Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,091 results · page 23 of 42
Feb 6, 2023Annual Archive: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0178 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Annual Archive
- Fixed in
- 1.6.0
- What to do
- Update Annual Archive to 1.6.0 or newer.
Feb 6, 2023Giveaways and Contests by RafflePress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0176 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.11.3
- What to do
- Update Giveaways and Contests by RafflePress to 1.11.3 or newer.
Feb 6, 2023WP VR: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0174 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP VR
- Fixed in
- 8.2.7
- What to do
- Update WP VR to 8.2.7 or newer.
Feb 6, 2023Drag & Drop Sales Funnel Builder for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0173 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Drag & Drop Sales Funnel Builder for
- Fixed in
- 2.6.9
- What to do
- Update Drag & Drop Sales Funnel Builder for to 2.6.9 or newer.
Feb 6, 2023jQuery T(-) Countdown Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0171 · WordPress plugins & themes · reported by WPScanMedium 5.4
The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- jQuery T(-) Countdown Widget
- Fixed in
- 2.3.24
- What to do
- Update jQuery T(-) Countdown Widget to 2.3.24 or newer.
Feb 6, 2023Html5 Audio Player: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0170 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Html5 Audio Player
- Fixed in
- 2.1.12
- What to do
- Update Html5 Audio Player to 2.1.12 or newer.
Feb 6, 2023GamiPress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0154 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GamiPress
- Fixed in
- 1.0.9
- What to do
- Update GamiPress to 1.0.9 or newer.
Feb 6, 2023Vimeo Video Autoplay Automute: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0153 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Vimeo Video Autoplay Automute
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Vimeo Video Autoplay Automute to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Cloak Front End Email: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Cloak Front End Email
- Fixed in
- 1.9.2
- What to do
- Update Cloak Front End Email to 1.9.2 or newer.
Feb 6, 2023WordPrezi: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0149 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WordPrezi
- Fixed in
- 0.9
- What to do
- Update WordPrezi to 0.9 or newer.
Feb 6, 2023Gallery Factory Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Gallery Factory Lite
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Gallery Factory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Flexible Captcha: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0147 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Flexible Captcha
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Flexible Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Naver Map: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0146 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Naver Map
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Naver Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Send PDF for Contact Form 7: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-0143 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Send PDF for Contact Form 7
- Fixed in
- 0.9.9.2
- What to do
- Update Send PDF for Contact Form 7 to 0.9.9.2 or newer.
Feb 6, 2023WC Vendors Marketplace: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0072 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WC Vendors Marketplace
- Fixed in
- 2.4.5
- What to do
- Update WC Vendors Marketplace to 2.4.5 or newer.
Feb 6, 2023ResponsiveVoice Text To Speech: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0070 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ResponsiveVoice Text To Speech
- Fixed in
- 1.7.7
- What to do
- Update ResponsiveVoice Text To Speech to 1.7.7 or newer.
Feb 6, 2023EAN for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0062 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- EAN for WooCommerce
- Fixed in
- 4.4.3
- What to do
- Update EAN for WooCommerce to 4.4.3 or newer.
Feb 6, 2023Clean Login: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Clean Login
- Fixed in
- 1.13.7
- What to do
- Update Clean Login to 1.13.7 or newer.
Feb 6, 2023Breadcrumb: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4836 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Breadcrumb
- Fixed in
- 1.5.33
- What to do
- Update Breadcrumb to 1.5.33 or newer.
Feb 6, 2023YourChannel: Everything you want in a YouTube: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- YourChannel: Everything you want in a YouTube
- Fixed in
- 1.2.3
- What to do
- Update YourChannel: Everything you want in a YouTube to 1.2.3 or newer.
Feb 6, 2023Simple Tooltips: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Simple Tooltips
- Fixed in
- 2.1.4
- What to do
- Update Simple Tooltips to 2.1.4 or newer.
Feb 6, 2023WP-ShowHide: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4825 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-ShowHide WordPress plugin before 1.05 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP-ShowHide
- Fixed in
- 1.05
- What to do
- Update WP-ShowHide to 1.05 or newer.
Feb 6, 2023WP Blog and Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4824 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Blog and Widgets
- Fixed in
- 2.3.1
- What to do
- Update WP Blog and Widgets to 2.3.1 or newer.
Feb 6, 2023Materialis Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4762 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Materialis Companion
- Fixed in
- 1.3.40
- What to do
- Update Materialis Companion to 1.3.40 or newer.
Feb 6, 2023My YouTube Channel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4756 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- My YouTube Channel
- Fixed in
- 3.23.0
- What to do
- Update My YouTube Channel to 3.23.0 or newer.
Feb 6, 2023Post Category Image With Grid and Slider: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4747 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Post Category Image With Grid and Slider
- Fixed in
- 1.4.8
- What to do
- Update Post Category Image With Grid and Slider to 1.4.8 or newer.
Feb 6, 2023Strong Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4717 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Strong Testimonials
- Fixed in
- 3.0.3
- What to do
- Update Strong Testimonials to 3.0.3 or newer.
Feb 6, 2023Leaflet Maps Marker: Does not validate and escape one of its shortcode attributesCVE-2022-4677 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Leaflet Maps Marker
- Fixed in
- 3.12.7
- What to do
- Update Leaflet Maps Marker to 3.12.7 or newer.
Feb 6, 2023Ibtana: Does not validate and escape one of its shortcode attributesCVE-2022-4674 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
- Product
- Ibtana
- Fixed in
- 1.1.8.8
- What to do
- Update Ibtana to 1.1.8.8 or newer.
Feb 6, 2023PDF.js Viewer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- PDF.js Viewer
- Fixed in
- 2.1.8
- What to do
- Update PDF.js Viewer to 2.1.8 or newer.
Feb 6, 2023Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4664 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 3.6.0
- What to do
- Update Logo Slider to 3.6.0 or newer.
Feb 6, 2023Restaurant Menu: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4657 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Restaurant Menu
- Fixed in
- 2.3.6
- What to do
- Update Restaurant Menu to 2.3.6 or newer.
Feb 6, 2023PPWP: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- PPWP
- Fixed in
- 1.8.6
- What to do
- Update PPWP to 1.8.6 or newer.
Feb 6, 2023Easy Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Testimonials
- Fixed in
- 3.9.3
- What to do
- Update Easy Testimonials to 3.9.3 or newer.
Feb 6, 2023WP Show Posts: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4459 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Show Posts
- Fixed in
- 1.1.4
- What to do
- Update WP Show Posts to 1.1.4 or newer.
Jan 30, 2023WP Social Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0074 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Social Widget
- Fixed in
- 2.2.4
- What to do
- Update WP Social Widget to 2.2.4 or newer.
Jan 30, 2023WP Tabs: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0071 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Tabs
- Fixed in
- 2.1.17
- What to do
- Update WP Tabs to 2.1.17 or newer.
Jan 30, 2023PDF Viewer: Does not validate and escape one of its shortcode attributesCVE-2023-0033 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Viewer WordPress plugin before 1.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- PDF Viewer
- Fixed in
- 1.0.0
- What to do
- Update PDF Viewer to 1.0.0 or newer.
Jan 30, 2023CPO Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- CPO Companion
- Fixed in
- 1.1.0
- What to do
- Update CPO Companion to 1.1.0 or newer.
Jan 30, 2023Social Sharing Toolkit: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4835 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Sharing Toolkit
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Social Sharing Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023CPT Bootstrap Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4834 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- CPT Bootstrap Carousel
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update CPT Bootstrap Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023Custom User Profile Fields for User Registration: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4831 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Custom User Profile Fields for User Registration
- Fixed in
- 1.8.1
- What to do
- Update Custom User Profile Fields for User Registration to 1.8.1 or newer.
Jan 30, 2023Bold Timeline Lite: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4828 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Bold Timeline Lite
- Fixed in
- 1.1.5
- What to do
- Update Bold Timeline Lite to 1.1.5 or newer.
Jan 30, 2023Blog Designer: Does not validate and escape one of its shortcode attributesCVE-2022-4793 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Blog Designer
- Fixed in
- 2.4.1
- What to do
- Update Blog Designer to 2.4.1 or newer.
Jan 30, 2023News & Blog Designer Pack: Does not validate and escape one of its shortcode attributesCVE-2022-4792 · WordPress plugins & themes · reported by WPScanMedium 5.4
The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- News & Blog Designer Pack
- Fixed in
- 3.3
- What to do
- Update News & Blog Designer Pack to 3.3 or newer.
Jan 30, 2023Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as conCVE-2022-4787 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Fixed in
- 2.0.8
- What to do
- Update the plugin to 2.0.8 or newer.
Jan 30, 2023Accordion Shortcodes: Does not validate and escape one of its shortcode attributesCVE-2022-4781 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Accordion Shortcodes WordPress plugin through 2.4.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Accordion Shortcodes
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update Accordion Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023CC Child Pages: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4776 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- CC Child Pages
- Fixed in
- 1.43
- What to do
- Update CC Child Pages to 1.43 or newer.
Jan 30, 2023Portfolio for Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Portfolio for Elementor
- Fixed in
- 2.3.1
- What to do
- Update Portfolio for Elementor to 2.3.1 or newer.
Jan 30, 2023Icon Widget: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4763 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Icon Widget
- Fixed in
- 1.3.0
- What to do
- Update Icon Widget to 1.3.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.