Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,543 results · page 140 of 391
Jun 20, 2022WPlite: Does not have CSRF check in placeCVE-2022-1831 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WPlite
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update WPlite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Amazon Einzeltitellinks: Does not have CSRF check in placeCVE-2022-1830 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Amazon Einzeltitellinks
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Amazon Einzeltitellinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Inline Google Maps: Does not have CSRF check in placeCVE-2022-1829 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Inline Google Maps
- Affected
- up to 5.11
- What to do
- Affects up to 5.11. Update Inline Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022PDF24 Articles To PDF: Does not have CSRF check in placeCVE-2022-1828 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- PDF24 Articles To PDF
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update PDF24 Articles To PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022PDF24 Article To PDF: Does not have CSRF check in placeCVE-2022-1827 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- PDF24 Article To PDF
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update PDF24 Article To PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Cross-Linker: Does not have CSRF check in placeCVE-2022-1826 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- Cross-Linker
- Affected
- up to 3.0.1.9
- What to do
- Affects up to 3.0.1.9. Update Cross-Linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Multi-page Toolkit: Does not have CSRF check in placeCVE-2022-1818 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- Multi-page Toolkit
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Multi-page Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Custom Share Buttons with Floating Sidebar: Does not sanitise and escape some of its settingsCVE-2022-1717 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Custom Share Buttons with Floating Sidebar
- Fixed in
- 4.2
- What to do
- Update Custom Share Buttons with Floating Sidebar to 4.2 or newer.
Jun 20, 2022WP-EMail: Does not protect its log deletion functionality with nonce checksCVE-2022-1630 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack
- Product
- WP-EMail
- Fixed in
- 2.69.0
- What to do
- Update WP-EMail to 2.69.0 or newer.
Jun 20, 2022Seamless Donations: Does not have CSRF check in placeCVE-2022-1610 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Seamless Donations
- Fixed in
- 5.1.9
- What to do
- Update Seamless Donations to 5.1.9 or newer.
Jun 20, 2022Mail Subscribe List: Does not have CSRF check in placeCVE-2022-1603 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list
- Product
- Mail Subscribe List
- Fixed in
- 2.1.4
- What to do
- Update Mail Subscribe List to 2.1.4 or newer.
Jun 20, 2022Better Find and Replace: Does not properly sanitiseCVE-2022-1472 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
- Product
- Better Find and Replace
- Fixed in
- 1.3.6
- What to do
- Update Better Find and Replace to 1.3.6 or newer.
Jun 20, 2022Post Grid, Slider & Carousel Ultimate: Does not sanitise and escape the Header TitleCVE-2022-1266 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Post Grid, Slider & Carousel Ultimate
- Fixed in
- 1.5.0
- What to do
- Update Post Grid, Slider & Carousel Ultimate to 1.5.0 or newer.
Jun 20, 2022Print, PDF, Email by PrintFriendly: Does not sanitise and escape the Custom Button Text settingsCVE-2022-0663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Print, PDF, Email by PrintFriendly
- Fixed in
- 5.2.3
- What to do
- Update Print, PDF, Email by PrintFriendly to 5.2.3 or newer.
Jun 20, 2022Rating by BestWebSoft: Does not validate the submitted ratingCVE-2021-25121 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating
- Product
- Rating by BestWebSoft
- Fixed in
- 1.6
- What to do
- Update Rating by BestWebSoft to 1.6 or newer.
Jun 20, 2022Ocean Extra: Does not escape generated linksCVE-2021-25104 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
- Product
- Ocean Extra
- Fixed in
- 1.9.5
- What to do
- Update Ocean Extra to 1.9.5 or newer.
Jun 20, 2022XML Sitemaps: Does not sanitise and escape a settings before outputting it in the Debug pageCVE-2021-25088 · WordPress plugins & themes · reported by WPScanMedium 4.8
The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- XML Sitemaps
- Fixed in
- 4.1.3
- What to do
- Update XML Sitemaps to 4.1.3 or newer.
Jun 17, 2022In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invaliCVE-2022-22485 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 does not cause the administrator's invalid sign-on count to be incremented on the IBM Spectrum Protect Server. An attacker could exploit this vulnerability using brute force techniques to gain unauthorized administrative access to the IBM Spectrum Protect Server. IBM X-Force ID: 226325.
- Product
- Spectrum Protect Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 15, 2022Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability.CVE-2021-40940 · Other software · Monstra · reported by MITRECritical 9.8
Monstra 3.0.4 does not filter the case of php, which leads to an unrestricted file upload vulnerability.
- Product
- Monstra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution CVE-2022-33140 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.
- Product
- Apache NiFi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgnifi.apache.org
Jun 14, 2022SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2022-31595 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- Product
- SAP Financial Consolidation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 14, 2022Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory.CVE-2021-42675 · Other software · Kreado · reported by MITRECritical 9.8
Kreado Kreasfero 1.5 does not properly sanitize uploaded files to the media directory. One can upload a malicious PHP file and obtain remote code execution.
- Product
- Kreasfero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwitter.comtwitter.com
Jun 13, 2022Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary toCVE-2022-28217 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSRF attacks that could compromise system�s Availability by causing system to crash.
- Product
- SAP NetWeaver (EP Web Page Composer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 13, 2022In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax.CVE-2022-30311 · Other software · Festo · reported by info@cert.vde.comCritical 9.8
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
- Product
- Controller CECC-X-M1 (4407603)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 13, 2022In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax.CVE-2022-30310 · Other software · Festo · reported by info@cert.vde.comCritical 9.8
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
- Product
- Controller CECC-X-M1 (4407603)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 13, 2022In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax.CVE-2022-30309 · Other software · Festo · reported by info@cert.vde.comCritical 9.8
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
- Product
- Controller CECC-X-M1 (4407603)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 13, 2022In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax.CVE-2022-30308 · Other software · Festo · reported by info@cert.vde.comCritical 9.8
In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection.
- Product
- Controller CECC-X-M1 (4407603)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jun 13, 2022Mitsol Social Post Feed: Does not escape some of its settings before outputting them back in attributesCVE-2022-0209 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Mitsol Social Post Feed
- Fixed in
- 1.11
- What to do
- Update Mitsol Social Post Feed to 1.11 or newer.
Jun 13, 2022WP Admin Style: Does not sanitise and escape some of its settingsCVE-2022-1814 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- WP Admin Style
- Affected
- up to 0.1.2
- What to do
- Affects up to 0.1.2. Update WP Admin Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Export any WordPress data to XML/CSV: Does not sanitize the cpt POST parameterCVE-2022-1800 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.
- Product
- Export any WordPress data to XML/CSV
- Fixed in
- 1.3.5
- What to do
- Update Export any WordPress data to XML/CSV to 1.3.5 or newer.
Jun 13, 2022Quick Subscribe: Does not have CSRF check in placeCVE-2022-1792 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them
- Product
- Quick Subscribe
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Quick Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022One Click Plugin Updater: Does not have CSRF check in placeCVE-2022-1791 · WordPress plugins & themes · reported by WPScanHigh 8.1
The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.
- Product
- One Click Plugin Updater
- Affected
- up to 2.4.14
- What to do
- Affects up to 2.4.14. Update One Click Plugin Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022New User Email Set Up: Does not have CSRF check in placeCVE-2022-1790 · WordPress plugins & themes · reported by WPScanMedium 6.5
The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- New User Email Set Up
- Affected
- up to 0.5.2
- What to do
- Affects up to 0.5.2. Update New User Email Set Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Sideblog: Does not have CSRF check in placeCVE-2022-1787 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Sideblog
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update Sideblog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022postTabs: Does not have CSRF check in placeCVE-2022-1781 · WordPress plugins & themes · reported by WPScanMedium 5.4
The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- postTabs
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update postTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022LaTeX for: Does not have CSRF check in placeCVE-2022-1780 · WordPress plugins & themes · reported by WPScanMedium 5.4
The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack which could also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- LaTeX for
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update LaTeX for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Auto Delete Posts: Does not have CSRF check in placeCVE-2022-1779 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.
- Product
- Auto Delete Posts
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Auto Delete Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Filr: Does not have authorisation check in two of its AJAX actionsCVE-2022-1777 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
- Product
- Filr
- Fixed in
- 1.2.2.1
- What to do
- Update Filr to 1.2.2.1 or newer.
Jun 13, 2022WP Athletics: Does not sanitise and escape a parameter before outputting back in an admin pageCVE-2022-1773 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- WP Athletics
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update WP Athletics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Google Places Reviews: Does not properly escape its Google API key settingCVE-2022-1772 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.
- Product
- Google Places Reviews
- Fixed in
- 2.0.0
- What to do
- Update Google Places Reviews to 2.0.0 or newer.
Jun 13, 2022WP-chgFontSize: Does not have CSRF check in placeCVE-2022-1764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- WP-chgFontSize
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update WP-chgFontSize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022iQ Block Country: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-1762 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- iQ Block Country
- Fixed in
- 1.2.20
- What to do
- Update iQ Block Country to 1.2.20 or newer.
Jun 13, 2022RB Internal Links: Does not have CSRF check in placeCVE-2022-1759 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as perform Stored Cross-Site Scripting attacks due to the lack of sanitisation and escaping
- Product
- RB Internal Links
- Affected
- up to 2.0.16
- What to do
- Affects up to 2.0.16. Update RB Internal Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Genki Pre-Publish Reminder: Does not have CSRF check in placeCVE-2022-1758 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS as well as RCE when custom code is added via the plugin settings.
- Product
- Genki Pre-Publish Reminder
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Genki Pre-Publish Reminder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Newsletter: Does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pagesCVE-2022-1756 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
- Product
- Newsletter
- Fixed in
- 7.4.5
- What to do
- Update Newsletter to 7.4.5 or newer.
Jun 13, 2022Simple Membership: Does not properly sanitise and escape parameters before outputting them back in AJAX actionsCVE-2022-1724 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
- Product
- Simple Membership
- Fixed in
- 4.1.1
- What to do
- Update Simple Membership to 4.1.1 or newer.
Jun 13, 2022Appointment Hour Booking: Does not sanitise and escape a settings of its Calendar fieldsCVE-2022-1710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.56
- What to do
- Update Appointment Hour Booking to 1.3.56 or newer.
Jun 13, 2022Useful Banner Manager: Does not perform CSRF checks on POST requests to its admin pageCVE-2022-1694 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.
- Product
- Useful Banner Manager
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Useful Banner Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Latest Tweets Widget: Does not have CSRF check in placeCVE-2022-1624 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Latest Tweets Widget
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Latest Tweets Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Webriti SMTP Mail: Does not have CSRF check in placeCVE-2022-1612 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Webriti SMTP Mail
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Webriti SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.