Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,547 results · page 148 of 391
Mar 23, 2022GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing CVE-2021-27426 · Other software · GE · reported by ics-cert@hq.dhs.govCritical 9.8
GE UR IED firmware versions prior to version 8.1x with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user.
- Product
- UR family
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govgegridsolutions.com
Mar 23, 2022GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming tCVE-2021-27420 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 5.3
GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By itself, this is not particularly significant as the relay remains effective in all other functionality and communication channels.
- Product
- UR family
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govgegridsolutions.com
Mar 21, 2022Simple Link Directory: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0760 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
- Product
- Simple Link Directory
- Fixed in
- 7.7.2
- What to do
- Update Simple Link Directory to 7.7.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Infographic Maker: Does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users)CVE-2022-0747 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
- Product
- Infographic Maker
- Fixed in
- 4.3.8
- What to do
- Update Infographic Maker to 4.3.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Advanced Booking Calendar: Does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated useCVE-2022-0694 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Product
- Advanced Booking Calendar
- Fixed in
- 1.7.0
- What to do
- Update Advanced Booking Calendar to 1.7.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Simple Membership: Does not have CSRF check in placeCVE-2022-0681 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack
- Product
- Simple Membership
- Fixed in
- 4.1.0
- What to do
- Update Simple Membership to 4.1.0 or newer.
Mar 21, 2022Pricing Table Builder: Does not sanitize and escape the postid parameter before outputting it back in an admin pageCVE-2022-0640 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Pricing Table Builder
- Fixed in
- 1.1.5
- What to do
- Update Pricing Table Builder to 1.1.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Mega Menu: Does not sanitize and escape the _wpnonce parameter before outputting it back in an admin pageCVE-2022-0628 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Mega Menu
- Fixed in
- 3.0.8
- What to do
- Update Mega Menu to 3.0.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Amelia: Does not sanitize and escape the code parameter before outputting it back in an admin pageCVE-2022-0627 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Amelia
- Fixed in
- 1.0.47
- What to do
- Update Amelia to 1.0.47 or newer.
Mar 21, 2022Amelia: Does not have CSRF check in placeCVE-2022-0616 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack
- Product
- Amelia
- Fixed in
- 1.0.47
- What to do
- Update Amelia to 1.0.47 or newer.
Mar 21, 2022FormCraft: Does not validate the URL parameter in the formcraft3_get AJAX actionCVE-2022-0591 · WordPress plugins & themes · reported by WPScanCritical 9.1
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
- Product
- FormCraft
- Fixed in
- 3.8.28
- What to do
- Update FormCraft to 3.8.28 or newer.
Mar 21, 2022BulletProof Security: Does not sanitise and escape some of its settingsCVE-2022-0590 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- BulletProof Security
- Fixed in
- 5.8
- What to do
- Update BulletProof Security to 5.8 or newer.
Mar 21, 20223D FlipBook: Does not have authorisation and CSRF checksCVE-2022-0423 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook.
- Product
- 3D FlipBook
- Fixed in
- 1.12.1
- What to do
- Update 3D FlipBook to 1.12.1 or newer.
Mar 21, 2022Modern Events Calendar Lite: Does not sanitize and escape some of the Hourly Schedule parametersCVE-2022-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.4.0
- What to do
- Update Modern Events Calendar Lite to 6.4.0 or newer.
Mar 21, 2022miniOrange's Google Authenticator: Does not have proper authorisation and CSRF checksCVE-2022-0229 · WordPress plugins & themes · reported by WPScanHigh 8.1
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
- Product
- miniOrange's Google Authenticator
- Fixed in
- 5.5
- What to do
- Update miniOrange's Google Authenticator to 5.5 or newer.
Mar 21, 2022SEO Plugin by Squirrly SEO: Does not escape the type parameter before outputting it back in an attribute in an admin pageCVE-2021-25019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- SEO Plugin by Squirrly SEO
- Fixed in
- 11.1.12
- What to do
- Update SEO Plugin by Squirrly SEO to 11.1.12 or newer.
Mar 21, 2022Advanced Contact form 7 DB: Does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX actionCVE-2021-24905 · WordPress plugins & themes · reported by WPScanHigh 8
The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.
- Product
- Advanced Contact form 7 DB
- Fixed in
- 1.8.7
- What to do
- Update Advanced Contact form 7 DB to 1.8.7 or newer.
Mar 18, 2022Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it.CVE-2021-4031 · Other software · Syltek · reported by cve-coordination@incibe.esHigh 7.5
Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker to forge a request and bypass the payment system by marking items as payed without any verification.
- Product
- Syltek
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe-cert.esincibe-cert.es
Mar 18, 2022In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk).CVE-2021-45868 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.kernel.orgcdn.kernel.org
Mar 15, 2022Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resultiCVE-2022-27213 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
- Product
- Jenkins Environment Dashboard Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 15, 2022Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored croCVE-2022-27212 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins List Git Branches Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 15, 2022Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stCVE-2022-27207 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.8
Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
- Product
- Jenkins global-build-stats Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 15, 2022Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttonsCVE-2022-27202 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Extended Choice Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 15, 2022Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about thCVE-2022-27201 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
- Product
- Jenkins Semantic Versioning Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 15, 2022Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored croCVE-2022-27200 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.8
Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
- Product
- Jenkins Folder-based Authorization Strategy Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 15, 2022Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scriCVE-2022-27197 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
- Product
- Jenkins Dashboard View Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 15, 2022Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerabiliCVE-2022-27196 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
- Product
- Jenkins Favorite Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 14, 2022Simple Quotation: Does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user dataCVE-2022-22735 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks
- Product
- Simple Quotation
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Simple Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Simple Quotation: Does not have CSRF checkCVE-2022-22734 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escape Quotes. As a result, attacker could make a logged in admin create or edit arbitrary quote, and put Cross-Site Scripting payloads in them
- Product
- Simple Quotation
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Simple Quotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022GD Mylist: Does not sanitise and escape some of its settingsCVE-2022-0703 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- GD Mylist
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update GD Mylist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Petfinder Listings: Does not escape its settingsCVE-2022-0702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Petfinder Listings
- Affected
- up to 1.0.18
- What to do
- Affects up to 1.0.18. Update Petfinder Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022SEO 301 Meta: Does not escape its Request and Destination settingsCVE-2022-0701 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- SEO 301 Meta
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update SEO 301 Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Simple Tracking: Does not sanitise and escape its settingsCVE-2022-0700 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Simple Tracking
- Fixed in
- 1.7
- What to do
- Update Simple Tracking to 1.7 or newer.
Mar 14, 2022WP Home Page Menu: Does not sanitise and escape its settingsCVE-2022-0684 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- WP Home Page Menu
- Fixed in
- 3.1
- What to do
- Update WP Home Page Menu to 3.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Kunze Law: Does not escape its 'E-Mail Error "From" Address' settingsCVE-2022-0674 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Kunze Law
- Fixed in
- 2.1
- What to do
- Update Kunze Law to 2.1 or newer.
Mar 14, 2022Sync QCloud COS: Does not escape some of its settingsCVE-2022-0659 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Sync QCloud COS
- Fixed in
- 2.0.1
- What to do
- Update Sync QCloud COS to 2.0.1 or newer.
Mar 14, 2022CommonsBooking: Does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queriesCVE-2022-0658 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
- Product
- CommonsBooking
- Fixed in
- 2.6.8
- What to do
- Update CommonsBooking to 2.6.8 or newer.
Mar 14, 2022Team Circle Image Slider With Lightbox: Does not sanitize and escape the order_pos parameter before outputting it back in an admin pageCVE-2022-0648 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Team Circle Image Slider With Lightbox
- Fixed in
- 1.0.16
- What to do
- Update Team Circle Image Slider With Lightbox to 1.0.16 or newer.
Mar 14, 2022Countdown, Coming Soon, Maintenance: Does not sanitize and escape the post parameter before outputting it back in an admin pageCVE-2022-0601 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Countdown, Coming Soon, Maintenance
- Fixed in
- 2.2.9
- What to do
- Update Countdown, Coming Soon, Maintenance to 2.2.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022WordPress Multisite Content Copier/Updater: Does not sanitise and escape the s parameter before outputting it back in an attributeCVE-2022-0503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in the network dashboard
- Product
- WordPress Multisite Content Copier/Updater
- Fixed in
- 2.1.2
- What to do
- Update WordPress Multisite Content Copier/Updater to 2.1.2 or newer.
Mar 14, 2022Event Manager and Tickets Selling for WooCommerce: Does not validate and escape the post_author_gutenberg parameter before using it in a SQL statementCVE-2022-0478 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacks
- Product
- Event Manager and Tickets Selling for WooCommerce
- Fixed in
- 3.5.8
- What to do
- Update Event Manager and Tickets Selling for WooCommerce to 3.5.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Flexi: Does not sanitise and escape various parameters before outputting them back in some pages suchCVE-2022-0449 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Flexi
- Fixed in
- 4.20
- What to do
- Update Flexi to 4.20 or newer.
Mar 14, 2022Advanced Product Labels for WooCommerce: Does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's responseCVE-2022-0399 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting
- Product
- Advanced Product Labels for WooCommerce
- Fixed in
- 1.2.3.7
- What to do
- Update Advanced Product Labels for WooCommerce to 1.2.3.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Master Addons for Elementor: Does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX actionCVE-2022-0327 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting
- Product
- Master Addons for Elementor
- Fixed in
- 1.8.5
- What to do
- Update Master Addons for Elementor to 1.8.5 or newer.
Mar 14, 2022WP Voting Contest: Does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
- Product
- WP Voting Contest
- Fixed in
- 3.0
- What to do
- Update WP Voting Contest to 3.0 or newer.
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
- Product
- WordPress Zero Spam
- Fixed in
- 5.2.11
- What to do
- Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
- Product
- Contact Form Submissions
- Fixed in
- 1.7.3
- What to do
- Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Better WordPress Google XML Sitemaps: Does not sanitise and escape its logsCVE-2022-0230 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
- Product
- Better WordPress Google XML Sitemaps
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Better WordPress Google XML Sitemaps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Photo Gallery by 10Web: Does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated userCVE-2022-0169 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.0
- What to do
- Update Photo Gallery by 10Web to 1.6.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX actCVE-2022-0165 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
- Product
- Page Builder KingComposer
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update Page Builder KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.