Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,328 results · page 15 of 27
Sep 25, 2023Popup Builder: Does not sanitise and escape some of its settingsCVE-2023-3226 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Popup Builder
- Fixed in
- 4.2.0
- What to do
- Update Popup Builder to 4.2.0 or newer.
Sep 19, 2023Serial Codes Generator and Validator with WooCommerce Support: Does not sanitise and escape some of its settingsCVE-2023-4376 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Serial Codes Generator and Validator with WooCommerce Support
- Fixed in
- 2.4.15
- What to do
- Update Serial Codes Generator and Validator with WooCommerce Support to 2.4.15 or newer.
Sep 19, 2023Leyka: Does not sanitise and escape some of its settingsCVE-2023-2995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Leyka
- Fixed in
- 3.30.4
- What to do
- Update Leyka to 3.30.4 or newer.
Sep 12, 2023WP User Control: Unauthorized password resetsCVE-2023-4915 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (in the WP User Control Widget). The function changes the user's password after providing the email. The new password is only sent to the user's email, so the attacker does not have access to the new password.
- Product
- WP User Control
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update WP User Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 11, 2023WP Adminify: Does not sanitise and escape some of its settingsCVE-2023-4060 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Adminify
- Fixed in
- 3.1.6
- What to do
- Update WP Adminify to 3.1.6 or newer.
Sep 11, 2023Herd Effects: Does not sanitise and escape some of its settingsCVE-2023-4022 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Herd Effects
- Fixed in
- 5.2.3
- What to do
- Update Herd Effects to 5.2.3 or newer.
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settingsCVE-2023-3170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- tagDiv Composer
- Fixed in
- 4.2
- What to do
- Update tagDiv Composer to 4.2 or newer.
Sep 4, 2023123.chat: Does not sanitise and escape some of its settingsCVE-2023-4298 · WordPress plugins & themes · reported by WPScanMedium 4.8
The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- 123.chat
- Fixed in
- 1.3.1
- What to do
- Update 123.chat to 1.3.1 or newer.
Sep 4, 2023AI ChatBot: Does not sanitise and escape some of its settingsCVE-2023-4254 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- AI ChatBot
- Fixed in
- 4.7.8
- What to do
- Update AI ChatBot to 4.7.8 or newer.
Sep 4, 2023AI ChatBot: Does not sanitise and escape some of its settingsCVE-2023-4253 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- AI ChatBot
- Fixed in
- 4.7.8
- What to do
- Update AI ChatBot to 4.7.8 or newer.
Sep 4, 2023Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2023-3499 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.16
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.16 or newer.
Aug 31, 2023CHP Ads Block Detector: Unauthorized plugin settings update and resetCVE-2023-2353 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd_action function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to change or reset plugin settings. CVE-2023-36509 appears to be a duplicate of this issue.
- Product
- CHP Ads Block Detector
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update CHP Ads Block Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2023FormCraft: Does not sanitise and escape some of its settingsCVE-2023-3501 · WordPress plugins & themes · reported by WPScanMedium 4.8
The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- FormCraft
- Fixed in
- 1.2.7
- What to do
- Update FormCraft to 1.2.7 or newer.
Aug 30, 2023Front Editor: Does not sanitize and escape some of its form settingsCVE-2023-1982 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Front Editor
- Affected
- up to 4.0.4
- What to do
- Affects up to 4.0.4. Update Front Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2023Bit Assist: Does not sanitise and escape some of its settingsCVE-2023-3667 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Bit Assist
- Fixed in
- 1.1.9
- What to do
- Update Bit Assist to 1.1.9 or newer.
Aug 16, 2023Ko-fi Button: Does not properly some of its settingsCVE-2023-2254 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we consider it a low risk.
- Product
- Ko-fi Button
- Fixed in
- 1.3.3
- What to do
- Update Ko-fi Button to 1.3.3 or newer.
Aug 16, 2023SEO ALert: Does not sanitise and escape some of its settingsCVE-2023-2225 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SEO ALert
- Affected
- up to 1.59
- What to do
- Affects up to 1.59. Update SEO ALert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 14, 2023WP-EMail: Does not sanitise and escape some of its settingsCVE-2023-3721 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP-EMail
- Fixed in
- 2.69.1
- What to do
- Update WP-EMail to 2.69.1 or newer.
Aug 14, 2023Contact Form Builder by Bit Form: Does not sanitise and escape some of its settingsCVE-2023-3645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Contact Form Builder by Bit Form
- Fixed in
- 2.2.0
- What to do
- Update Contact Form Builder by Bit Form to 2.2.0 or newer.
Aug 14, 2023Custom Field For WP Job Manager: Does not sanitise and escape some of its settingsCVE-2023-3328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Custom Field For WP Job Manager
- Fixed in
- 1.2
- What to do
- Update Custom Field For WP Job Manager to 1.2 or newer.
Aug 14, 2023Ultimate Addons for Contact Form 7: Does not sanitise and escape some of its settingsCVE-2023-2802 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Addons for Contact Form 7
- Fixed in
- 3.1.29
- What to do
- Update Ultimate Addons for Contact Form 7 to 3.1.29 or newer.
Aug 14, 2023WP Brutal AI: Does not sanitise and escape some of its settingsCVE-2023-2606 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Brutal AI
- Fixed in
- 2.06
- What to do
- Update WP Brutal AI to 2.06 or newer.
Aug 7, 2023Bubble Menu: Does not sanitize and escape some of its settingsCVE-2023-3650 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Bubble Menu
- Fixed in
- 3.0.5
- What to do
- Update Bubble Menu to 3.0.5 or newer.
Aug 7, 2023WP Food Manager: Does not sanitise and escape some of its settingsCVE-2023-0604 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Food Manager
- Fixed in
- 1.0.4
- What to do
- Update WP Food Manager to 1.0.4 or newer.
Jul 31, 2023Short URL: Does not sanitise and escape some of its settingsCVE-2023-3130 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Short URL
- Fixed in
- 1.6.5
- What to do
- Update Short URL to 1.6.5 or newer.
Jul 24, 2023Auto Location for WP Job Manager via Google: Does not sanitise and escape some of its settingsCVE-2023-3344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Auto Location for WP Job Manager via Google
- Fixed in
- 1.1
- What to do
- Update Auto Location for WP Job Manager via Google to 1.1 or newer.
Jul 24, 2023All-in-one Floating Contact Form: Does not sanitise and escape some of its settingsCVE-2023-3248 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- All-in-one Floating Contact Form
- Fixed in
- 2.1.2
- What to do
- Update All-in-one Floating Contact Form to 2.1.2 or newer.
Jul 17, 2023Floating Chat Widget: Does not sanitise and escape some of its settingsCVE-2023-3245 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Chat Widget
- Fixed in
- 3.1.2
- What to do
- Update Floating Chat Widget to 3.1.2 or newer.
Jul 17, 2023InventoryPress: Does not sanitise and escape some of its settingsCVE-2023-2579 · WordPress plugins & themes · reported by WPScanMedium 5.4
The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
- Product
- InventoryPress
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update InventoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2023WP-Members Membership: Unauthorized plugin settings updateCVE-2023-2869 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorder form elements on login forms.
- Product
- WP-Members Membership
- Affected
- up to 3.4.7.3
- What to do
- Affects up to 3.4.7.3. Update WP-Members Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 10, 2023Float menu: Does not sanitise and escape some of its settingsCVE-2023-3225 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Float menu
- Fixed in
- 5.0.3
- What to do
- Update Float menu to 5.0.3 or newer.
Jul 10, 2023AI ChatBot: Does not adequately escape some settingsCVE-2023-3175 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- AI ChatBot
- Fixed in
- 4.6.1
- What to do
- Update AI ChatBot to 4.6.1 or newer.
Jul 10, 2023URL Shortify: Does not sanitise and escape some of its settingsCVE-2023-3129 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- URL Shortify
- Fixed in
- 1.7.0
- What to do
- Update URL Shortify to 1.7.0 or newer.
Jul 10, 2023TinyMCE Custom Styles: Does not sanitise and escape some of its settingsCVE-2023-2967 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- TinyMCE Custom Styles
- Fixed in
- 1.1.4
- What to do
- Update TinyMCE Custom Styles to 1.1.4 or newer.
Jul 10, 2023AN_GradeBook: Does not sanitise and escape some of its settingsCVE-2023-2709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AN_GradeBook
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023Call Now Accessibility Button: Does not sanitise and escape some of its settingsCVE-2023-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Call Now Accessibility Button
- Fixed in
- 1.1
- What to do
- Update Call Now Accessibility Button to 1.1 or newer.
Jul 10, 2023Buy Me a Coffee: Does not sanitise and escape some of its settingsCVE-2023-2578 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Buy Me a Coffee
- Fixed in
- 3.7
- What to do
- Update Buy Me a Coffee to 3.7 or newer.
Jul 10, 2023PrePost SEO: Does not properly sanitize some of its settingsCVE-2023-2029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PrePost SEO
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update PrePost SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 10, 2023Call Now Accessibility Button: Does not properly sanitize some of its settingsCVE-2023-2028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Call Now Accessibility Button
- Fixed in
- 1.1
- What to do
- Update Call Now Accessibility Button to 1.1 or newer.
Jul 10, 2023Image Protector: Does not properly sanitize some of its settingsCVE-2023-2026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Protector
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Image Protector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 1, 2023Import / Export Customizer Settings: Cross-Site Request ForgeryCVE-2020-36737 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the astra_admin_errors() function. This makes it possible for unauthenticated attackers to display an import status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Import / Export Customizer Settings
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Import / Export Customizer Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 27, 2023CodeColorer: Does not sanitise and escape some of its settingsCVE-2023-2795 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CodeColorer
- Fixed in
- 0.10.1
- What to do
- Update CodeColorer to 0.10.1 or newer.
Jun 27, 2023Ultimate Product Catalog: Does not sanitise and escape some of its settingsCVE-2023-2711 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Product Catalog
- Fixed in
- 5.2.6
- What to do
- Update Ultimate Product Catalog to 5.2.6 or newer.
Jun 27, 2023AI Engine: Does not sanitize and escape some of its settingsCVE-2023-2580 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- AI Engine
- Fixed in
- 1.6.83
- What to do
- Update AI Engine to 1.6.83 or newer.
Jun 27, 2023Aajoda Testimonials: Does not sanitise and escape some of its settingsCVE-2023-2178 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Aajoda Testimonials
- Fixed in
- 2.2.2
- What to do
- Update Aajoda Testimonials to 2.2.2 or newer.
Jun 27, 2023USM-Premium: Does not sanitize and escape some of its settingsCVE-2023-1166 · WordPress plugins & themes · reported by WPScanMedium 4.8
The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- USM-Premium
- Fixed in
- 16.3
- What to do
- Update USM-Premium to 16.3 or newer.
Jun 27, 2023Kanban Boards for: Does not sanitise and escape some of its settingsCVE-2023-0873 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Kanban Boards for
- Fixed in
- 2.5.21
- What to do
- Update Kanban Boards for to 2.5.21 or newer.
Jun 27, 2023Editorial Calendar: Does not sanitise and escape its settingsCVE-2022-4115 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.
- Product
- Editorial Calendar
- Fixed in
- 3.8.3
- What to do
- Update Editorial Calendar to 3.8.3 or newer.
Jun 19, 2023Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2023-2812 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Dashboard
- Fixed in
- 3.7.6
- What to do
- Update Ultimate Dashboard to 3.7.6 or newer.
Jun 19, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-2811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks to all admin when setting chatbot and all client when using chatbot
- Product
- AI ChatBot
- Fixed in
- 4.5.6
- What to do
- Update AI ChatBot to 4.5.6 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.