Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

103 results · page 2 of 3

Nov 19, 2024Awesome Fitness Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51806 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shingo Awesome Fitness Testimonials awesome-fitness-testimonials allows Stored XSS.This issue affects Awesome Fitness Testimonials: from n/a through <= 1.0.1.
Product
Awesome Fitness Testimonials
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Awesome Fitness Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Surbma | Font Awesome: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Font Awesome surbma-font-awesome allows DOM-Based XSS.This issue affects Surbma | Font Awesome: from n/a through <= 3.0.
Product
Surbma | Font Awesome
Affected
up to 3.0
What to do
Affects up to 3.0. Update Surbma | Font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Awesome Shortcodes For Genesis: Cross-Site Request Forgery (CSRF)CVE-2024-51638 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sanjeev Mohindra Awesome Shortcodes For Genesis awesome-shortcodes-for-genesis allows Stored XSS.This issue affects Awesome Shortcodes For Genesis: from n/a through 1.1.8.
Product
Awesome Shortcodes For Genesis
Affected
up to 1.1.8
What to do
Affects up to 1.1.8. Update Awesome Shortcodes For Genesis to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 19, 2024Awesome Progress Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50548 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abdullah Nahian Awesome Progress Bar awesome-progess-bar allows DOM-Based XSS.This issue affects Awesome Progress Bar: from n/a through <= 1.0.13.
Product
Awesome Progress Bar
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Awesome Progress Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 18, 2024Awesome Tool Tip: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52349 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md. Shiddikur Rahman Awesome Tool Tip awesome-tool-tip allows DOM-Based XSS.This issue affects Awesome Tool Tip: from n/a through <= 1.0.
Product
Awesome Tool Tip
Affected
up to 1.0
What to do
Affects up to 1.0. Update Awesome Tool Tip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 9, 2024AwesomePress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51616 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rupok AwesomePress awesomepress allows Stored XSS.This issue affects AwesomePress: from n/a through <= 1.0.
Product
AwesomePress
Affected
up to 1.0
What to do
Affects up to 1.0. Update AwesomePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Nov 1, 2024Demo Awesome: Missing AuthorizationCVE-2024-37207 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Theme4Press Demo Awesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Awesome: from n/a through 1.0.2.
Product
Demo Awesome
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Demo Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 26, 2024WP Awesome Login: Stored Cross-Site ScriptingCVE-2024-9456 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Awesome Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Product
WP Awesome Login
Affected
up to 0.4.0
What to do
Affects up to 0.4.0. Update WP Awesome Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 25, 2024Awesome buttons: Stored Cross-Site ScriptingCVE-2024-10148 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Awesome buttons
Affected
up to 1.0
What to do
Affects up to 1.0. Update Awesome buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Oct 17, 2024Awesome Contact Form7 for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49319 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B.M. Rafiul Alam Awesome Contact Form7 for Elementor awesome-contact-form7-for-elementor.This issue affects Awesome Contact Form7 for Elementor: from n/a through <= 3.0.
Product
Awesome Contact Form7 for Elementor
Affected
up to 3.0
What to do
Affects up to 3.0. Update Awesome Contact Form7 for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 22, 2024Demo Awesome: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37206 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme4Press Demo Awesome allows Reflected XSS.This issue affects Demo Awesome: from n/a through 1.0.1.
Product
Demo Awesome
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Demo Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2024Awesome Support: Missing AuthorizationCVE-2023-51537 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.5.
Product
Awesome Support
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Awesome Support: Missing AuthorizationCVE-2024-35741 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.
Product
Awesome Support
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Awesome Support: Missing AuthorizationCVE-2024-24716 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.6.
Product
Awesome Support
Affected
up to 6.1.6
What to do
Affects up to 6.1.6. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Awesome Support: Missing AuthorizationCVE-2024-30539 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.
Product
Awesome Support
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Awesome Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 8, 2024Block for Font Awesome: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35705 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ciprian Popescu Block for Font Awesome allows Stored XSS.This issue affects Block for Font Awesome: from n/a through 1.4.4.
Product
Block for Font Awesome
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Block for Font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 22, 2024Awesome Contact Form7 for Elementor: Stored Cross-Site ScriptingCVE-2024-4486 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Awesome Contact Form7 for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'AEP Contact Form 7' widget in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Awesome Contact Form7 for Elementor
Affected
up to 2.9
What to do
Affects up to 2.9. Update Awesome Contact Form7 for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 22, 2024WP Font Awesome Share Icons: Stored Cross-Site ScriptingCVE-2024-3198 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Font Awesome Share Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpfai_social' shortcode in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Font Awesome Share Icons
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Font Awesome Share Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 10, 2024Awesome Support – WordPress HelpDesk & Support: Unauthorized access of dataCVE-2024-0596 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the editor_html() function in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to view password protected and draft posts. CVE-2024-35741 is likely a duplicate of this issue.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 10, 2024Awesome Support – WordPress HelpDesk & Support: Unauthorized accessCVE-2024-0595 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpas_get_users() function hooked via AJAX in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve user data such as emails. CVE-2024-35741 is likely a duplicate of this issue.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 10, 2024Awesome Support – WordPress HelpDesk & Support: Union-based SQL InjectionCVE-2024-0594 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to union-based SQL Injection via the 'q' parameter of the wpas_get_users action in all versions up to, and including, 6.1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.1.7
What to do
Affects up to 6.1.7. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 16, 2024Font Awesome 4 Menus: Does not sanitise and escape some of its settingsCVE-2022-3829 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Font Awesome 4 Menus
Affected
up to 4.7.0
What to do
Affects up to 4.7.0. Update Font Awesome 4 Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 5, 2024Awesome Support – WordPress HelpDesk & Support: Cross-Site Request Forgery (CSRF)CVE-2023-51538 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.5.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.1.5
What to do
Affects up to 6.1.5. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 17, 2023Block for Font Awesome: Cross-Site Request Forgery (CSRF)CVE-2023-49751 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu Block for Font Awesome.This issue affects Block for Font Awesome: from n/a through 1.4.0.
Product
Block for Font Awesome
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Block for Font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Awesome Support – WordPress HelpDesk & Support: Cross-Site Request Forgery (CSRF)CVE-2023-48323 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross Site Request Forgery.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.4.
Product
Awesome Support – WordPress HelpDesk & Support
Affected
up to 6.1.4
What to do
Affects up to 6.1.4. Update Awesome Support – WordPress HelpDesk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Awesome Support: Does not sanitize file pathsCVE-2023-5355 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.
Product
Awesome Support
Fixed in
6.1.5
What to do
Update Awesome Support to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 6, 2023Awesome Support: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5354 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Awesome Support
Fixed in
6.1.5
What to do
Update Awesome Support to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 6, 2023Awesome Support: Does not correctly authorize the wpas_edit_reply functionCVE-2023-5352 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not have permission.
Product
Awesome Support
Fixed in
6.1.5
What to do
Update Awesome Support to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2023WP Font Awesome: Stored Cross-Site ScriptingCVE-2023-5127 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping on 'icon' user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Font Awesome
Affected
up to 1.7.9
What to do
Affects up to 1.7.9. Update WP Font Awesome to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions.CVE-2023-46151 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions.
Affected
up to 2.5
What to do
Affects up to 2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Alexey Golubnichenko AGP Font Awesome Collection plugin <= 3.2.4 versions.CVE-2023-45749 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Alexey Golubnichenko AGP Font Awesome Collection plugin <= 3.2.4 versions.
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 28, 2023Font Awesome Integration: Stored Cross-Site ScriptingCVE-2023-5233 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fawesome' shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Font Awesome Integration
Affected
up to 5.0
What to do
Affects up to 5.0. Update Font Awesome Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 28, 2023Font Awesome More Icons: Stored Cross-Site ScriptingCVE-2023-5232 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Font Awesome More Icons
Affected
up to 3.5
What to do
Affects up to 3.5. Update Font Awesome More Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 13, 2023Awesome Weather Widget: Stored Cross-Site ScriptingCVE-2023-4944 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Awesome Weather Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Awesome Weather Widget
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Awesome Weather Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 2, 2023Font Awesome 4 Menus: Stored Cross-Site ScriptingCVE-2023-4718 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Font Awesome 4 Menus
Affected
up to 4.7.0
What to do
Affects up to 4.7.0. Update Font Awesome 4 Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 21, 2023Shortcode for Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0419 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Shortcode for Font Awesome
Fixed in
1.4.1
What to do
Update Shortcode for Font Awesome to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023WP Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WP Font Awesome
Fixed in
1.7.9
What to do
Update WP Font Awesome to 1.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Better Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4512 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Better Font Awesome
Fixed in
2.0.4
What to do
Update Better Font Awesome to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Font Awesome: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4478 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
Product
Font Awesome
Fixed in
4.3.2
What to do
Update Font Awesome to 4.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Awesome Support: Does not ensure that the exported tickets archive to be downloaded belongs to the user making the requestCVE-2022-3511 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
Product
Awesome Support
Fixed in
6.1.2
What to do
Update Awesome Support to 6.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.CVE-2022-40193 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.CVE-2022-37328 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.CVE-2022-36791 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.
Affected
up to 1.0.16
What to do
Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.CVE-2022-35238 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 21, 2022Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.CVE-2022-38073 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.
Affected
up to 6.0.7
What to do
Affects up to 6.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 9, 2022Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress.CVE-2022-37405 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mickey Kay's Better Font Awesome plugin <= 2.0.1 at WordPress.
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 26, 2021Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id,CVE-2021-36919 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 2, 2021Awesome Weather Widget: Does not sanitize the id parameter of its awesome_weather_refresh AJAX actionCVE-2021-24474 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refresh AJAX action, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability.
Product
Awesome Weather Widget
Affected
up to 3.0.2
What to do
Affects up to 3.0.2. Update Awesome Weather Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 9, 2020The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.CVE-2019-20181 · WordPress plugins & themes · reported by MITREMedium 4.8
The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record medium.com medium.com
Oct 10, 2019The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter.CVE-2015-9462 · WordPress plugins & themes · reported by MITREHigh 7.2
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter.
Product
awesome-filterable-portfolio
Fixed in
1.9
What to do
Update awesome-filterable-portfolio to 1.9 or newer.
Full record and what to do →NVD record cinu.pl wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.