Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,207 results · page 15 of 25
Feb 27, 2023Olevmedia Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0168 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Olevmedia Shortcodes WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Olevmedia Shortcodes
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Olevmedia Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Show-Hide / Collapse-Expand: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4829 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Show-Hide / Collapse-Expand
- Fixed in
- 1.3.0
- What to do
- Update Show-Hide / Collapse-Expand to 1.3.0 or newer.
Feb 27, 2023Galleries by Angie Makes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4795 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Galleries by Angie Makes WordPress plugin through 1.67 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Galleries by Angie Makes
- Affected
- up to 1.67
- What to do
- Affects up to 1.67. Update Galleries by Angie Makes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Embed PDF: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4788 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Embed PDF
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Embed PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023List Pages Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- List Pages Shortcode
- Fixed in
- 1.7.6
- What to do
- Update List Pages Shortcode to 1.7.6 or newer.
Feb 27, 2023Wufoo Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4679 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wufoo Shortcode WordPress plugin before 1.52 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Wufoo Shortcode
- Fixed in
- 1.52
- What to do
- Update Wufoo Shortcode to 1.52 or newer.
Feb 21, 2023GS Portfolio for Envato: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0559 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GS Portfolio for Envato
- Fixed in
- 1.4.0
- What to do
- Update GS Portfolio for Envato to 1.4.0 or newer.
Feb 21, 2023GS Books Showcase: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0541 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GS Books Showcase
- Fixed in
- 1.3.1
- What to do
- Update GS Books Showcase to 1.3.1 or newer.
Feb 21, 2023GS Filterable Portfolio: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0540 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GS Filterable Portfolio
- Fixed in
- 1.6.1
- What to do
- Update GS Filterable Portfolio to 1.6.1 or newer.
Feb 21, 2023GS Products Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0492 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GS Products Slider for WooCommerce
- Fixed in
- 1.5.9
- What to do
- Update GS Products Slider for WooCommerce to 1.5.9 or newer.
Feb 21, 2023Loan Comparison: Does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcodeCVE-2023-0442 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.
- Product
- Loan Comparison
- Fixed in
- 1.5.3
- What to do
- Update Loan Comparison to 1.5.3 or newer.
Feb 21, 2023Shortcode for Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0419 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Shortcode for Font Awesome
- Fixed in
- 1.4.1
- What to do
- Update Shortcode for Font Awesome to 1.4.1 or newer.
Feb 21, 2023Easy Digital Downloads: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0380 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Digital Downloads
- Fixed in
- 3.1.0.5
- What to do
- Update Easy Digital Downloads to 3.1.0.5 or newer.
Feb 21, 2023Greenshift: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0378 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Greenshift
- Fixed in
- 5.0
- What to do
- Update Greenshift to 5.0 or newer.
Feb 21, 2023Easy Affiliate Links: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embeddedCVE-2023-0375 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Affiliate Links
- Fixed in
- 3.7.1
- What to do
- Update Easy Affiliate Links to 3.7.1 or newer.
Feb 21, 2023EmbedStories: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0372 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EmbedStories WordPress plugin before 0.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- EmbedStories
- Fixed in
- 0.7.5
- What to do
- Update EmbedStories to 0.7.5 or newer.
Feb 21, 2023EmbedSocial: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0371 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- EmbedSocial
- Fixed in
- 1.1.28
- What to do
- Update EmbedSocial to 1.1.28 or newer.
Feb 21, 2023Loan Comparison: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0366 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Loan Comparison
- Fixed in
- 1.5.3
- What to do
- Update Loan Comparison to 1.5.3 or newer.
Feb 21, 2023WP Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Font Awesome
- Fixed in
- 1.7.9
- What to do
- Update WP Font Awesome to 1.7.9 or newer.
Feb 21, 2023ShopLentor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0231 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ShopLentor
- Fixed in
- 2.5.4
- What to do
- Update ShopLentor to 2.5.4 or newer.
Feb 21, 2023Timed Content: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Timed Content
- Fixed in
- 2.73
- What to do
- Update Timed Content to 2.73 or newer.
Feb 21, 2023Youzify: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0059 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Youzify
- Fixed in
- 1.2.2
- What to do
- Update Youzify to 1.2.2 or newer.
Feb 21, 2023Product Slider and Carousel with Category for WooCommerce: Does not validate and escape one of its shortcode attributesCVE-2022-4791 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Product Slider and Carousel with Category for WooCommerce
- Fixed in
- 2.8
- What to do
- Update Product Slider and Carousel with Category for WooCommerce to 2.8 or newer.
Feb 21, 2023Video.js: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4786 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video.js
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update Video.js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Video Sidebar Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4785 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video Sidebar Widgets
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Video Sidebar Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Hueman Addons: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4784 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Hueman Addons
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Hueman Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Bootstrap Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4777 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Bootstrap Shortcodes
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Bootstrap Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Simple File Downloader: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Simple File Downloader
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Simple File Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Post Views Count: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4761 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Post Views Count
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Post Views Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Easy Social Box / Page: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4754 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Easy Social Box / Page
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update Easy Social Box / Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Opening Hours: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4752 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Opening Hours
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Opening Hours to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023WP Responsive Testimonials Slider And Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4750 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Responsive Testimonials Slider And Widget
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WP Responsive Testimonials Slider And Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023WP Dark Mode: Does not validate and escape one of its shortcode attributesCVE-2022-4714 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
- Product
- WP Dark Mode
- Fixed in
- 4.0.0
- What to do
- Update WP Dark Mode to 4.0.0 or newer.
Feb 21, 2023Page Builder: Live Composer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4669 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Page Builder: Live Composer
- Fixed in
- 1.5.23
- What to do
- Update Page Builder: Live Composer to 1.5.23 or newer.
Feb 21, 2023Markup (JSON-LD) structured in schema.org: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4666 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Markup (JSON-LD) structured in schema.org
- Affected
- up to 4.8.1
- What to do
- Affects up to 4.8.1. Update Markup (JSON-LD) structured in schema.org to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Login Logout Menu: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4622 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Login Logout Menu
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Login Logout Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Intuitive Custom Post Order: Lacks CSRF protection in its update-menu-order ajax actionCVE-2022-4386 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack
- Product
- Intuitive Custom Post Order
- Fixed in
- 3.1.4
- What to do
- Update Intuitive Custom Post Order to 3.1.4 or newer.
Feb 21, 2023Intuitive Custom Post Order: Does not check for authorization in the update-menu-order ajax actionCVE-2022-4385 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order
- Product
- Intuitive Custom Post Order
- Fixed in
- 3.1.4
- What to do
- Update Intuitive Custom Post Order to 3.1.4 or newer.
Feb 13, 2023Spotlight Social Feeds: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0379 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Spotlight Social Feeds
- Fixed in
- 1.4.3
- What to do
- Update Spotlight Social Feeds to 1.4.3 or newer.
Feb 13, 2023Lightweight Accordion: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0373 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Lightweight Accordion
- Fixed in
- 1.5.15
- What to do
- Update Lightweight Accordion to 1.5.15 or newer.
Feb 13, 2023Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post whCVE-2023-0362 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Fixed in
- 1.2.2
- What to do
- Update the plugin to 1.2.2 or newer.
Feb 13, 2023Location Weather: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0360 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Location Weather
- Fixed in
- 1.3.4
- What to do
- Update Location Weather to 1.3.4 or newer.
Feb 13, 2023TemplatesNext ToolKit: Does not validate some of its shortcode attributes before using them to generate an HTML tagCVE-2023-0333 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- TemplatesNext ToolKit
- Fixed in
- 3.2.9
- What to do
- Update TemplatesNext ToolKit to 3.2.9 or newer.
Feb 13, 2023Easy Accept Payments for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0275 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Accept Payments for PayPal
- Fixed in
- 4.9.10
- What to do
- Update Easy Accept Payments for PayPal to 4.9.10 or newer.
Feb 13, 2023YaMaps for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0270 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- YaMaps for
- Fixed in
- 0.6.26
- What to do
- Update YaMaps for to 0.6.26 or newer.
Feb 13, 2023Pinpoint Booking System: Does not validate and escape one of its shortcode attributes before using it in a SQL statementCVE-2023-0220 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
- Product
- Pinpoint Booking System
- Fixed in
- 2.9.9.2.9
- What to do
- Update Pinpoint Booking System to 2.9.9.2.9 or newer.
Feb 13, 2023Social Like Box and Page by WpDevArt: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0177 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Social Like Box and Page by WpDevArt
- Fixed in
- 0.8.41
- What to do
- Update Social Like Box and Page by WpDevArt to 0.8.41 or newer.
Feb 13, 2023Zoho Forms: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0169 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Zoho Forms
- Fixed in
- 3.0.1
- What to do
- Update Zoho Forms to 3.0.1 or newer.
Feb 13, 2023Product Slider for WooCommerce by PickPlugins: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0166 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Product Slider for WooCommerce by PickPlugins
- Fixed in
- 1.13.42
- What to do
- Update Product Slider for WooCommerce by PickPlugins to 1.13.42 or newer.
Feb 13, 2023Extensive VC Addons for WPBakery page builder: Does not validate a parameter passed to the php extract functionCVE-2023-0159 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.
- Product
- Extensive VC Addons for WPBakery page builder
- Fixed in
- 1.9.1
- What to do
- Update Extensive VC Addons for WPBakery page builder to 1.9.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.