Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,328 results · page 16 of 27
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statementCVE-2023-2805 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- SupportCandy
- Fixed in
- 3.1.7
- What to do
- Update SupportCandy to 3.1.7 or newer.
Jun 19, 2023AI ChatBot: Does not sanitize and escape its settingsCVE-2023-2742 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- AI ChatBot
- Fixed in
- 4.5.5
- What to do
- Update AI ChatBot to 4.5.5 or newer.
Jun 19, 2023File Renaming on Upload: Does not sanitise and escape some of its settingsCVE-2023-2684 · WordPress plugins & themes · reported by WPScanMedium 4.8
The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- File Renaming on Upload
- Fixed in
- 2.5.2
- What to do
- Update File Renaming on Upload to 2.5.2 or newer.
Jun 19, 2023Custom Base Terms: Does not sanitize and escape some of its settingsCVE-2023-2600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Custom Base Terms
- Fixed in
- 1.0.3
- What to do
- Update Custom Base Terms to 1.0.3 or newer.
Jun 19, 2023QuBot: Does not sanitise and escape some of its settingsCVE-2023-2401 · WordPress plugins & themes · reported by WPScanMedium 4.8
The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- QuBot
- Fixed in
- 1.1.6
- What to do
- Update QuBot to 1.1.6 or newer.
Jun 9, 2023The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up toCVE-2023-2767 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Affected
- up to 4.19.1
- What to do
- Affects up to 4.19.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2023Directorist: An arbitrary user password resetCVE-2023-1888 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of validation checks within login.php. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset the password of an arbitrary user and gain elevated (e.g., administrator) privileges.
- Product
- Directorist
- Affected
- up to 7.5.4
- What to do
- Affects up to 7.5.4. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 6, 2023WP Quick FrontEnd Editor: Setting ChangsCVE-2021-4371 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lacking both a security nonce and a capabilities check. This makes it possible for low-authenticated attackers to change plugin settings even when they do not have the capabilities to do so.
- Product
- WP Quick FrontEnd Editor
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update WP Quick FrontEnd Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Jun 6, 2023Frontend File Manager: Authenticated Settings ChangeCVE-2021-4368 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfm_save_settings AJAX action. This makes it possible for subscriber-level attackers to edit the plugin settings, such as the allowed upload file types. This can lead to remote code execution through other vulnerabilities.
- Product
- Frontend File Manager
- Affected
- up to 18.2
- What to do
- Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023Ultimate GDPR & CCPA: Unauthenticated settings import and exportCVE-2021-4348 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks such as redirecting visitors to malicious sites.
- Product
- Ultimate GDPR & CCPA
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Ultimate GDPR & CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023Flexible Checkout Fields for WooCommerce: Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site ScriptingCVE-2020-36731 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.
- Product
- Flexible Checkout Fields for WooCommerce
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Flexible Checkout Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023WPS Hide Login: Login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sitesCVE-2020-36710 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.
- Product
- WPS Hide Login
- Affected
- up to 1.5.4.2
- What to do
- Affects up to 1.5.4.2. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023Ultimate Addons for Gutenberg: Authenticated Settings ChangeCVE-2020-36702 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14.7. This is due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber+ roles to update the plugin's settings.
- Product
- Ultimate Addons for Gutenberg
- Affected
- up to 1.14.7
- What to do
- Affects up to 1.14.7. Update Ultimate Addons for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023Coming Soon Page & Maintenance Mode: Unauthenticated settings resetCVE-2019-25139 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php file which makes it possible for unauthenticated attackers to trigger a plugin settings reset.
- Product
- Coming Soon Page & Maintenance Mode
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Coming Soon Page & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 5, 2023Get your number: Does not sanitise and escape some of its settingsCVE-2023-2634 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Get your number WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Get your number
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Get your number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023SEO by 10Web: Does not sanitise and escape some of its settingsCVE-2023-2224 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SEO by 10Web
- Fixed in
- 1.2.7
- What to do
- Update SEO by 10Web to 1.2.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 5, 2023Hostel: Does not sanitise and escape some of its settingsCVE-2023-0545 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Hostel
- Fixed in
- 1.1.5.2
- What to do
- Update Hostel to 1.1.5.2 or newer.
May 30, 2023Add to Feedly: Does not sanitize and escape its settingsCVE-2023-2470 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Add to Feedly
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Add to Feedly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Login rebuilder: Does not sanitise and escape some of its settingsCVE-2023-2223 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login rebuilder
- Fixed in
- 2.8.1
- What to do
- Update Login rebuilder to 2.8.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2023Autoptimize: Does not sanitise and escape the settings imported from a previous exportCVE-2023-2113 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
- Product
- Autoptimize
- Fixed in
- 3.1.7
- What to do
- Update Autoptimize to 3.1.7 or newer.
May 30, 2023Newsletter Popup: Does not sanitise and escape some of its settingsCVE-2023-0733 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform SCVE-2023-2009 · WordPress plugins & themes · reported by WPScanMedium 4.8
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pretty Url
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some of its setting fieldsCVE-2023-1839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Product Addons & Fields for WooCommerce
- Fixed in
- 32.0.6
- What to do
- Update Product Addons & Fields for WooCommerce to 32.0.6 or newer.
May 15, 2023Ad Inserter: Unserializes user input provided via the settingsCVE-2023-1549 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Ad Inserter
- Fixed in
- 2.7.27
- What to do
- Update Ad Inserter to 2.7.27 or newer.
May 15, 2023BizLibrary: Does not sanitise and escape some of its settingsCVE-2023-0892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- BizLibrary
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update BizLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023AI ChatBot: Does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settingsCVE-2023-1651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS
- Product
- AI ChatBot
- Fixed in
- 4.4.9
- What to do
- Update AI ChatBot to 4.4.9 or newer.
May 8, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-1649 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- AI ChatBot
- Fixed in
- 4.5.1
- What to do
- Update AI ChatBot to 4.5.1 or newer.
May 8, 2023Customizer Export/Import: Unserializes user input provided via the settingsCVE-2023-1347 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Customizer Export/Import
- Fixed in
- 0.9.6
- What to do
- Update Customizer Export/Import to 0.9.6 or newer.
May 8, 2023AI ChatBot: Does not escape most of its settings before outputting them back in the dashboardCVE-2023-1011 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not have a proper CSRF check, allowing attackers to make a logged in admin set XSS payloads in them.
- Product
- AI ChatBot
- Fixed in
- 4.4.5
- What to do
- Update AI ChatBot to 4.4.5 or newer.
May 8, 2023Pickup | Delivery | Dine-in date time: Does not sanitise and escape some of its settingsCVE-2023-0894 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Pickup | Delivery | Dine-in date time
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Pickup | Delivery | Dine-in date time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023WP Login Box: Does not sanitise and escape some of its settingsCVE-2023-0544 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Login Box
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update WP Login Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2023SEOPress: Unserializes user input provided via the settingsCVE-2023-1669 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- SEOPress
- Fixed in
- 6.5.0.3
- What to do
- Update SEOPress to 6.5.0.3 or newer.
May 2, 2023WP Custom Author URL: Does not sanitise and escape some of its settingsCVE-2023-1614 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Custom Author URL
- Fixed in
- 1.0.5
- What to do
- Update WP Custom Author URL to 1.0.5 or newer.
May 2, 2023Quick Paypal Payments: Does not sanitise and escape some of its settingsCVE-2023-1554 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Quick Paypal Payments
- Fixed in
- 5.7.26.4
- What to do
- Update Quick Paypal Payments to 5.7.26.4 or newer.
May 2, 2023Site Reviews: Does not sanitise and escape some of its settingsCVE-2023-1525 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Site Reviews
- Fixed in
- 6.7.1
- What to do
- Update Site Reviews to 6.7.1 or newer.
May 2, 2023SMTP Mailing Queue: Does not sanitise and escape some of its settingsCVE-2023-1090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SMTP Mailing Queue
- Fixed in
- 2.0.1
- What to do
- Update SMTP Mailing Queue to 2.0.1 or newer.
May 2, 2023amr ical events lists: Does not sanitise and escape some of its settingsCVE-2023-1021 · WordPress plugins & themes · reported by WPScanMedium 4.8
The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- amr ical events lists
- Affected
- up to 6.6
- What to do
- Affects up to 6.6. Update amr ical events lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2023Profile Builder – User Profile & User Registration Forms: Unauthorized password resetsCVE-2023-2297 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Apr 10, 2023Simple Giveaways: Does not sanitise and escape some of its settingsCVE-2023-1121 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Giveaways
- Fixed in
- 2.45.1
- What to do
- Update Simple Giveaways to 2.45.1 or newer.
Apr 10, 2023Simple Giveaways: Does not sanitise and escape some of its settingsCVE-2023-1120 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Giveaways
- Fixed in
- 2.45.1
- What to do
- Update Simple Giveaways to 2.45.1 or newer.
Apr 10, 2023Time Sheets: Does not sanitise and escape some of its settingsCVE-2023-0893 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Time Sheets
- Fixed in
- 1.29.3
- What to do
- Update Time Sheets to 1.29.3 or newer.
Apr 10, 2023Klaviyo: Does not sanitize and escape some of its settingsCVE-2023-0874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Klaviyo
- Fixed in
- 3.0.10
- What to do
- Update Klaviyo to 3.0.10 or newer.
Apr 10, 2023Auto Rename Media On Upload: Does not sanitise and escape some of its settingsCVE-2023-0605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Auto Rename Media On Upload
- Fixed in
- 1.1.0
- What to do
- Update Auto Rename Media On Upload to 1.1.0 or newer.
Apr 10, 2023Article Directory: Does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panelCVE-2023-0422 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.
- Product
- Article Directory
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Article Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2023All-In-One Security (AIOS): Does not limit what log files to display in it's settings pagesCVE-2023-0156 · WordPress plugins & themes · reported by WPScanMedium 4.9
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.5
- What to do
- Update All-In-One Security (AIOS) to 5.1.5 or newer.
Mar 27, 2023Modern Events Calendar Lite: Does not sanitise and escape some of its settingsCVE-2023-1400 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.5.2
- What to do
- Update Modern Events Calendar Lite to 6.5.2 or newer.
Mar 27, 2023Simple File List: Does not sanitise and escape some of its settingsCVE-2023-1025 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple File List
- Fixed in
- 6.0.10
- What to do
- Update Simple File List to 6.0.10 or newer.
Mar 20, 2023ProfileGrid: Provides an AJAX endpoint for resetting a user password but does not implement proper authorizationCVE-2023-0940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
- Product
- ProfileGrid
- Fixed in
- 5.3.1
- What to do
- Update ProfileGrid to 5.3.1 or newer.
Mar 13, 2023Namaste! LMS: Does not sanitize and escape some of its settingsCVE-2023-0844 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Namaste! LMS
- Fixed in
- 2.6
- What to do
- Update Namaste! LMS to 2.6 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.