Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

512new WordPress flaws this week

391,181entries in the database

1,938 results · page 22 of 39

Aug 30, 2023FormCraft: Does not sanitise and escape some of its settingsCVE-2023-3501 · WordPress plugins & themes · reported by WPScanMedium 4.8
The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
FormCraft
Fixed in
1.2.7
What to do
Update FormCraft to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 21, 2023MultiParcels Shipping For WooCommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
MultiParcels Shipping For WooCommerce
Fixed in
1.15.4
What to do
Update MultiParcels Shipping For WooCommerce to 1.15.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 21, 2023Blog2Social: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3936 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Blog2Social
Fixed in
7.2.1
What to do
Update Blog2Social to 7.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 21, 2023Bit Assist: Does not sanitise and escape some of its settingsCVE-2023-3667 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bit Assist WordPress plugin before 1.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Bit Assist
Fixed in
1.1.9
What to do
Update Bit Assist to 1.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 17, 2023Steve Curtis, St: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-30874 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Steve Curtis, St. Pete Design Gps Plotter plugin <= 5.1.4 versions.
Product
Steve Curtis, St
Affected
up to 5.1.4
What to do
Affects up to 5.1.4. Update Steve Curtis, St to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 16, 2023Tiempo.com: Does not sanitise and escape the page parameter before outputting it back in the pageCVE-2023-2272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Tiempo.com
Affected
up to 0.1.2
What to do
Affects up to 0.1.2. Update Tiempo.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2023SEO ALert: Does not sanitise and escape some of its settingsCVE-2023-2225 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
SEO ALert
Affected
up to 1.59
What to do
Affects up to 1.59. Update SEO ALert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2023WP Inventory Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2123 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Product
WP Inventory Manager
Fixed in
2.1.0.13
What to do
Update WP Inventory Manager to 2.1.0.13 or newer.
Full record and what to do →NVD record github.com wpscan.com
Aug 16, 2023Image Optimizer by 10web: Does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panelCVE-2023-2122 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.
Product
Image Optimizer by 10web
Fixed in
1.0.27
What to do
Update Image Optimizer by 10web to 1.0.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023WP-EMail: Does not sanitise and escape some of its settingsCVE-2023-3721 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP-EMail
Fixed in
2.69.1
What to do
Update WP-EMail to 2.69.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023Contact Form Builder by Bit Form: Does not sanitise and escape some of its settingsCVE-2023-3645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Contact Form Builder by Bit Form
Fixed in
2.2.0
What to do
Update Contact Form Builder by Bit Form to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023User Activity Log: Does not correctly sanitise and escape several parameters before using it in a SQL statementCVE-2023-3435 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
Product
User Activity Log
Fixed in
1.6.5
What to do
Update User Activity Log to 1.6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023Custom Field For WP Job Manager: Does not sanitise and escape some of its settingsCVE-2023-3328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Custom Field For WP Job Manager
Fixed in
1.2
What to do
Update Custom Field For WP Job Manager to 1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023Ultimate Addons for Contact Form 7: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2803 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Ultimate Addons for Contact Form 7
Fixed in
3.1.29
What to do
Update Ultimate Addons for Contact Form 7 to 3.1.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023Ultimate Addons for Contact Form 7: Does not sanitise and escape some of its settingsCVE-2023-2802 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Ultimate Addons for Contact Form 7
Fixed in
3.1.29
What to do
Update Ultimate Addons for Contact Form 7 to 3.1.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023WP Brutal AI: Does not sanitise and escape some of its settingsCVE-2023-2606 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Brutal AI
Fixed in
2.06
What to do
Update WP Brutal AI to 2.06 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not sanitise and escape various parameters before outputting it back in the pageCVE-2023-3671 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
MultiParcels Shipping For WooCommerce
Fixed in
1.15.4
What to do
Update MultiParcels Shipping For WooCommerce to 1.15.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 7, 2023WP Food Manager: Does not sanitise and escape some of its settingsCVE-2023-0604 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Food Manager
Fixed in
1.0.4
What to do
Update WP Food Manager to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 31, 2023Short URL: Does not sanitise and escape some of its settingsCVE-2023-3130 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Short URL
Fixed in
1.6.5
What to do
Update Short URL to 1.6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 24, 2023Auto Location for WP Job Manager via Google: Does not sanitise and escape some of its settingsCVE-2023-3344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Auto Location for WP Job Manager via Google
Fixed in
1.1
What to do
Update Auto Location for WP Job Manager via Google to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 24, 2023All-in-one Floating Contact Form: Does not sanitise and escape some of its settingsCVE-2023-3248 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
All-in-one Floating Contact Form
Fixed in
2.1.2
What to do
Update All-in-one Floating Contact Form to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 24, 2023User Activity Log: Does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pagesCVE-2023-2761 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
Product
User Activity Log
Fixed in
1.6.3
What to do
Update User Activity Log to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023Floating Chat Widget: Does not sanitise and escape some of its settingsCVE-2023-3245 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Floating Chat Widget
Fixed in
3.1.2
What to do
Update Floating Chat Widget to 3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023Membership: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3182 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Membership
Fixed in
3.2.3
What to do
Update Membership to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023Autochat Automatic Conversation: Does not sanitise and escape user input before outputting it back on the pageCVE-2023-3041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack.
Product
Autochat Automatic Conversation
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Autochat Automatic Conversation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023AN_GradeBook: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2636 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
Product
AN_GradeBook
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jul 17, 2023InventoryPress: Does not sanitise and escape some of its settingsCVE-2023-2579 · WordPress plugins & themes · reported by WPScanMedium 5.4
The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
Product
InventoryPress
Affected
up to 1.7
What to do
Affects up to 1.7. Update InventoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
Jul 10, 2023Float menu: Does not sanitise and escape some of its settingsCVE-2023-3225 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Float menu
Fixed in
5.0.3
What to do
Update Float menu to 5.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023URL Shortify: Does not sanitise and escape some of its settingsCVE-2023-3129 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
URL Shortify
Fixed in
1.7.0
What to do
Update URL Shortify to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023Export All URLs: Does not sanitise and escape a parameter before outputting them back in the pageCVE-2023-3118 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Export All URLs
Fixed in
4.6
What to do
Update Export All URLs to 4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023MStore API: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-3077 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
Product
MStore API
Fixed in
3.9.8
What to do
Update MStore API to 3.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023TinyMCE Custom Styles: Does not sanitise and escape some of its settingsCVE-2023-2967 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
TinyMCE Custom Styles
Fixed in
1.1.4
What to do
Update TinyMCE Custom Styles to 1.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023AN_GradeBook: Does not sanitise and escape some of its settingsCVE-2023-2709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
AN_GradeBook
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023Call Now Accessibility Button: Does not sanitise and escape some of its settingsCVE-2023-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Call Now Accessibility Button
Fixed in
1.1
What to do
Update Call Now Accessibility Button to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023Buy Me a Coffee: Does not sanitise and escape some of its settingsCVE-2023-2578 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Buy Me a Coffee
Fixed in
3.7
What to do
Update Buy Me a Coffee to 3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023Enable SVG Uploads: Does not sanitise uploaded SVG filesCVE-2023-2529 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
Enable SVG Uploads
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update Enable SVG Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023All In One Redirection: Does not properly sanitise and escape multiple parameters before using them in an SQL statementCVE-2023-2493 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
All In One Redirection
Fixed in
2.2.0
What to do
Update All In One Redirection to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023Companion Sitemap Generator: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-1780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Companion Sitemap Generator
Fixed in
4.5.3
What to do
Update Companion Sitemap Generator to 4.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress.CVE-2015-10120 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.
Product
WDS Multisite Aggregate
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update WDS Multisite Aggregate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jun 27, 2023CodeColorer: Does not sanitise and escape some of its settingsCVE-2023-2795 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
CodeColorer
Fixed in
0.10.1
What to do
Update CodeColorer to 0.10.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023ERP: Does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statementCVE-2023-2744 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
ERP
Fixed in
1.12.4
What to do
Update ERP to 1.12.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 27, 2023ERP: Does not sanitise and escape the employee_name parameter before outputting it back in the pageCVE-2023-2743 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
ERP
Fixed in
1.12.4
What to do
Update ERP to 1.12.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023Ultimate Product Catalog: Does not sanitise and escape some of its settingsCVE-2023-2711 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Ultimate Product Catalog
Fixed in
5.2.6
What to do
Update Ultimate Product Catalog to 5.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023KiviCare: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2624 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator
Product
KiviCare
Fixed in
3.2.1
What to do
Update KiviCare to 3.2.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 27, 2023wpbrutalai: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2605 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
Product
wpbrutalai
Fixed in
2.0.1
What to do
Update wpbrutalai to 2.0.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 27, 2023wpbrutalai: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2601 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin via CSRF.
Product
wpbrutalai
Fixed in
2.0.0
What to do
Update wpbrutalai to 2.0.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 27, 2023FormCraft: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2592 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
FormCraft
Fixed in
3.9.7
What to do
Update FormCraft to 3.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023Responsive CSS EDITOR: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2482 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.
Product
Responsive CSS EDITOR
Affected
up to 1.0
What to do
Affects up to 1.0. Update Responsive CSS EDITOR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023Aajoda Testimonials: Does not sanitise and escape some of its settingsCVE-2023-2178 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Aajoda Testimonials
Fixed in
2.2.2
What to do
Update Aajoda Testimonials to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023Kanban Boards for: Does not sanitise and escape some of its settingsCVE-2023-0873 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Kanban Boards for
Fixed in
2.5.21
What to do
Update Kanban Boards for to 2.5.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.