Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
984 results · page 17 of 20
Apr 10, 2023All-In-One Security (AIOS): Does not escape the content of log files before outputting it to the plugin admin pageCVE-2023-0157 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.5
- What to do
- Update All-In-One Security (AIOS) to 5.1.5 or newer.
Apr 10, 2023All-In-One Security (AIOS): Does not limit what log files to display in it's settings pagesCVE-2023-0156 · WordPress plugins & themes · reported by WPScanMedium 4.9
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.5
- What to do
- Update All-In-One Security (AIOS) to 5.1.5 or newer.
Mar 22, 2023The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] paraCVE-2023-28659 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action.
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 20, 2023VK All in One Expansion Unit: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2023-0937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- VK All in One Expansion Unit
- Fixed in
- 9.87.1.0
- What to do
- Update VK All in One Expansion Unit to 9.87.1.0 or newer.
Mar 20, 2023Custom Content Shortcode: Does not validate one of its shortcode attributeCVE-2023-0340 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
- Product
- Custom Content Shortcode
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification.CVE-2022-46806 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification.
- Fixed in
- 1.1.11
- What to do
- Update the plugin to 1.1.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leadsCVE-2022-46797 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leads to plugin settings change.
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change.CVE-2022-40198 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change.
- Affected
- up to 1.3.24
- What to do
- Affects up to 1.3.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 27, 2023VK All in One Expansion Unit: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0230 · WordPress plugins & themes · reported by WPScanMedium 5.4
The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- VK All in One Expansion Unit
- Fixed in
- 9.86.0.0
- What to do
- Update VK All in One Expansion Unit to 9.86.0.0 or newer.
Feb 24, 2023All in One SEO Pack: Stored Cross-Site ScriptingCVE-2023-0586 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- All in One SEO Pack
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update All in One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 24, 2023All in One SEO Pack: Stored Cross-Site ScriptingCVE-2023-0585 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- All in One SEO Pack
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update All in One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 21, 2023Product Slider and Carousel with Category for WooCommerce: Does not validate and escape one of its shortcode attributesCVE-2022-4791 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Product Slider and Carousel with Category for WooCommerce
- Fixed in
- 2.8
- What to do
- Update Product Slider and Carousel with Category for WooCommerce to 2.8 or newer.
Feb 21, 2023WP Dark Mode: Does not validate and escape one of its shortcode attributesCVE-2022-4714 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
- Product
- WP Dark Mode
- Fixed in
- 4.0.0
- What to do
- Update WP Dark Mode to 4.0.0 or newer.
Feb 13, 2023Pinpoint Booking System: Does not validate and escape one of its shortcode attributes before using it in a SQL statementCVE-2023-0220 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
- Product
- Pinpoint Booking System
- Fixed in
- 2.9.9.2.9
- What to do
- Update Pinpoint Booking System to 2.9.9.2.9 or newer.
Feb 13, 2023Customer Reviews for WooCommerce: Does not validate one of its shortcode attributeCVE-2023-0080 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
- Product
- Customer Reviews for WooCommerce
- Fixed in
- 5.16.0
- What to do
- Update Customer Reviews for WooCommerce to 5.16.0 or newer.
Feb 13, 2023WP Visitor Statistics (Real Time Traffic): Does not validate and escape one of its shortcode attributesCVE-2022-4656 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 6.5
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 6.5 or newer.
Feb 6, 2023Leaflet Maps Marker: Does not validate and escape one of its shortcode attributesCVE-2022-4677 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Leaflet Maps Marker
- Fixed in
- 3.12.7
- What to do
- Update Leaflet Maps Marker to 3.12.7 or newer.
Feb 6, 2023Ibtana: Does not validate and escape one of its shortcode attributesCVE-2022-4674 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
- Product
- Ibtana
- Fixed in
- 1.1.8.8
- What to do
- Update Ibtana to 1.1.8.8 or newer.
Feb 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions.CVE-2022-27628 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions.
- Affected
- 3.1 to 3.1
- What to do
- Affects 3.1 to 3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 2, 2023All-in-One WP Migration: Uses the wrong content typeCVE-2022-2546 · WordPress plugins & themes · reported by WPScanMedium 4.7
The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key
- Product
- All-in-One WP Migration
- Fixed in
- 7.63
- What to do
- Update All-in-One WP Migration to 7.63 or newer.
Jan 30, 2023PDF Viewer: Does not validate and escape one of its shortcode attributesCVE-2023-0033 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- PDF Viewer
- Fixed in
- 1.0.0
- What to do
- Update PDF Viewer to 1.0.0 or newer.
Jan 30, 2023Blog Designer: Does not validate and escape one of its shortcode attributesCVE-2022-4793 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Blog Designer
- Fixed in
- 2.4.1
- What to do
- Update Blog Designer to 2.4.1 or newer.
Jan 30, 2023News & Blog Designer Pack: Does not validate and escape one of its shortcode attributesCVE-2022-4792 · WordPress plugins & themes · reported by WPScanMedium 5.4
The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- News & Blog Designer Pack
- Fixed in
- 3.3
- What to do
- Update News & Blog Designer Pack to 3.3 or newer.
Jan 30, 2023Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as conCVE-2022-4787 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Fixed in
- 2.0.8
- What to do
- Update the plugin to 2.0.8 or newer.
Jan 30, 2023Accordion Shortcodes: Does not validate and escape one of its shortcode attributesCVE-2022-4781 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Accordion Shortcodes WordPress plugin through 2.4.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Accordion Shortcodes
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Accordion Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023Pricing Tables: Does not validate and escape one of its shortcode attributesCVE-2022-4654 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Pricing Tables
- Fixed in
- 3.2.3
- What to do
- Update Pricing Tables to 3.2.3 or newer.
Jan 30, 2023Justified Gallery: Does not validate and escape one of its shortcode attributesCVE-2022-4651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Justified Gallery
- Fixed in
- 1.7.1
- What to do
- Update Justified Gallery to 1.7.1 or newer.
Jan 30, 2023WP Extended Search: Does not validate and escape one of its shortcode attributesCVE-2022-4649 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- WP Extended Search
- Fixed in
- 2.1.2
- What to do
- Update WP Extended Search to 2.1.2 or newer.
Jan 23, 2023WP Google My Business Auto Publish: Does not validate and escape one of its shortcode attributesCVE-2022-4790 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- WP Google My Business Auto Publish
- Fixed in
- 3.4
- What to do
- Update WP Google My Business Auto Publish to 3.4 or newer.
Jan 23, 2023WPZOOM Portfolio: Does not validate and escape one of its shortcode attributesCVE-2022-4789 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- WPZOOM Portfolio
- Fixed in
- 1.2.2
- What to do
- Update WPZOOM Portfolio to 1.2.2 or newer.
Jan 23, 2023OneClick Chat to Order: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- OneClick Chat to Order
- Fixed in
- 1.0.4.2
- What to do
- Update OneClick Chat to Order to 1.0.4.2 or newer.
Jan 23, 2023Mongoose Page: Does not validate and escape one of its shortcode attributesCVE-2022-4675 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Mongoose Page
- Fixed in
- 1.9.0
- What to do
- Update Mongoose Page to 1.9.0 or newer.
Jan 23, 2023Rate my Post: Does not validate and escape one of its shortcode attributesCVE-2022-4673 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Rate my Post
- Fixed in
- 3.3.9
- What to do
- Update Rate my Post to 3.3.9 or newer.
Jan 23, 2023HashBar: Does not validate and escape one of its shortcode attributesCVE-2022-4650 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- HashBar
- Fixed in
- 1.3.6
- What to do
- Update HashBar to 1.3.6 or newer.
Jan 23, 2023All-In-One Security (AIOS): Leaked settings of the plugin publiclyCVE-2022-4346 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.3
- What to do
- Update All-In-One Security (AIOS) to 5.1.3 or newer.
Jan 20, 2023The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forCVE-2023-23492 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.
- Fixed in
- 1.4.2
- What to do
- Update the plugin to 1.4.2 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 16, 2023RSSImport: Does not validate and escape one of its shortcode attributesCVE-2022-4658 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- RSSImport
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update RSSImport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Welcart e-Commerce: Does not validate and escapes one of its shortcode attributesCVE-2022-4655 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.9
- What to do
- Update Welcart e-Commerce to 2.8.9 or newer.
Jan 16, 2023Greenshift: Does not validate and escape one of its shortcode attributesCVE-2022-4653 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Greenshift
- Fixed in
- 4.8.9
- What to do
- Update Greenshift to 4.8.9 or newer.
Jan 2, 2023Popup Maker: Does not validate and escape one of its shortcode attributesCVE-2022-4381 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Popup Maker
- Fixed in
- 1.16.9
- What to do
- Update Popup Maker to 1.16.9 or newer.
Jan 2, 2023Popup Maker: Does not validate and escape one of its shortcode attributesCVE-2022-4362 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Popup Maker
- Fixed in
- 1.16.9
- What to do
- Update Popup Maker to 1.16.9 or newer.
Jan 2, 2023All-in-One Addons for Elementor: Does not sanitise and escape some of its settingsCVE-2022-4256 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- All-in-One Addons for Elementor
- Fixed in
- 2.4.4
- What to do
- Update All-in-One Addons for Elementor to 2.4.4 or newer.
Dec 12, 2022All-In-One Security (AIOS): Is susceptible to IP Spoofing attacksCVE-2022-4097 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.0.8
- What to do
- Update All-In-One Security (AIOS) to 5.0.8 or newer.
Dec 5, 2022Clerk: Is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site optionsCVE-2022-3907 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operators to verify API keys against the ones stored in the site options.
- Product
- Clerk
- Fixed in
- 4.0.0
- What to do
- Update Clerk to 4.0.0 or newer.
Nov 22, 2022Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.CVE-2022-44737 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 8, 2022Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.CVE-2022-42494 · WordPress plugins & themes · reported by PatchstackLow 3
Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.
- Affected
- up to 4.2.5.1
- What to do
- Affects up to 4.2.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordaioseo.compatchstack.com
Oct 11, 2022Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at: Unauthenticated Options Change and Content InjectionCVE-2021-36913 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) AccessiBe.
- Product
- Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 3, 2022DSGVO All in one for WP: Does not sanitise and escape some of its settingsCVE-2022-2628 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DSGVO All in one for WP
- Fixed in
- 4.2
- What to do
- Update DSGVO All in one for WP to 4.2 or newer.
Sep 26, 2022Download Manager: Does not validate one of its settingsCVE-2022-2926 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory
- Product
- Download Manager
- Fixed in
- 3.2.55
- What to do
- Update Download Manager to 3.2.55 or newer.
Sep 9, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.CVE-2022-38093 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.
- Affected
- up to 4.2.3.1
- What to do
- Affects up to 4.2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.