to, and including, 4.6.9. This makes it possible for authenticated attackers with subscriber-level permissions to modify plugin settings, including retrieving arbitrary order information or creating/updating/deleting products, orders, or other sensitive information not associated with their own account.
- Product
- Fancy Product Designer
- Affected
- up to 4.6.9
- What to do
- Affects up to 4.6.9. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com
Oct 16, 2023WordPress File Upload: Does not sanitise and escape some of its settingsCVE-2023-4811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
- Product
- WordPress File Upload
- Fixed in
- 4.23.3
- What to do
- Update WordPress File Upload to 4.23.3 or newer.
Oct 16, 2023Tutor LMS: Does not sanitise and escape some of its settingsCVE-2023-4805 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Tutor LMS
- Fixed in
- 2.3.0
- What to do
- Update Tutor LMS to 2.3.0 or newer.
Oct 16, 2023Simple Posts Ticker: Does not sanitise and escape some of its settingsCVE-2023-4725 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Posts Ticker
- Fixed in
- 1.1.6
- What to do
- Update Simple Posts Ticker to 1.1.6 or newer.
Oct 16, 2023EventON: Does not sanitise and escape some of its settingsCVE-2023-4388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- EventON
- Fixed in
- 2.2
- What to do
- Update EventON to 2.2 or newer.
Oct 16, 2023Read More & Accordion: Unserializes user input provided via the settingsCVE-2023-3392 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Read More & Accordion WordPress plugin before 3.2.7 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- Read More & Accordion
- Fixed in
- 3.2.7
- What to do
- Update Read More & Accordion to 3.2.7 or newer.
Sep 25, 2023Translate WordPress with GTranslate: Does not sanitise and escape some of its settingsCVE-2023-4502 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.
- Product
- Translate WordPress with GTranslate
- Fixed in
- 3.0.4
- What to do
- Update Translate WordPress with GTranslate to 3.0.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.