Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,456 results · page 22 of 30
Mar 17, 2023WP Express Checkout: Stored Cross-Site ScriptingCVE-2023-1469 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This can potentially be exploited by lower-privileged users if the `Admin Dashboard Access Permission` setting it set for those users to access the dashboard.
- Product
- WP Express Checkout
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update WP Express Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 6, 2023WPCode: Does not have adequate privilege checks in place for several AJAX actionsCVE-2023-0328 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).
- Product
- WPCode
- Fixed in
- 2.0.7
- What to do
- Update WPCode to 2.0.7 or newer.
Mar 6, 2023WooCommerce Checkout Field Manager: Does not validate files to be uploadedCVE-2022-4328 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
- Product
- WooCommerce Checkout Field Manager
- Fixed in
- 18.0
- What to do
- Update WooCommerce Checkout Field Manager to 18.0 or newer.
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.CVE-2023-23865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.
- Fixed in
- 1.4.11
- What to do
- Update the plugin to 1.4.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 27, 2023Correos Oficial: Does not have an authorization check user input validationCVE-2023-0331 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.
- Product
- Correos Oficial
- Affected
- up to 1.2.0.2
- What to do
- Affects up to 1.2.0.2. Update Correos Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023User Activity: Checks headers suchCVE-2022-4550 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing
- Product
- User Activity
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update User Activity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Intuitive Custom Post Order: Does not check for authorization in the update-menu-order ajax actionCVE-2022-4385 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order
- Product
- Intuitive Custom Post Order
- Fixed in
- 3.1.4
- What to do
- Update Intuitive Custom Post Order to 3.1.4 or newer.
Feb 13, 2023GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training: Does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary postsCVE-2023-0405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.
- Product
- GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training
- Fixed in
- 1.4.38
- What to do
- Update GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training to 1.4.38 or newer.
Feb 13, 2023WP Customer Area: Does not have CSRF checksCVE-2022-4745 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example.
- Product
- WP Customer Area
- Fixed in
- 8.1.4
- What to do
- Update WP Customer Area to 8.1.4 or newer.
Jan 30, 2023Chained Products: Does not have authorisation and CSRF checksCVE-2022-4872 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belong to the plugin, allowing unauthenticated attackers to set arbitrary options to 'no'
- Product
- Chained Products
- Fixed in
- 2.12.0
- What to do
- Update Chained Products to 2.12.0 or newer.
Jan 30, 2023FL3R FeelBox: Does not have CSRF checkCVE-2022-4553 · WordPress plugins & themes · reported by WPScanMedium 4.3
The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perform such action via a CSRF attack and delete the lydl_posts & lydl_poststimestamp DB tables
- Product
- FL3R FeelBox
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update FL3R FeelBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023FL3R FeelBox: Does not have CSRF checkCVE-2022-4552 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- FL3R FeelBox
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update FL3R FeelBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023Optimize images ALT Text & names for SEO using AI: Does not have CSRF check in placeCVE-2022-4548 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- Optimize images ALT Text & names for SEO using AI
- Fixed in
- 2.0.8
- What to do
- Update Optimize images ALT Text & names for SEO using AI to 2.0.8 or newer.
Jan 23, 2023BruteBank: Does not have CSRF check in placeCVE-2022-4443 · WordPress plugins & themes · reported by WPScanMedium 6.5
The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- BruteBank
- Fixed in
- 1.9
- What to do
- Update BruteBank to 1.9 or newer.
Jan 23, 2023Login as User or Customer: Lacks authorization checks to ensure that users are allowed to log inCVE-2022-4305 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
- Product
- Login as User or Customer
- Fixed in
- 3.3
- What to do
- Update Login as User or Customer to 3.3 or newer.
Jan 23, 2023Passster: Does not properly check for passwordCVE-2021-24881 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request.
- Product
- Passster
- Fixed in
- 3.5.5.9
- What to do
- Update Passster to 3.5.5.9 or newer.
Jan 16, 2023Tickera: Does not have CSRF check in placeCVE-2022-4549 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- Tickera
- Fixed in
- 3.5.1.0
- What to do
- Update Tickera to 3.5.1.0 or newer.
Jan 16, 2023Subscribe2: Does not have CSRF checkCVE-2022-4309 · WordPress plugins & themes · reported by WPScanLow 3.1
The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
- Product
- Subscribe2
- Fixed in
- 10.38
- What to do
- Update Subscribe2 to 10.38 or newer.
Jan 16, 2023WP Spell Check: Does not escape ignored wordsCVE-2022-2658 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Spell Check
- Fixed in
- 9.13
- What to do
- Update WP Spell Check to 9.13 or newer.
Jan 9, 2023Mautic Integration for WooCommerce: Does not have proper CSRF checkCVE-2022-4426 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.
- Product
- Mautic Integration for WooCommerce
- Fixed in
- 1.0.3
- What to do
- Update Mautic Integration for WooCommerce to 1.0.3 or newer.
Jan 9, 2023Royal Elementor Addons: Does not have authorisation and CSRF checksCVE-2022-4103 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title
- Product
- Royal Elementor Addons
- Fixed in
- 1.3.56
- What to do
- Update Royal Elementor Addons to 1.3.56 or newer.
Jan 9, 2023Royal Elementor Addons: Does not have authorization and CSRF checksCVE-2022-4102 · WordPress plugins & themes · reported by WPScanLow 3.1
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.
- Product
- Royal Elementor Addons
- Fixed in
- 1.3.56
- What to do
- Update Royal Elementor Addons to 1.3.56 or newer.
Jan 9, 2023ActiveCampaign for WooCommerce: Does not have authorisation checkCVE-2022-3923 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs.
- Product
- ActiveCampaign for WooCommerce
- Fixed in
- 1.9.8
- What to do
- Update ActiveCampaign for WooCommerce to 1.9.8 or newer.
Jan 2, 2023Wholesale Market: Does not have authorisation checkCVE-2022-4298 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
- Product
- Wholesale Market
- Fixed in
- 2.2.1
- What to do
- Update Wholesale Market to 2.2.1 or newer.
Dec 28, 2022Broken Link Checker: Does not sanitise and escape some of its settingsCVE-2022-3922 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Broken Link Checker
- Fixed in
- 1.11.20
- What to do
- Update Broken Link Checker to 1.11.20 or newer.
Dec 26, 2022Bulk Delete Users by Email: Does not have CSRF checkCVE-2022-4266 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete non admin users by knowing their email via a CSRF attack
- Product
- Bulk Delete Users by Email
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bulk Delete Users by Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-loginCVE-2022-4158 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 19, 2022Popup Manager: Does not have authorisation and CSRF checkCVE-2022-4125 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well
- Product
- Popup Manager
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Popup Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2022Popup Manager: Does not have authorisation and CSRF checksCVE-2022-4124 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them
- Product
- Popup Manager
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Popup Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2022SMSA Shipping for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-4107 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server
- Product
- SMSA Shipping for WooCommerce
- Fixed in
- 1.0.5
- What to do
- Update SMSA Shipping for WooCommerce to 1.0.5 or newer.
Dec 19, 2022Wholesale Market for WooCommerce: Does not have authorisation checkCVE-2022-4106 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
- Product
- Wholesale Market for WooCommerce
- Fixed in
- 1.0.7
- What to do
- Update Wholesale Market for WooCommerce to 1.0.7 or newer.
Dec 19, 2022WP Stripe Checkout: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3986 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WP Stripe Checkout
- Fixed in
- 1.2.2.21
- What to do
- Update WP Stripe Checkout to 1.2.2.21 or newer.
Dec 19, 2022Checkout for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3983 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Checkout for PayPal
- Fixed in
- 1.0.14
- What to do
- Update Checkout for PayPal to 1.0.14 or newer.
Dec 12, 2022Donation Button: Does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX actionCVE-2022-4004 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX action, which may allow any users with an account on the affected site, like subscribers, to use the plugin's Twilio integration to send SMSes to arbitrary phone numbers.
- Product
- Donation Button
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Donation Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2022Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3882 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix
- Fixed in
- 2.46
- What to do
- Update Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix to 2.46 or newer.
Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3926 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 3.4.2
- What to do
- Update WP OAuth Server (OAuth Authentication) to 3.4.2 or newer.
Dec 5, 2022Advanced Import: Does not have CSRF checkCVE-2022-3677 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from WordPress.org, and activate arbitrary ones from the blog via CSRF attacks
- Product
- Advanced Import
- Fixed in
- 1.3.8
- What to do
- Update Advanced Import to 1.3.8 or newer.
Nov 28, 2022The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks inCVE-2022-4169 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.
- Affected
- up to 3.2.16
- What to do
- Affects up to 3.2.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 28, 2022Find and Replace All: Does not have CSRF checkCVE-2022-3850 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 28, 2022Showing URL in QR Code: Does not have CSRF checkCVE-2022-3847 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack
- Product
- Showing URL in QR Code
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update Showing URL in QR Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022Checkout Field Editor (Checkout Manager) for WooCommerce: Unserializes user input provided via the settingsCVE-2022-3490 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Checkout Field Editor (Checkout Manager) for WooCommerce
- Fixed in
- 1.8.0
- What to do
- Update Checkout Field Editor (Checkout Manager) for WooCommerce to 1.8.0 or newer.
Nov 21, 2022WPQA Builder: Does not have CSRF checkCVE-2022-3688 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users perform such actions via CSRF attacks
- Product
- WPQA Builder
- Fixed in
- 5.9
- What to do
- Update WPQA Builder to 5.9 or newer.
Nov 21, 2022Event Monster: Does not have CSRF checkCVE-2022-3336 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack
- Product
- Event Monster
- Fixed in
- 1.2.0
- What to do
- Update Event Monster to 1.2.0 or newer.
Nov 21, 2022The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.CVE-2022-1579 · WordPress plugins & themes · reported by WPScanHigh 7.5
The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2022My wpdb: Is missing CSRF checkCVE-2022-1578 · WordPress plugins & themes · reported by WPScanHigh 8.8
The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack
- Product
- My wpdb
- Fixed in
- 2.5
- What to do
- Update My wpdb to 2.5 or newer.
Nov 14, 2022OAuth Client by DigitialPixies: Does not have CSRF checks in some placesCVE-2022-3632 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions.
- Product
- OAuth Client by DigitialPixies
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2022Webmaster Tools Verification: Does not have authorisation and CSRF checksCVE-2022-3538 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
- Product
- Webmaster Tools Verification
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Webmaster Tools Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2022reSmush.it : the only free Image Optimizer & compress: Does not perform CSRF checks for any of its AJAX actionsCVE-2022-2449 · WordPress plugins & themes · reported by WPScanMedium 6.5
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
- Product
- reSmush.it : the only free Image Optimizer & compress
- Fixed in
- 0.4.4
- What to do
- Update reSmush.it : the only free Image Optimizer & compress to 0.4.4 or newer.
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3537 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
- Product
- Role Based Pricing for WooCommerce
- Fixed in
- 1.6.2
- What to do
- Update Role Based Pricing for WooCommerce to 1.6.2 or newer.
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3536 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blog
- Product
- Role Based Pricing for WooCommerce
- Fixed in
- 1.6.3
- What to do
- Update Role Based Pricing for WooCommerce to 1.6.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.