Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,460entries in the database

9,124 results · page 167 of 183

Nov 29, 2022Simple:Press: Stored Cross-Site ScriptingCVE-2022-4028 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to inject arbitrary web scripts in pages when modifying a profile signature that will execute whenever a user accesses an injected page.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Simple:Press: Stored Cross-Site ScriptingCVE-2022-4027 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when responding to forum threads that will execute whenever a user accesses an injected page.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Photospace Gallery: Stored Cross-Site ScriptingCVE-2022-3991 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photospace Gallery
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Photospace Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022WP Affiliate Platform: Stored Cross-Site ScriptingCVE-2022-3897 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Affiliate Platform
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tipsandtricks-hq.com wordfence.com
Nov 29, 2022Ultimate Member: Directory traversalCVE-2022-3361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths using traversal (../../) to access and include files outside of the intended directory. If an attacker can successfully upload a php file then remote code execution via inclusion may also be possible. Note: for users with less than administrative capabilities, /wp-admin access needs to be enabled for that user in order for this to be exploitable by those users.
Product
Ultimate Member
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 28, 2022Checkout Field Editor (Checkout Manager) for WooCommerce: Unserializes user input provided via the settingsCVE-2022-3490 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Product
Checkout Field Editor (Checkout Manager) for WooCommerce
Fixed in
1.8.0
What to do
Update Checkout Field Editor (Checkout Manager) for WooCommerce to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 21, 2022WP-Polls: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1581 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
Product
WP-Polls
Fixed in
2.76.0
What to do
Update WP-Polls to 2.76.0 or newer.
Full record and what to do →NVD record wpscan.com hightechdad.com
Nov 18, 2022Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.CVE-2022-42497 · WordPress plugins & themes · reported by PatchstackCritical 10
Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.CVE-2022-41615 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.CVE-2022-42461 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.
Affected
up to 5.6.1
What to do
Affects up to 5.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.CVE-2022-38075 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
Affected
up to 0.13
What to do
Affects up to 0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.CVE-2022-41132 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 10, 2022Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.CVE-2022-42460 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPCVE-2022-41136 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.
Affected
up to 5.12.0
What to do
Affects up to 5.12.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.CVE-2022-40632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion.
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 7, 2022Complianz WordPress plugin before 6.3.4, and Complianz Premium: Allow a translators to inject arbitrary SQL through an unsanitized translationCVE-2022-3494 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.
Product
Complianz WordPress plugin before 6.3.4, and Complianz Premium
Fixed in
6.3.4
What to do
Update Complianz WordPress plugin before 6.3.4, and Complianz Premium to 6.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 3, 2022JumpDEMAND Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-44628 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.
Product
JumpDEMAND Inc
Affected
up to 0.2.17
What to do
Affects up to 0.2.17. Update JumpDEMAND Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Oct 28, 2022Web Stories: Server-Side Request ForgeryCVE-2022-3708 · WordPress plugins & themes · reported by WordfenceCritical 9.6
The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This makes it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
Web Stories
Affected
up to 1.24.0
What to do
Affects up to 1.24.0. Update Web Stories to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Oct 28, 2022Log HTTP Requests: Stored Cross-Site ScriptingCVE-2022-3402 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers who can trick a site's administrator into performing an action like clicking on a link, or an authenticated user with access to a page that sends a request using user-supplied data via the server, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Log HTTP Requests
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Log HTTP Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Oct 25, 2022WP All Export Pro: Does not limit some functionality during exports only to users with the Administrator roleCVE-2022-3394 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
Product
WP All Export Pro
Fixed in
1.7.9
What to do
Update WP All Export Pro to 1.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 17, 2022Passster: Stores the password inside a cookie named "passster" using base64 encoding methodCVE-2022-3206 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.
Product
Passster
Fixed in
3.5.5.5.2
What to do
Update Passster to 3.5.5.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 17, 2022Tutor LMS: Does not escape some course parametersCVE-2022-2563 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Tutor LMS
Fixed in
2.0.10
What to do
Update Tutor LMS to 2.0.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2022Download Monitor: Does not ensure that files to be downloaded are inside the blog foldersCVE-2022-2981 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
Product
Download Monitor
Fixed in
4.5.98
What to do
Update Download Monitor to 4.5.98 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2022WP 2FA: Uses comparison operators that don't mitigate time-based attacksCVE-2022-2891 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared.
Product
WP 2FA
Fixed in
2.3.0
What to do
Update WP 2FA to 2.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 30, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.CVE-2021-36839 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.
Affected
up to 4.73
What to do
Affects up to 4.73. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 30, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.CVE-2021-36830 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.
Affected
up to 0.8.0
What to do
Affects up to 0.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 26, 2022Ldap WP Login / Active Directory Integration: Does not have any authorisation and CSRF checksCVE-2022-2987 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication
Product
Ldap WP Login / Active Directory Integration
Fixed in
3.0.2
What to do
Update Ldap WP Login / Active Directory Integration to 3.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 26, 2022Restricted Site Access: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1613 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations.
Product
Restricted Site Access
Fixed in
7.3.2
What to do
Update Restricted Site Access to 7.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history.CVE-2022-38704 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history.
Affected
up to 8.9
What to do
Affects up to 8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress.CVE-2022-40215 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress.
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.CVE-2022-36417 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.
Affected
up to 3.8
What to do
Affects up to 3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.CVE-2022-40672 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.
Affected
up to 1.5.0
What to do
Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.CVE-2022-40195 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.CVE-2022-40193 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.CVE-2022-38460 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.CVE-2022-37342 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.CVE-2022-37328 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.CVE-2022-36791 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.CVE-2022-40213 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.
Affected
up to 1.9.6
What to do
Affects up to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Wordfence Security – Firewall & Malware Scan: Stored Cross-Site ScriptingCVE-2022-3144 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.
Product
Wordfence Security – Firewall & Malware Scan
Affected
up to 7.6.0
What to do
Affects up to 7.6.0. Update Wordfence Security – Firewall & Malware Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPressCVE-2022-38703 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress
Affected
up to 9.2
What to do
Affects up to 9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.CVE-2022-37339 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.CVE-2022-37338 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress.CVE-2022-37330 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress.
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Image Hover Effects Ultimate: Stored Cross-Site ScriptingCVE-2022-2937 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.
Product
Image Hover Effects Ultimate
Affected
up to 9.7.3
What to do
Affects up to 9.7.3. Update Image Hover Effects Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 21, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress.CVE-2022-36383 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress.
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 21, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Crossword plugin <= 1.1.10 at WordPress.CVE-2022-36365 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Crossword plugin <= 1.1.10 at WordPress.
Affected
up to 1.1.10
What to do
Affects up to 1.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 9, 2022Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.CVE-2022-40191 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 9, 2022Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.CVE-2022-38144 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 9, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.CVE-2022-38068 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.