Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,207 results · page 17 of 25
Feb 6, 2023WP Blog and Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4824 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Blog and Widgets
- Fixed in
- 2.3.1
- What to do
- Update WP Blog and Widgets to 2.3.1 or newer.
Feb 6, 2023Materialis Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4762 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Materialis Companion
- Fixed in
- 1.3.40
- What to do
- Update Materialis Companion to 1.3.40 or newer.
Feb 6, 2023My YouTube Channel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4756 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- My YouTube Channel
- Fixed in
- 3.23.0
- What to do
- Update My YouTube Channel to 3.23.0 or newer.
Feb 6, 2023Post Category Image With Grid and Slider: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4747 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Post Category Image With Grid and Slider
- Fixed in
- 1.4.8
- What to do
- Update Post Category Image With Grid and Slider to 1.4.8 or newer.
Feb 6, 2023Strong Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4717 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Strong Testimonials
- Fixed in
- 3.0.3
- What to do
- Update Strong Testimonials to 3.0.3 or newer.
Feb 6, 2023Leaflet Maps Marker: Does not validate and escape one of its shortcode attributesCVE-2022-4677 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Leaflet Maps Marker
- Fixed in
- 3.12.7
- What to do
- Update Leaflet Maps Marker to 3.12.7 or newer.
Feb 6, 2023Ibtana: Does not validate and escape one of its shortcode attributesCVE-2022-4674 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
- Product
- Ibtana
- Fixed in
- 1.1.8.8
- What to do
- Update Ibtana to 1.1.8.8 or newer.
Feb 6, 2023PDF.js Viewer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- PDF.js Viewer
- Fixed in
- 2.1.8
- What to do
- Update PDF.js Viewer to 2.1.8 or newer.
Feb 6, 2023Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4664 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 3.6.0
- What to do
- Update Logo Slider to 3.6.0 or newer.
Feb 6, 2023Restaurant Menu: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4657 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Restaurant Menu
- Fixed in
- 2.3.6
- What to do
- Update Restaurant Menu to 2.3.6 or newer.
Feb 6, 2023PPWP: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- PPWP
- Fixed in
- 1.8.6
- What to do
- Update PPWP to 1.8.6 or newer.
Feb 6, 2023Easy Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Testimonials
- Fixed in
- 3.9.3
- What to do
- Update Easy Testimonials to 3.9.3 or newer.
Feb 6, 2023WP Show Posts: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4459 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Show Posts
- Fixed in
- 1.1.4
- What to do
- Update WP Show Posts to 1.1.4 or newer.
Jan 30, 2023Post Grid, Post Carousel, & List Category Posts: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0097 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Post Grid, Post Carousel, & List Category Posts
- Fixed in
- 2.4.19
- What to do
- Update Post Grid, Post Carousel, & List Category Posts to 2.4.19 or newer.
Jan 30, 2023WP Social Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0074 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Social Widget
- Fixed in
- 2.2.4
- What to do
- Update WP Social Widget to 2.2.4 or newer.
Jan 30, 2023WP Tabs: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0071 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Tabs
- Fixed in
- 2.1.17
- What to do
- Update WP Tabs to 2.1.17 or newer.
Jan 30, 2023PDF Viewer: Does not validate and escape one of its shortcode attributesCVE-2023-0033 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- PDF Viewer
- Fixed in
- 1.0.0
- What to do
- Update PDF Viewer to 1.0.0 or newer.
Jan 30, 2023CPO Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- CPO Companion
- Fixed in
- 1.1.0
- What to do
- Update CPO Companion to 1.1.0 or newer.
Jan 30, 2023Social Sharing Toolkit: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4835 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Sharing Toolkit
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Social Sharing Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023CPT Bootstrap Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4834 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- CPT Bootstrap Carousel
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update CPT Bootstrap Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023Custom User Profile Fields for User Registration: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4831 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Custom User Profile Fields for User Registration
- Fixed in
- 1.8.1
- What to do
- Update Custom User Profile Fields for User Registration to 1.8.1 or newer.
Jan 30, 2023Bold Timeline Lite: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4828 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Bold Timeline Lite
- Fixed in
- 1.1.5
- What to do
- Update Bold Timeline Lite to 1.1.5 or newer.
Jan 30, 2023Blog Designer: Does not validate and escape one of its shortcode attributesCVE-2022-4793 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Blog Designer
- Fixed in
- 2.4.1
- What to do
- Update Blog Designer to 2.4.1 or newer.
Jan 30, 2023News & Blog Designer Pack: Does not validate and escape one of its shortcode attributesCVE-2022-4792 · WordPress plugins & themes · reported by WPScanMedium 5.4
The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- News & Blog Designer Pack
- Fixed in
- 3.3
- What to do
- Update News & Blog Designer Pack to 3.3 or newer.
Jan 30, 2023Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as conCVE-2022-4787 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Fixed in
- 2.0.8
- What to do
- Update the plugin to 2.0.8 or newer.
Jan 30, 2023Accordion Shortcodes: Does not validate and escape one of its shortcode attributesCVE-2022-4781 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Accordion Shortcodes WordPress plugin through 2.4.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Accordion Shortcodes
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Accordion Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023CC Child Pages: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4776 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- CC Child Pages
- Fixed in
- 1.43
- What to do
- Update CC Child Pages to 1.43 or newer.
Jan 30, 2023Portfolio for Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Portfolio for Elementor
- Fixed in
- 2.3.1
- What to do
- Update Portfolio for Elementor to 2.3.1 or newer.
Jan 30, 2023Icon Widget: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4763 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Icon Widget
- Fixed in
- 1.3.0
- What to do
- Update Icon Widget to 1.3.0 or newer.
Jan 30, 2023Posts List Designer by Category: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4749 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Posts List Designer by Category
- Fixed in
- 3.2
- What to do
- Update Posts List Designer by Category to 3.2 or newer.
Jan 30, 2023MediaElement.js: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4699 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
- Product
- MediaElement.js
- Affected
- up to 4.2.8
- What to do
- Affects up to 4.2.8. Update MediaElement.js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023PixCodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- PixCodes
- Fixed in
- 2.3.7
- What to do
- Update PixCodes to 2.3.7 or newer.
Jan 30, 2023RSS Aggregator by Feedzy: Does not validate and escape some of its block options before outputting them back in the pageCVE-2022-4667 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- RSS Aggregator by Feedzy
- Fixed in
- 4.1.1
- What to do
- Update RSS Aggregator by Feedzy to 4.1.1 or newer.
Jan 30, 2023Pricing Tables: Does not validate and escape one of its shortcode attributesCVE-2022-4654 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Pricing Tables
- Fixed in
- 3.2.3
- What to do
- Update Pricing Tables to 3.2.3 or newer.
Jan 30, 2023Justified Gallery: Does not validate and escape one of its shortcode attributesCVE-2022-4651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Justified Gallery
- Fixed in
- 1.7.1
- What to do
- Update Justified Gallery to 1.7.1 or newer.
Jan 30, 2023WP Extended Search: Does not validate and escape one of its shortcode attributesCVE-2022-4649 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- WP Extended Search
- Fixed in
- 2.1.2
- What to do
- Update WP Extended Search to 2.1.2 or newer.
Jan 30, 2023Simple Sitemap: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4472 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Simple Sitemap
- Fixed in
- 3.5.8
- What to do
- Update Simple Sitemap to 3.5.8 or newer.
Jan 30, 2023Widgets for Google Reviews: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4470 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Widgets for Google Reviews
- Fixed in
- 9.8
- What to do
- Update Widgets for Google Reviews to 9.8 or newer.
Jan 30, 2023Membership For WooCommerce: Does not validate uploaded filesCVE-2022-4395 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE.
- Product
- Membership For WooCommerce
- Fixed in
- 2.1.7
- What to do
- Update Membership For WooCommerce to 2.1.7 or newer.
Full record and what to do →NVD recordwpscan.compacketstormsecurity.com
Jan 23, 2023Store Locator: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4832 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Store Locator
- Fixed in
- 1.4.9
- What to do
- Update Store Locator to 1.4.9 or newer.
Jan 23, 2023WP Google My Business Auto Publish: Does not validate and escape one of its shortcode attributesCVE-2022-4790 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- WP Google My Business Auto Publish
- Fixed in
- 3.4
- What to do
- Update WP Google My Business Auto Publish to 3.4 or newer.
Jan 23, 2023WPZOOM Portfolio: Does not validate and escape one of its shortcode attributesCVE-2022-4789 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- WPZOOM Portfolio
- Fixed in
- 1.2.2
- What to do
- Update WPZOOM Portfolio to 1.2.2 or newer.
Jan 23, 2023GeoDirectory: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4775 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- GeoDirectory
- Fixed in
- 2.2.22
- What to do
- Update GeoDirectory to 2.2.22 or newer.
Jan 23, 2023OneClick Chat to Order: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- OneClick Chat to Order
- Fixed in
- 1.0.4.2
- What to do
- Update OneClick Chat to Order to 1.0.4.2 or newer.
Jan 23, 202310WebMapBuilder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4758 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- 10WebMapBuilder
- Fixed in
- 1.0.72
- What to do
- Update 10WebMapBuilder to 1.0.72 or newer.
Jan 23, 2023Print-O-Matic: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4753 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Print-O-Matic
- Fixed in
- 2.1.8
- What to do
- Update Print-O-Matic to 2.1.8 or newer.
Jan 23, 2023Word Balloon: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4751 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Word Balloon
- Fixed in
- 4.19.3
- What to do
- Update Word Balloon to 4.19.3 or newer.
Jan 23, 2023Landing Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Landing Page Builder
- Fixed in
- 1.4.9.9
- What to do
- Update Landing Page Builder to 1.4.9.9 or newer.
Jan 23, 2023WP Popups: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Popups
- Fixed in
- 2.1.4.8
- What to do
- Update WP Popups to 2.1.4.8 or newer.
Jan 23, 2023Structured Content: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4715 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Structured Content
- Fixed in
- 1.5.1
- What to do
- Update Structured Content to 1.5.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.