Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,328 results · page 20 of 27
Aug 8, 2022Better Tag Cloud: Does not sanitise and escape some of its settingsCVE-2022-2412 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Better Tag Cloud
- Affected
- up to 0.99.5
- What to do
- Affects up to 0.99.5. Update Better Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Auto More Tag: Does not sanitise and escape some of its settingsCVE-2022-2411 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Auto More Tag
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Auto More Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022mTouch Quiz: Does not sanitise and escape some of its settingsCVE-2022-2410 · WordPress plugins & themes · reported by WPScanMedium 4.8
The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- mTouch Quiz
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update mTouch Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022weForms: Does not sanitise and escape its settingsCVE-2022-2395 · WordPress plugins & themes · reported by WPScanMedium 4.8
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- weForms
- Fixed in
- 1.6.14
- What to do
- Update weForms to 1.6.14 or newer.
Aug 8, 2022YaySMTP: Does not sanitise and escape some of its settingsCVE-2022-2372 · WordPress plugins & themes · reported by WPScanMedium 4.8
The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- YaySMTP
- Fixed in
- 2.2.2
- What to do
- Update YaySMTP to 2.2.2 or newer.
Aug 1, 2022YaySMTP: Does not have capability check before displaying the Mailer Credentials in JS code for the settingsCVE-2022-2370 · WordPress plugins & themes · reported by WPScanMedium 6.5
The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 1, 2022Flexi Quote Rotator: Does not sanitise and escape its settingsCVE-2022-2328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flexi Quote Rotator
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Flexi Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Invitation Based Registrations: Does not sanitise and escape some of its settingsCVE-2022-2325 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Invitation Based Registrations
- Affected
- up to 2.2.84
- What to do
- Affects up to 2.2.84. Update Invitation Based Registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022WordPress Popup: Does not sanitise and escape some of its settingsCVE-2022-2305 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Popup
- Affected
- up to 1.9.3.8
- What to do
- Affects up to 1.9.3.8. Update WordPress Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022GiveWP: Does not properly sanitise and escape the currency settingsCVE-2022-2215 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GiveWP
- Fixed in
- 2.21.3
- What to do
- Update GiveWP to 2.21.3 or newer.
Aug 1, 2022Advanced WordPress Reset: Does not escape some generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2181 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced WordPress Reset
- Fixed in
- 1.6
- What to do
- Update Advanced WordPress Reset to 1.6 or newer.
Aug 1, 2022Microsoft Advertising Universal Event Tracking (UET): Does not sanitise and escape its settingsCVE-2022-2170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
- Product
- Microsoft Advertising Universal Event Tracking (UET)
- Fixed in
- 1.0.4
- What to do
- Update Microsoft Advertising Universal Event Tracking (UET) to 1.0.4 or newer.
Aug 1, 2022Login with phone number: Does not sanitise and escape plugin settingsCVE-2022-0598 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Login with phone number
- Fixed in
- 1.3.8
- What to do
- Update Login with phone number to 1.3.8 or newer.
Jul 25, 2022Simple Page Transition: Does not sanitise and escape some of its settingsCVE-2022-2341 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Page Transition
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Simple Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 25, 2022Request a Quote: Does not sanitise and escape some of its settingsCVE-2022-2239 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Request a Quote
- Fixed in
- 2.3.9
- What to do
- Update Request a Quote to 2.3.9 or newer.
Jul 18, 2022plugin Wbcom Designs – BuddyPress Group Reviews: Unauthorized settings changes and review modificationCVE-2022-2108 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.
- Product
- plugin Wbcom Designs – BuddyPress Group Reviews
- Affected
- up to 2.8.3
- What to do
- Affects up to 2.8.3. Update plugin Wbcom Designs – BuddyPress Group Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 17, 2022Accept Stripe Payments: Does not sanitize and escape some of its settingsCVE-2022-2194 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Accept Stripe Payments
- Fixed in
- 2.0.64
- What to do
- Update Accept Stripe Payments to 2.0.64 or newer.
Jul 17, 2022Simple Post Notes: Does not sanitise and escape its settingsCVE-2022-2186 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Post Notes
- Fixed in
- 1.7.6
- What to do
- Update Simple Post Notes to 1.7.6 or newer.
Jul 17, 2022Loading Page with Loading Screen: Does not escape its settingsCVE-2022-2169 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Loading Page with Loading Screen
- Fixed in
- 1.0.83
- What to do
- Update Loading Page with Loading Screen to 1.0.83 or newer.
Jul 17, 2022Best Contact Management Software: Does not sanitise and escape its settingsCVE-2022-2151 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Best Contact Management Software
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Best Contact Management Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2022Very Simple Breadcrumb: Does not sanitise and escape its settingsCVE-2022-2149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Very Simple Breadcrumb WordPress plugin through 1.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Very Simple Breadcrumb
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Very Simple Breadcrumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2022LinkedIn Company Updates: Does not sanitise and escape its settingsCVE-2022-2148 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- LinkedIn Company Updates
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update LinkedIn Company Updates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2022Data Tables Generator by Supsystic: Does not sanitise and escape some of its Table settingsCVE-2022-2114 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Data Tables Generator by Supsystic
- Fixed in
- 1.10.20
- What to do
- Update Data Tables Generator by Supsystic to 1.10.20 or newer.
Jul 17, 2022Page Generator: Does not sanitise and escape its settingsCVE-2022-2100 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Page Generator
- Fixed in
- 1.6.5
- What to do
- Update Page Generator to 1.6.5 or newer.
Jul 17, 2022WP User Manager: Does not ensure that the user ID to reset the password of is related to the reset key givenCVE-2021-24655 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account.
- Product
- WP User Manager
- Fixed in
- 2.6.3
- What to do
- Update WP User Manager to 2.6.3 or newer.
Jul 11, 2022WP Duplicate Page: Does not sanitize and escape some of its settingsCVE-2022-2093 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WP Duplicate Page
- Fixed in
- 1.3
- What to do
- Update WP Duplicate Page to 1.3 or newer.
Jul 11, 2022WooCommerce PDF Invoices & Packing Slips: Doesn't escape a parameter on its setting pageCVE-2022-2092 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Fixed in
- 2.16.0
- What to do
- Update WooCommerce PDF Invoices & Packing Slips to 2.16.0 or newer.
Jul 11, 2022Bold Page Builder: Does not sanitise and escape some of its settingsCVE-2022-2089 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Bold Page Builder
- Fixed in
- 4.3.3
- What to do
- Update Bold Page Builder to 4.3.3 or newer.
Jul 11, 2022WP-Paginate: Does not escape one of its settingsCVE-2022-2050 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- WP-Paginate
- Fixed in
- 2.1.9
- What to do
- Update WP-Paginate to 2.1.9 or newer.
Jul 11, 2022Popup Builder: Does not escape and sanitize some settingsCVE-2022-1894 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltred_html is disallowed
- Product
- Popup Builder
- Fixed in
- 4.1.11
- What to do
- Update Popup Builder to 4.1.11 or newer.
Jul 4, 2022WP Contact Slider: Does not sanitize and escape the Text to Display settings of slidersCVE-2022-1301 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- WP Contact Slider
- Fixed in
- 2.4.7
- What to do
- Update WP Contact Slider to 2.4.7 or newer.
Jun 27, 2022Malware Scanner: Does not sanitise and escape some of its settingsCVE-2022-1995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- Malware Scanner
- Fixed in
- 4.5.2
- What to do
- Update Malware Scanner to 4.5.2 or newer.
Jun 27, 2022Login With OTP Over SMS, Email, WhatsApp and Google Authenticator: Does not escape its settingsCVE-2022-1994 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Login With OTP Over SMS, Email, WhatsApp and Google Authenticator
- Fixed in
- 1.0.8
- What to do
- Update Login With OTP Over SMS, Email, WhatsApp and Google Authenticator to 1.0.8 or newer.
Jun 27, 2022Nested Pages: Does not escape and sanitize the some of its settingsCVE-2022-1990 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltered_html is disallowed
- Product
- Nested Pages
- Fixed in
- 3.1.21
- What to do
- Update Nested Pages to 3.1.21 or newer.
Jun 27, 2022NextCellent Gallery: Does not sanitise and escape some of its image settingsCVE-2022-1971 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- NextCellent Gallery
- Affected
- up to 1.9.35
- What to do
- Affects up to 1.9.35. Update NextCellent Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022miniOrange's Google Authenticator: Does not sanitise and escape some of its settingsCVE-2022-1321 · WordPress plugins & themes · reported by WPScanMedium 4.8
The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- miniOrange's Google Authenticator
- Fixed in
- 5.5.6
- What to do
- Update miniOrange's Google Authenticator to 5.5.6 or newer.
Jun 27, 2022Flower Delivery by Florist One: Does not sanitise and escape some of its settingsCVE-2022-1113 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setups)
- Product
- Flower Delivery by Florist One
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Flower Delivery by Florist One to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Mihdan: No External Links: Does not sanitise and escape some of its settingsCVE-2022-1095 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Mihdan: No External Links
- Fixed in
- 5.0.2
- What to do
- Update Mihdan: No External Links to 5.0.2 or newer.
Jun 27, 2022Limit Login Attempts: Does not sanitise and escape some of its settingsCVE-2022-1029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- Limit Login Attempts
- Fixed in
- 4.0.72
- What to do
- Update Limit Login Attempts to 4.0.72 or newer.
Jun 27, 2022The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to maliCVE-2022-1028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- WordPress Security Firewall, Malware Scanner, Secure Login and Backup
- Fixed in
- 4.2.1
- What to do
- Update WordPress Security Firewall, Malware Scanner, Secure Login and Backup to 4.2.1 or newer.
Jun 27, 2022Login using WordPress Users ( WP as SAML IDP ): Does not sanitise and escape some of its settingsCVE-2022-1010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Login using WordPress Users ( WP as SAML IDP )
- Fixed in
- 1.13.4
- What to do
- Update Login using WordPress Users ( WP as SAML IDP ) to 1.13.4 or newer.
Jun 20, 2022Coming Soon & Maintenance Mode by Colorlib: Does not sanitize and escape some settingsCVE-2022-1945 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in multisite setup)
- Product
- Coming Soon & Maintenance Mode by Colorlib
- Fixed in
- 1.0.99
- What to do
- Update Coming Soon & Maintenance Mode by Colorlib to 1.0.99 or newer.
Jun 20, 2022WP Zillow Review Slider: Does not escape a settingsCVE-2022-1915 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite)
- Product
- WP Zillow Review Slider
- Fixed in
- 2.4
- What to do
- Update WP Zillow Review Slider to 2.4 or newer.
Jun 20, 2022underConstruction: Does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting itCVE-2022-1896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.
- Product
- underConstruction
- Fixed in
- 1.21
- What to do
- Update underConstruction to 1.21 or newer.
Jun 20, 2022Newsletter: Does not escape and sanitise the preheader_text settingCVE-2022-1889 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfilteredhtml is disallowed
- Product
- Newsletter
- Fixed in
- 7.4.6
- What to do
- Update Newsletter to 7.4.6 or newer.
Jun 20, 2022Custom Share Buttons with Floating Sidebar: Does not sanitise and escape some of its settingsCVE-2022-1717 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Custom Share Buttons with Floating Sidebar
- Fixed in
- 4.2
- What to do
- Update Custom Share Buttons with Floating Sidebar to 4.2 or newer.
Jun 20, 2022Print, PDF, Email by PrintFriendly: Does not sanitise and escape the Custom Button Text settingsCVE-2022-0663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Print, PDF, Email by PrintFriendly
- Fixed in
- 5.2.3
- What to do
- Update Print, PDF, Email by PrintFriendly to 5.2.3 or newer.
Jun 20, 2022XML Sitemaps: Does not sanitise and escape a settings before outputting it in the Debug pageCVE-2021-25088 · WordPress plugins & themes · reported by WPScanMedium 4.8
The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- XML Sitemaps
- Fixed in
- 4.1.3
- What to do
- Update XML Sitemaps to 4.1.3 or newer.
Jun 13, 2022Mitsol Social Post Feed: Does not escape some of its settings before outputting them back in attributesCVE-2022-0209 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Mitsol Social Post Feed
- Fixed in
- 1.11
- What to do
- Update Mitsol Social Post Feed to 1.11 or newer.
Jun 13, 2022WP Admin Style: Does not sanitise and escape some of its settingsCVE-2022-1814 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- WP Admin Style
- Affected
- up to 0.1.2
- What to do
- Affects up to 0.1.2. Update WP Admin Style to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.