Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,207 results · page 18 of 25
Jan 23, 2023Genesis Columns Advanced: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4706 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
- Product
- Genesis Columns Advanced
- Fixed in
- 2.0.4
- What to do
- Update Genesis Columns Advanced to 2.0.4 or newer.
Jan 23, 2023Mongoose Page: Does not validate and escape one of its shortcode attributesCVE-2022-4675 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Mongoose Page
- Fixed in
- 1.9.0
- What to do
- Update Mongoose Page to 1.9.0 or newer.
Jan 23, 2023Rate my Post: Does not validate and escape one of its shortcode attributesCVE-2022-4673 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Rate my Post
- Fixed in
- 3.3.9
- What to do
- Update Rate my Post to 3.3.9 or newer.
Jan 23, 2023WordPress Simple Shopping Cart: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4672 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WordPress Simple Shopping Cart
- Fixed in
- 4.6.2
- What to do
- Update WordPress Simple Shopping Cart to 4.6.2 or newer.
Jan 23, 2023Easy Appointments: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4668 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Appointments
- Fixed in
- 3.11.2
- What to do
- Update Easy Appointments to 3.11.2 or newer.
Jan 23, 2023HashBar: Does not validate and escape one of its shortcode attributesCVE-2022-4650 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- HashBar
- Fixed in
- 1.3.6
- What to do
- Update HashBar to 1.3.6 or newer.
Jan 23, 2023Product Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4629 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Product Slider for WooCommerce
- Fixed in
- 2.6.4
- What to do
- Update Product Slider for WooCommerce to 2.6.4 or newer.
Jan 23, 2023ShiftNav: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- ShiftNav
- Fixed in
- 1.7.2
- What to do
- Update ShiftNav to 1.7.2 or newer.
Jan 23, 2023Login Logout Menu: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4625 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Login Logout Menu
- Fixed in
- 1.4.0
- What to do
- Update Login Logout Menu to 1.4.0 or newer.
Jan 23, 2023GS Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4624 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- GS Logo Slider
- Fixed in
- 3.3.8
- What to do
- Update GS Logo Slider to 3.3.8 or newer.
Jan 23, 2023Easy Bootstrap Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4576 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Bootstrap Shortcode
- Affected
- up to 4.5.4
- What to do
- Affects up to 4.5.4. Update Easy Bootstrap Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023Top 10: Does not validate and escape some of its Block attributes before outputting them back in the pageCVE-2022-4570 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Top 10
- Fixed in
- 3.2.3
- What to do
- Update Top 10 to 3.2.3 or newer.
Jan 23, 2023Sitemap: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4545 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Sitemap
- Fixed in
- 4.4
- What to do
- Update Sitemap to 4.4 or newer.
Jan 23, 2023Compact WP Audio Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4542 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Compact WP Audio Player
- Fixed in
- 1.9.8
- What to do
- Update Compact WP Audio Player to 1.9.8 or newer.
Jan 23, 2023Content Control: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.
- Product
- Content Control
- Fixed in
- 1.1.10
- What to do
- Update Content Control to 1.1.10 or newer.
Jan 23, 2023Page-list: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4485 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Page-list
- Fixed in
- 5.3
- What to do
- Update Page-list to 5.3 or newer.
Jan 23, 2023Collapse-O-Matic: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4475 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Collapse-O-Matic
- Fixed in
- 1.8.3
- What to do
- Update Collapse-O-Matic to 1.8.3 or newer.
Jan 23, 2023Easy Social Feed: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4474 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Easy Social Feed
- Fixed in
- 6.4.0
- What to do
- Update Easy Social Feed to 6.4.0 or newer.
Jan 23, 2023Search & Filter: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4467 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Search & Filter
- Fixed in
- 1.2.16
- What to do
- Update Search & Filter to 1.2.16 or newer.
Jan 16, 2023RSSImport: Does not validate and escape one of its shortcode attributesCVE-2022-4658 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- RSSImport
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update RSSImport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Welcart e-Commerce: Does not validate and escapes one of its shortcode attributesCVE-2022-4655 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.9
- What to do
- Update Welcart e-Commerce to 2.8.9 or newer.
Jan 16, 2023Greenshift: Does not validate and escape one of its shortcode attributesCVE-2022-4653 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Greenshift
- Fixed in
- 4.8.9
- What to do
- Update Greenshift to 4.8.9 or newer.
Jan 16, 2023Real Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4648 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Real Testimonials
- Fixed in
- 2.6.0
- What to do
- Update Real Testimonials to 2.6.0 or newer.
Jan 16, 2023Video Conferencing with Zoom: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4578 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Video Conferencing with Zoom
- Fixed in
- 4.0.10
- What to do
- Update Video Conferencing with Zoom to 4.0.10 or newer.
Jan 16, 2023Seriously Simple Podcasting: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Seriously Simple Podcasting
- Fixed in
- 2.19.1
- What to do
- Update Seriously Simple Podcasting to 2.19.1 or newer.
Jan 16, 2023MashShare: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- MashShare
- Fixed in
- 3.8.7
- What to do
- Update MashShare to 3.8.7 or newer.
Jan 16, 2023ConvertKit: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4508 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- ConvertKit
- Fixed in
- 2.0.5
- What to do
- Update ConvertKit to 2.0.5 or newer.
Jan 16, 2023Real Cookie Banner: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4507 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Real Cookie Banner
- Fixed in
- 3.4.10
- What to do
- Update Real Cookie Banner to 3.4.10 or newer.
Jan 16, 2023Easy Accordion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4487 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Accordion
- Fixed in
- 2.2.0
- What to do
- Update Easy Accordion to 2.2.0 or newer.
Jan 16, 2023Meteor Slides: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4486 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Meteor Slides
- Fixed in
- 1.5.7
- What to do
- Update Meteor Slides to 1.5.7 or newer.
Jan 16, 2023Social Share, Social Login and Social Comments: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4484 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.44
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.44 or newer.
Jan 16, 2023Insert Pages: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4483 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Insert Pages
- Fixed in
- 3.7.5
- What to do
- Update Insert Pages to 3.7.5 or newer.
Jan 16, 2023Carousel, Slider, Gallery by WP Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4482 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Carousel, Slider, Gallery by WP Carousel
- Fixed in
- 2.5.3
- What to do
- Update Carousel, Slider, Gallery by WP Carousel to 2.5.3 or newer.
Jan 16, 2023Mesmerize Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4481 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Mesmerize Companion
- Fixed in
- 1.6.135
- What to do
- Update Mesmerize Companion to 1.6.135 or newer.
Jan 16, 2023Click to Chat: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4480 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Click to Chat
- Fixed in
- 3.18.1
- What to do
- Update Click to Chat to 3.18.1 or newer.
Jan 16, 2023Font Awesome: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4478 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Font Awesome
- Fixed in
- 4.3.2
- What to do
- Update Font Awesome to 4.3.2 or newer.
Jan 16, 2023Smash Balloon Social Post Feed: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 4.1.6
- What to do
- Update Smash Balloon Social Post Feed to 4.1.6 or newer.
Jan 16, 2023Download Manager: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4476 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Download Manager
- Fixed in
- 3.2.62
- What to do
- Update Download Manager to 3.2.62 or newer.
Jan 16, 2023Simple Membership: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4469 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Simple Membership
- Fixed in
- 4.2.2
- What to do
- Update Simple Membership to 4.2.2 or newer.
Jan 16, 2023WP Video Lightbox: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4465 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- WP Video Lightbox
- Fixed in
- 1.9.7
- What to do
- Update WP Video Lightbox to 1.9.7 or newer.
Jan 16, 2023Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, whiCVE-2022-4464 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.
- Fixed in
- 1.2.1
- What to do
- Update the plugin to 1.2.1 or newer.
Jan 16, 2023Sidebar Widgets by CodeLights: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4460 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- Sidebar Widgets by CodeLights
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 20233D FlipBook: Does not validate or escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4453 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators.
- Product
- 3D FlipBook
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4451 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Sharing
- Fixed in
- 3.3.45
- What to do
- Update Social Sharing to 3.3.45 or newer.
Jan 16, 2023Page scroll to id: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4449 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Page scroll to id
- Fixed in
- 1.7.6
- What to do
- Update Page scroll to id to 1.7.6 or newer.
Jan 16, 2023WOOCS: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4431 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WOOCS
- Fixed in
- 1.3.9.4
- What to do
- Update WOOCS to 1.3.9.4 or newer.
Jan 16, 2023Images Optimize and Upload CF7: Does not validate the file to be deleted via an AJAX action available to unauthenticated usersCVE-2022-4101 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.
- Product
- Images Optimize and Upload CF7
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Images Optimize and Upload CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Jetpack CRM: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4497 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins
- Product
- Jetpack CRM
- Fixed in
- 5.5
- What to do
- Update Jetpack CRM to 5.5 or newer.
Jan 9, 2023WP-Table Reloaded: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4491 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.
- Product
- WP-Table Reloaded
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update WP-Table Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Table of Contents Plus: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4479 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Table of Contents Plus
- Fixed in
- 2212
- What to do
- Update Table of Contents Plus to 2212 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.