Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

364new WordPress flaws this week

393,576entries in the database

10,182 results · page 183 of 204

Apr 7, 2023Unauth.CVE-2023-25713 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
Fixed in
5.7.26
What to do
Update the plugin to 5.7.26 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25712 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-Buddy Google Analytics Opt-Out plugin <= 2.3.4 versions.
Fixed in
2.3.5
What to do
Update the plugin to 2.3.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-25711 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPGlobus WPGlobus Translate Options plugin <= 2.1.0 versions.
Fixed in
2.2.0
What to do
Update the plugin to 2.2.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25705 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Go Prayer WP Prayer plugin <= 1.9.6 versions.
Fixed in
1.9.7
What to do
Update the plugin to 1.9.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25702 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
Fixed in
5.7.26
What to do
Update the plugin to 5.7.26 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25464 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StreamWeasels Twitch Player plugin <= 2.1.0 versions.
Fixed in
2.1.1
What to do
Update the plugin to 2.1.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-29236 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions.
Fixed in
3.9.7
What to do
Update the plugin to 3.9.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-28993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On Line plugin <= 4.6.1 versions.
Fixed in
4.6.2
What to do
Update the plugin to 4.6.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions.CVE-2023-25716 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions.
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25049 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.4 versions.
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-25041 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Monolit theme <= 2.0.6 versions.
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25031 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1 versions.
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-25020 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.
Affected
up to 2.7.1.1
What to do
Affects up to 2.7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-23994 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcel Bootsman Auto Hide Admin Bar plugin <= 1.6.1 versions.
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-23885 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.
Affected
up to 8.0.3.1
What to do
Affects up to 8.0.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25027 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Chained Quiz plugin <= 1.3.2.5 versions.
Affected
up to 1.3.2.5
What to do
Affects up to 1.3.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25024 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Icegram Icegram Collect plugin <= 1.3.8 versions.
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25023 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saleswonder.Biz Webinar ignition plugin <= 2.14.2 versions.
Affected
up to 2.14.2
What to do
Affects up to 2.14.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25022 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.8 versions.
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25046 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.2 versions.
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-24398 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Snap Creek Software EZP Coming Soon Page plugin <= 1.0.7.3 versions.
Affected
up to 1.0.7.3
What to do
Affects up to 1.0.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25061 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.
Affected
up to 2.7.1.1
What to do
Affects up to 2.7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25059 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in avalex GmbH avalex – Automatically secure legal texts plugin <= 3.0.3 versions.
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-24402 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Veribo, Roland Murg WP Booking System – Booking Calendar plugin <= 2.0.18 versions.
Affected
up to 2.0.18
What to do
Affects up to 2.0.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023WP Fastest Cache: Unauthorized data lossCVE-2023-1931 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the deleteCssAndJsCacheToolbar function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers with subscriber-level access to perform cache deletion.
Product
WP Fastest Cache
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 6, 2023WP Fastest Cache: Unauthorized data deletionCVE-2023-1930 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the wpfc_clear_cache_of_allsites_callback function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers with subscriber-level access to delete caches.
Product
WP Fastest Cache
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 6, 2023WP Fastest Cache: Unauthorized data modificationCVE-2023-1929 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_purgecache_varnish_callback function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers with subscriber-level access to purge the varnish cache.
Product
WP Fastest Cache
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 6, 2023WP Fastest Cache: Unauthorized data modificationCVE-2023-1928 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the wpfc_preload_single_callback function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers with subscriber-level access to initiate cache creation.
Product
WP Fastest Cache
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 6, 2023Auth.CVE-2023-25062 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PINPOINT.WORLD Pinpoint Booking System plugin <= 2.9.9.2.8 versions.
Fixed in
2.9.9.2.9
What to do
Update the plugin to 2.9.9.2.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023E4J s.R.L: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-24396 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.11 versions.
Product
E4J s.R.L
Fixed in
1.5.12
What to do
Update E4J s.R.L to 1.5.12 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24378 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Codeat Glossary plugin <= 2.1.27 versions.
Fixed in
2.1.28
What to do
Update the plugin to 2.1.28 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24374 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.
Fixed in
1.4.3
What to do
Update the plugin to 1.4.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023OceanWP Ocean Extra plugin <= 2.1.1 versions: Auth. (contributor+) Stored Cross-Site Scripting (XSS)CVE-2023-23891 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated.
Product
OceanWP Ocean Extra plugin <= 2.1.1 versions
Fixed in
2.1.2
What to do
Update OceanWP Ocean Extra plugin <= 2.1.1 versions to 2.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24411 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kerry Kline BNE Testimonials plugin <= 2.0.7 versions.
Fixed in
2.0.8
What to do
Update the plugin to 2.0.8 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24403 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP For The Win bbPress Voting plugin <= 2.1.11.0 versions.
Fixed in
2.1.11.1
What to do
Update the plugin to 2.1.11.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24387 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Organization chart plugin <= 1.4.4 versions.
Fixed in
1.4.5
What to do
Update the plugin to 1.4.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24383 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Namaste! LMS plugin <= 2.5.9.1 versions.
Fixed in
2.5.9.2
What to do
Update the plugin to 2.5.9.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-23898 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeThemes Blocksy Companion plugin <= 1.8.67 versions.
Fixed in
1.8.68
What to do
Update the plugin to 1.8.68 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24004 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart Image and Video Lightbox, Image PopUp plugin <= 2.1.5 versions.
Fixed in
2.1.6
What to do
Update the plugin to 2.1.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24003 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Timersys WP Popups – WordPress Popup plugin <= 2.1.4.8 versions.
Fixed in
2.1.4.9
What to do
Update the plugin to 2.1.4.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24002 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPdevart YouTube Embed, Playlist and Popup by WpDevArt plugin <= 2.6.3 versions.
Fixed in
2.6.4
What to do
Update the plugin to 2.6.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24006 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Link Software LLC WP Terms Popup plugin <= 2.6.0 versions.
Fixed in
2.6.1
What to do
Update the plugin to 2.6.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-24001 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yannick Lefebvre Modal Dialog plugin <= 3.5.9 versions.
Fixed in
3.5.10
What to do
Update the plugin to 3.5.10 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023E4J s.R.L: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23998 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin <= 1.3.0 versions.
Product
E4J s.R.L
Fixed in
1.3.1
What to do
Update E4J s.R.L to 1.3.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-23996 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.3 versions.
Fixed in
4.5.4
What to do
Update the plugin to 4.5.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-23980 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MailOptin Popup Builder Team MailOptin plugin <= 1.2.54.0 versions.
Fixed in
1.2.54.1
What to do
Update the plugin to 1.2.54.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-23987 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPEverest User Registration plugin <= 2.3.0 versions.
Fixed in
2.3.1
What to do
Update the plugin to 2.3.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Unauth.CVE-2023-23979 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 versions.
Fixed in
9.7.5
What to do
Update the plugin to 9.7.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-23972 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smplug-in Social Like Box and Page by WpDevArt plugin <= 0.8.39 versions.
Affected
up to 0.8.39
What to do
Affects up to 0.8.39. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-23971 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodePeople WP Time Slots Booking Form plugin <= 1.1.81 versions.
Affected
up to 1.1.81
What to do
Affects up to 1.1.81. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.