Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,543 results · page 143 of 391
May 17, 2022Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate cCVE-2022-30955 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
- Product
- Jenkins GitLab Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to cCVE-2022-30954 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
- Product
- Jenkins Blue Ocean Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
May 17, 2022Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to sCVE-2022-30951 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access control, potentially allowing users to start processes even if they're not allowed to log in.
- Product
- Jenkins WMI Windows Agents Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
May 16, 2022Amministrazione Aperta: Does not validate the open parameter before using it in an include statementCVE-2022-1560 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link
- Product
- Amministrazione Aperta
- Fixed in
- 3.8
- What to do
- Update Amministrazione Aperta to 3.8 or newer.
May 16, 2022Clipr: Does not sanitise and escape its API Key settings before outputting it in an attributeCVE-2022-1559 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
- Product
- Clipr
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Clipr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022ULeak Security & Monitoring: Does not have authorisation and CSRF checksCVE-2022-1557 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings
- Product
- ULeak Security & Monitoring
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update ULeak Security & Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022ScrollReveal.js Effects: Does not sanitise and escape its settingsCVE-2022-1512 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- ScrollReveal.js Effects
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update ScrollReveal.js Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX actionCVE-2022-1465 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.
- Product
- WPC Smart Wishlist for WooCommerce
- Fixed in
- 2.9.9
- What to do
- Update WPC Smart Wishlist for WooCommerce to 2.9.9 or newer.
May 16, 2022Call Now Button: Does not escape a parameter before outputting it back in an attribute of a hidden inputCVE-2022-1455 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled
- Product
- Call Now Button
- Fixed in
- 1.1.2
- What to do
- Update Call Now Button to 1.1.2 or newer.
May 16, 2022WPCargo Track & Trace: Does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the pageCVE-2022-1436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
May 16, 2022WPCargo Track & Trace: Does not sanitize and escapes some of its settingsCVE-2022-1435 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_messCVE-2022-1425 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
May 16, 2022Social Stickers: Does not have CSRF checks in placeCVE-2022-1418 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does not escape some of these fields, which could allow attackers to make a logged-in admin change them and lead to Stored Cross-Site Scripting issues.
- Product
- Social Stickers
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update Social Stickers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not properly validate imagesCVE-2022-1409 · WordPress plugins & themes · reported by WPScanHigh 7.2
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not escape various settings before outputting them in attributesCVE-2022-1408 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not have CSRF check in placeCVE-2022-1407 · WordPress plugins & themes · reported by WPScanMedium 6.5
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 16, 2022External Media without Import: Does not have any authorisation and does to ensure that medias added via URLs are external mediasCVE-2022-1398 · WordPress plugins & themes · reported by WPScanMedium 6.5
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks
- Product
- External Media without Import
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update External Media without Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary CVE-2022-1386 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
- Product
- Fusion Builder
- Fixed in
- 3.6.2
- What to do
- Update Fusion Builder to 3.6.2 or newer.
Full record and what to do →NVD recordtheme-fusion.comwpscan.com
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_iCVE-2022-1349 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to the requesting user, allowing any users (with privileges as low as Subscriber) to delete the profile pictures of any other user.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
May 16, 2022WP YouTube Live: Does not validateCVE-2022-1334 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP YouTube Live WordPress plugin before 1.8.3 does not validate, sanitise and escape various of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WP YouTube Live
- Fixed in
- 1.8.3
- What to do
- Update WP YouTube Live to 1.8.3 or newer.
May 16, 2022BMI BMR Calculator: Does not sanitise and escape arbitrary POST data before outputting it back in the responseCVE-2022-1267 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- BMI BMR Calculator
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update BMI BMR Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022BulletProof Security: Does not sanitize and escape some of its CAPTCHA settingsCVE-2022-1265 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- BulletProof Security
- Fixed in
- 6.1
- What to do
- Update BulletProof Security to 6.1 or newer.
May 16, 2022Custom TinyMCE Shortcode Button: Does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin pageCVE-2022-1217 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
- Product
- Custom TinyMCE Shortcode Button
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Custom TinyMCE Shortcode Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Advanced Image Sitemap: Does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin pageCVE-2022-1216 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
- Product
- Advanced Image Sitemap
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Advanced Image Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Visual Slide Box Builder: Does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (suchCVE-2022-1182 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections
- Product
- Visual Slide Box Builder
- Affected
- up to 3.2.9
- What to do
- Affects up to 3.2.9. Update Visual Slide Box Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Bulk Edit and Create User Profiles: Does not sanitise and escape the Users LoginCVE-2022-1089 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Bulk Edit and Create User Profiles
- Fixed in
- 1.5.14
- What to do
- Update Bulk Edit and Create User Profiles to 1.5.14 or newer.
May 16, 2022th23 Social: Does not sanitise and escape some of its settingsCVE-2022-1062 · WordPress plugins & themes · reported by WPScanMedium 4.8
The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- th23 Social
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update th23 Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profilCVE-2022-1051 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any authenticated user to perform Cross-Site Scripting attacks.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
May 16, 2022Gmedia Photo Gallery: Does not sanitise and escape the Album's name before outputting it in pages/posts with a media embedCVE-2022-0873 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed
- Product
- Gmedia Photo Gallery
- Fixed in
- 1.20.0
- What to do
- Update Gmedia Photo Gallery to 1.20.0 or newer.
May 16, 2022Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secure random numbers.CVE-2022-30782 · Other software · Openmoney API Project · reported by MITREHigh 7.5
Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secure random numbers.
- Product
- Openmoney API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.mozilla.orggithub.com
May 16, 2022Gitea before 1.16.7 does not escape git fetch remote.CVE-2022-30781 · Other software · Gitea · reported by MITREHigh 7.5
Gitea before 1.16.7 does not escape git fetch remote.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
May 13, 2022mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.CVE-2021-33013 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 8.2
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.CVE-2021-27505 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 7.5
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in CCVE-2022-27656 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
The Web administration UI of SAP Web Dispatcher and the Internet Communication Manager (ICM) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
- Product
- SAP NetWeaver AS for ABAP and Java (ICM Administration UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
May 10, 2022The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the uCVE-2022-1567 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 9, 2022Easily Generate Rest API Url: Does not escape some of its settingsCVE-2022-1338 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easily Generate Rest API Url WordPress plugin through 1.0.0 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Easily Generate Rest API Url
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Easily Generate Rest API Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022Slide Anything: Does not sanitize and escape sliders' descriptionCVE-2022-1303 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Slide Anything
- Fixed in
- 2.3.44
- What to do
- Update Slide Anything to 2.3.44 or newer.
May 9, 2022Vertical scroll recent post: Does not sanitise and escape a parameter before outputting it back in an attributeCVE-2022-1171 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Vertical scroll recent post
- Fixed in
- 14.0
- What to do
- Update Vertical scroll recent post to 14.0 or newer.
May 9, 2022Popup Maker: Does not sanitise and escape some of its Popup settingsCVE-2022-1104 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Popup Maker
- Fixed in
- 1.16.5
- What to do
- Update Popup Maker to 1.16.5 or newer.
May 9, 2022Themify Post Type Builder Search Addon: Does not properly escape the current page URL before reusing it in a HTML attributeCVE-2022-1047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability.
- Product
- Themify Post Type Builder Search Addon
- Fixed in
- 1.4.0
- What to do
- Update Themify Post Type Builder Search Addon to 1.4.0 or newer.
May 9, 2022Order Listener for WooCommerce: Does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated usersCVE-2022-0948 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection
- Product
- Order Listener for WooCommerce
- Fixed in
- 3.2.2
- What to do
- Update Order Listener for WooCommerce to 3.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 9, 2022IgniteUp: Does not sanitise and escape some fieldsCVE-2022-0898 · WordPress plugins & themes · reported by WPScanMedium 5.4
The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues
- Product
- IgniteUp
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update IgniteUp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022WP Social Buttons: Does not sanitise and escape its settingsCVE-2022-0874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Social Buttons
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WP Social Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022SEMA API: Does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX actionCVE-2022-0836 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users
- Product
- SEMA API
- Fixed in
- 4.02
- What to do
- Update SEMA API to 4.02 or newer.
May 9, 2022WP Video Gallery: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCVE-2022-0826 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- WP Video Gallery
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update WP Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022BadgeOS: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCVE-2022-0817 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- BadgeOS
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update BadgeOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022Ubigeo de Perú para Woocommerce: Does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actionsCVE-2022-0814 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
- Product
- Ubigeo de Perú para Woocommerce
- Fixed in
- 3.6.4
- What to do
- Update Ubigeo de Perú para Woocommerce to 3.6.4 or newer.
May 9, 2022Admin Menu Editor: Does not sanitize and escape a parameter before outputting it back in an admin pageCVE-2022-0625 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Admin Menu Editor
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Admin Menu Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 9, 2022MapSVG: Does not validate and escape a parameter via a REST endpoint before using it in a SQL statementCVE-2022-0592 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.
- Product
- MapSVG
- Fixed in
- 6.2.20
- What to do
- Update MapSVG to 6.2.20 or newer.
May 9, 2022Popup by Supsystic: Does not have any authentication and authorisation in an AJAX actionCVE-2022-0424 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
- Product
- Popup by Supsystic
- Fixed in
- 1.10.9
- What to do
- Update Popup by Supsystic to 1.10.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.