Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 23 of 39
Jun 27, 2023Editorial Calendar: Does not sanitise and escape its settingsCVE-2022-4115 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.
- Product
- Editorial Calendar
- Fixed in
- 3.8.3
- What to do
- Update Editorial Calendar to 3.8.3 or newer.
Jun 19, 2023Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2023-2812 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Dashboard
- Fixed in
- 3.7.6
- What to do
- Update Ultimate Dashboard to 3.7.6 or newer.
Jun 19, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-2811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks to all admin when setting chatbot and all client when using chatbot
- Product
- AI ChatBot
- Fixed in
- 4.5.6
- What to do
- Update AI ChatBot to 4.5.6 or newer.
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statementCVE-2023-2805 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- SupportCandy
- Fixed in
- 3.1.7
- What to do
- Update SupportCandy to 3.1.7 or newer.
Jun 19, 2023Social Share, Social Login and Social Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2779 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.52
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.52 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statementCVE-2023-2719 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.
- Product
- SupportCandy
- Fixed in
- 3.1.7
- What to do
- Update SupportCandy to 3.1.7 or newer.
Jun 19, 2023File Renaming on Upload: Does not sanitise and escape some of its settingsCVE-2023-2684 · WordPress plugins & themes · reported by WPScanMedium 4.8
The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- File Renaming on Upload
- Fixed in
- 2.5.2
- What to do
- Update File Renaming on Upload to 2.5.2 or newer.
Jun 19, 2023Integration for Contact Form 7 and Zoho CRM, Bigin: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2527 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Integration for Contact Form 7 and Zoho CRM, Bigin
- Fixed in
- 1.2.4
- What to do
- Update Integration for Contact Form 7 and Zoho CRM, Bigin to 1.2.4 or newer.
Jun 19, 2023QueryWall: Plug'n Play Firewall: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2492 · WordPress plugins & themes · reported by WPScanHigh 7.2
The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- QueryWall: Plug'n Play Firewall
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update QueryWall: Plug'n Play Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023QuBot: Does not sanitise and escape some of its settingsCVE-2023-2401 · WordPress plugins & themes · reported by WPScanMedium 4.8
The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- QuBot
- Fixed in
- 1.1.6
- What to do
- Update QuBot to 1.1.6 or newer.
Jun 19, 2023WP Custom Cursors: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2221 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- WP Custom Cursors
- Fixed in
- 3.2
- What to do
- Update WP Custom Cursors to 3.2 or newer.
Jun 12, 2023Easy Forms for Mailchimp: Does not sanitise and escape some of its from parametersCVE-2023-1323 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape some of its from parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.9
- What to do
- Update Easy Forms for Mailchimp to 6.8.9 or newer.
Jun 7, 2023Adning Advertising: File deletionCVE-2020-36728 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthenticated attackers to delete arbitrary files which can be used to reset and gain full control of a site.
- Product
- Adning Advertising
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Adning Advertising to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comcodecanyon.net
Jun 7, 2023Adning Advertising: Arbitrary file uploadsCVE-2020-36705 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
- Product
- Adning Advertising
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Adning Advertising to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comcodecanyon.net
Jun 5, 2023Get your number: Does not sanitise and escape some of its settingsCVE-2023-2634 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Get your number WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Get your number
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Get your number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 202310Web Social Post Feed: Does not sanitise and escape some parameter before outputting it back in a pageCVE-2023-2503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- 10Web Social Post Feed
- Fixed in
- 1.2.9
- What to do
- Update 10Web Social Post Feed to 1.2.9 or newer.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not sanitise and escape a parameter before outputting it back in the admin dashboardCVE-2023-2472 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.61
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.61 or newer.
Jun 5, 2023SEO by 10Web: Does not sanitise and escape some of its settingsCVE-2023-2224 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SEO by 10Web
- Fixed in
- 1.2.7
- What to do
- Update SEO by 10Web to 1.2.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 5, 2023Pricing Table Builder: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0900 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.
- Product
- Pricing Table Builder
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Pricing Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023Hostel: Does not sanitise and escape some of its settingsCVE-2023-0545 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Hostel
- Fixed in
- 1.1.5.2
- What to do
- Update Hostel to 1.1.5.2 or newer.
May 30, 2023Easy Forms for Mailchimp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2518 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.9
- What to do
- Update Easy Forms for Mailchimp to 6.8.9 or newer.
May 30, 2023Login rebuilder: Does not sanitise and escape some of its settingsCVE-2023-2223 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login rebuilder
- Fixed in
- 2.8.1
- What to do
- Update Login rebuilder to 2.8.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2023Autoptimize: Does not sanitise and escape the settings imported from a previous exportCVE-2023-2113 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
- Product
- Autoptimize
- Fixed in
- 3.1.7
- What to do
- Update Autoptimize to 3.1.7 or newer.
May 30, 2023Newsletter Popup: Does not sanitise and escape some of its settingsCVE-2023-0733 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 24, 2023Cross-Site Request Forgery (CSRF) vulnerability in Etison, LLC ClickFunnels plugin <= 3.1.1 versions.CVE-2022-47152 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Etison, LLC ClickFunnels plugin <= 3.1.1 versions.
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 15, 2023Thumbnail carousel slider: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-1915 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Thumbnail carousel slider WordPress plugin before 1.1.10 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting vulnerability which could be used against high privilege users such as admin.
- Product
- Thumbnail carousel slider
- Fixed in
- 1.1.10
- What to do
- Update Thumbnail carousel slider to 1.1.10 or newer.
May 15, 2023tagDiv Composer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-1596 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- tagDiv Composer
- Fixed in
- 4.0
- What to do
- Update tagDiv Composer to 4.0 or newer.
May 15, 2023Help Desk WP: Does not sanitise and escape some parametersCVE-2023-1019 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Help Desk WP WordPress plugin through 1.2.0 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.
- Product
- Help Desk WP
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Help Desk WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023BizLibrary: Does not sanitise and escape some of its settingsCVE-2023-0892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- BizLibrary
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update BizLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Push Notifications for WordPress by PushAssist: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-0644 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Push Notifications for WordPress by PushAssist
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Push Notifications for WordPress by PushAssist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023WP Visitor Statistics (Real Time Traffic): Does not escape user inputCVE-2023-0600 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 6.9
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 6.9 or newer.
May 8, 2023WP Inventory Manager: Does not sanitise and escape the message parameter before outputting it back in the pageCVE-2023-1806 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
- Product
- WP Inventory Manager
- Fixed in
- 2.1.0.12
- What to do
- Update WP Inventory Manager to 2.1.0.12 or newer.
May 8, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-1649 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- AI ChatBot
- Fixed in
- 4.5.1
- What to do
- Update AI ChatBot to 4.5.1 or newer.
May 8, 2023Video List Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1408 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Video List Manager
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Pickup | Delivery | Dine-in date time: Does not sanitise and escape some of its settingsCVE-2023-0894 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Pickup | Delivery | Dine-in date time
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Pickup | Delivery | Dine-in date time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023WP Login Box: Does not sanitise and escape some of its settingsCVE-2023-0544 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Login Box
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update WP Login Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Membership Database: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0514 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Membership Database
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Membership Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Cloud Manager: Does not sanitise and escape the query param ricerca before outputting it in an admin panelCVE-2023-0421 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.
- Product
- Cloud Manager
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Cloud Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4118 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users
- Product
- Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the page parameter before outputting it back in an attributeCVE-2023-1805 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Product Catalog Feed by PixelYourSite
- Fixed in
- 2.1.1
- What to do
- Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the edit parameter before outputting it back in an attributeCVE-2023-1804 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
- Product
- Product Catalog Feed by PixelYourSite
- Fixed in
- 2.1.1
- What to do
- Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
May 2, 2023WP Custom Author URL: Does not sanitise and escape some of its settingsCVE-2023-1614 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Custom Author URL
- Fixed in
- 1.0.5
- What to do
- Update WP Custom Author URL to 1.0.5 or newer.
May 2, 2023Quick Paypal Payments: Does not sanitise and escape some of its settingsCVE-2023-1554 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Quick Paypal Payments
- Fixed in
- 5.7.26.4
- What to do
- Update Quick Paypal Payments to 5.7.26.4 or newer.
May 2, 2023Site Reviews: Does not sanitise and escape some of its settingsCVE-2023-1525 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Site Reviews
- Fixed in
- 6.7.1
- What to do
- Update Site Reviews to 6.7.1 or newer.
May 2, 2023SMTP Mailing Queue: Does not sanitise and escape some of its settingsCVE-2023-1090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SMTP Mailing Queue
- Fixed in
- 2.0.1
- What to do
- Update SMTP Mailing Queue to 2.0.1 or newer.
May 2, 2023amr ical events lists: Does not sanitise and escape some of its settingsCVE-2023-1021 · WordPress plugins & themes · reported by WPScanMedium 4.8
The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- amr ical events lists
- Affected
- up to 6.6
- What to do
- Affects up to 6.6. Update amr ical events lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Ajax Search Pro: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-1435 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ajax Search Pro
- Fixed in
- 4.26.2
- What to do
- Update Ajax Search Pro to 4.26.2 or newer.
Apr 24, 2023Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro: Does not sanitise and escape a parameter before outputting it back in a response of an AJAX actionCVE-2023-1420 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro
- Fixed in
- 4.11.1
- What to do
- Update Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro to 4.11.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.