Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,456 results · page 24 of 30
Jul 11, 2022Rename wp-login.php: Does not have CSRF check in placeCVE-2022-1732 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Rename wp-login.php
- Affected
- up to 2.6.0
- What to do
- Affects up to 2.6.0. Update Rename wp-login.php to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022Sharebar: Does not have CSRF check in placeCVE-2022-1626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and also lead to Stored Cross-Site Scripting issue due to the lack of sanitisation and escaping in some of them
- Product
- Sharebar
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Sharebar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2022Admin Management Xtended: Does not have CSRF checks in some of its AJAX actionsCVE-2022-1599 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.
- Product
- Admin Management Xtended
- Fixed in
- 2.4.5
- What to do
- Update Admin Management Xtended to 2.4.5 or newer.
Jul 4, 2022WP Championship: Is lacking CSRF checks in various placesCVE-2022-1967 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- WP Championship
- Fixed in
- 9.3
- What to do
- Update WP Championship to 9.3 or newer.
Jun 27, 2022MyCSS: Does not have CSRF check in placeCVE-2022-1960 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- MyCSS
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MyCSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Clean-Contact: Does not have CSRF check in placeCVE-2022-1914 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS due to the lack of sanitisation and escaping as well
- Product
- Clean-Contact
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Clean-Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Add Post URL: Does not have CSRF check in placeCVE-2022-1913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Add Post URL
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Add Post URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022ARMember: Is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated usersCVE-2022-1903 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
- Product
- ARMember
- Fixed in
- 3.4.8
- What to do
- Update ARMember to 3.4.8 or newer.
Jun 27, 2022Cimy Header Image Rotator: Does not have CSRF check in placeCVE-2022-1885 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Cimy Header Image Rotator
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update Cimy Header Image Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Rotating Posts: Does not have CSRF check in placeCVE-2022-1847 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Rotating Posts
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update Rotating Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Tiny Contact Form: Does not have CSRF check in placeCVE-2022-1846 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Tiny Contact Form
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Tiny Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022WP Post Styling: Does not have CSRF checks in various actionsCVE-2022-1845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks
- Product
- WP Post Styling
- Fixed in
- 1.3.1
- What to do
- Update WP Post Styling to 1.3.1 or newer.
Jun 27, 2022WP Sentry: Does not have CSRF check in placeCVE-2022-1844 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- WP Sentry
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Sentry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022MailPress: Does not have CSRF checks in various placesCVE-2022-1843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks
- Product
- MailPress
- Affected
- up to 7.2.1
- What to do
- Affects up to 7.2.1. Update MailPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022OpenBook Book Data: Does not have CSRF check in placeCVE-2022-1842 · WordPress plugins & themes · reported by WPScanMedium 4.3
The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- OpenBook Book Data
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update OpenBook Book Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Social Share Buttons by Supsystic: Does not perform CSRF checks in it's ajax endpoints and admin pagesCVE-2022-1653 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks.
- Product
- Social Share Buttons by Supsystic
- Fixed in
- 2.2.4
- What to do
- Update Social Share Buttons by Supsystic to 2.2.4 or newer.
Jun 27, 2022My Private Site: Does not have CSRF check in placeCVE-2022-1627 · WordPress plugins & themes · reported by WPScanMedium 4.3
The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- My Private Site
- Fixed in
- 3.0.8
- What to do
- Update My Private Site to 3.0.8 or newer.
Jun 27, 2022New User Approve: Does not have CSRF check in placeCVE-2022-1625 · WordPress plugins & themes · reported by WPScanMedium 4.3
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.
- Product
- New User Approve
- Fixed in
- 2.4
- What to do
- Update New User Approve to 2.4 or newer.
Jun 27, 2022Site Offline or Coming Soon: Does not have CSRF check in placeCVE-2022-1593 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack
- Product
- Site Offline or Coming Soon
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Site Offline or Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022HTML2WP: Does not have authorisation and CSRF checksCVE-2022-1574 · WordPress plugins & themes · reported by WPScanCritical 9.8
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022HTML2WP: Does not have CSRF check in placeCVE-2022-1573 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022HTML2WP: Does not have authorisation and CSRF checks in an AJAX actionCVE-2022-1572 · WordPress plugins & themes · reported by WPScanHigh 8.1
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Google Authenticator: Does not have CSRF checkCVE-2022-0875 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
- Product
- Google Authenticator
- Fixed in
- 1.0.5
- What to do
- Update Google Authenticator to 1.0.5 or newer.
Jun 27, 2022Backup, Restore and Migrate WordPress Sites With the XCloner: Does not have authorisation and CSRF checksCVE-2022-0444 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.
- Product
- Backup, Restore and Migrate WordPress Sites With the XCloner
- Fixed in
- 4.3.6
- What to do
- Update Backup, Restore and Migrate WordPress Sites With the XCloner to 4.3.6 or newer.
Jun 20, 2022underConstruction: Does not have CSRF check in placeCVE-2022-1895 · WordPress plugins & themes · reported by WPScanMedium 4.3
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- underConstruction
- Fixed in
- 1.20
- What to do
- Update underConstruction to 1.20 or newer.
Jun 20, 2022CaPa Protect: Does not have CSRF check in placeCVE-2022-1832 · WordPress plugins & themes · reported by WPScanMedium 6.5
The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection.
- Product
- CaPa Protect
- Affected
- up to 0.5.8.2
- What to do
- Affects up to 0.5.8.2. Update CaPa Protect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022WPlite: Does not have CSRF check in placeCVE-2022-1831 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WPlite
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update WPlite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Amazon Einzeltitellinks: Does not have CSRF check in placeCVE-2022-1830 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Amazon Einzeltitellinks
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Amazon Einzeltitellinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Inline Google Maps: Does not have CSRF check in placeCVE-2022-1829 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Inline Google Maps
- Affected
- up to 5.11
- What to do
- Affects up to 5.11. Update Inline Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022PDF24 Articles To PDF: Does not have CSRF check in placeCVE-2022-1828 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- PDF24 Articles To PDF
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update PDF24 Articles To PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022PDF24 Article To PDF: Does not have CSRF check in placeCVE-2022-1827 · WordPress plugins & themes · reported by WPScanMedium 6.5
The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- PDF24 Article To PDF
- Affected
- up to 4.2.2
- What to do
- Affects up to 4.2.2. Update PDF24 Article To PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Cross-Linker: Does not have CSRF check in placeCVE-2022-1826 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- Cross-Linker
- Affected
- up to 3.0.1.9
- What to do
- Affects up to 3.0.1.9. Update Cross-Linker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Multi-page Toolkit: Does not have CSRF check in placeCVE-2022-1818 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- Multi-page Toolkit
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Multi-page Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022WP-EMail: Does not protect its log deletion functionality with nonce checksCVE-2022-1630 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack
- Product
- WP-EMail
- Fixed in
- 2.69.0
- What to do
- Update WP-EMail to 2.69.0 or newer.
Jun 20, 2022Seamless Donations: Does not have CSRF check in placeCVE-2022-1610 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Seamless Donations
- Fixed in
- 5.1.9
- What to do
- Update Seamless Donations to 5.1.9 or newer.
Jun 20, 2022Mail Subscribe List: Does not have CSRF check in placeCVE-2022-1603 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list
- Product
- Mail Subscribe List
- Fixed in
- 2.1.4
- What to do
- Update Mail Subscribe List to 2.1.4 or newer.
Jun 13, 2022Private Files: Is missing CSRF checkCVE-2022-1793 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public
- Product
- Private Files
- Affected
- up to 0.40
- What to do
- Affects up to 0.40. Update Private Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Quick Subscribe: Does not have CSRF check in placeCVE-2022-1792 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them
- Product
- Quick Subscribe
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Quick Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022One Click Plugin Updater: Does not have CSRF check in placeCVE-2022-1791 · WordPress plugins & themes · reported by WPScanHigh 8.1
The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.
- Product
- One Click Plugin Updater
- Affected
- up to 2.4.14
- What to do
- Affects up to 2.4.14. Update One Click Plugin Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022New User Email Set Up: Does not have CSRF check in placeCVE-2022-1790 · WordPress plugins & themes · reported by WPScanMedium 6.5
The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- New User Email Set Up
- Affected
- up to 0.5.2
- What to do
- Affects up to 0.5.2. Update New User Email Set Up to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.CVE-2022-1788 · WordPress plugins & themes · reported by WPScanMedium 6.5
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Sideblog: Does not have CSRF check in placeCVE-2022-1787 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Sideblog
- Affected
- up to 6.0
- What to do
- Affects up to 6.0. Update Sideblog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022postTabs: Does not have CSRF check in placeCVE-2022-1781 · WordPress plugins & themes · reported by WPScanMedium 5.4
The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- postTabs
- Affected
- up to 2.10.6
- What to do
- Affects up to 2.10.6. Update postTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022LaTeX for: Does not have CSRF check in placeCVE-2022-1780 · WordPress plugins & themes · reported by WPScanMedium 5.4
The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack which could also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- LaTeX for
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update LaTeX for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Auto Delete Posts: Does not have CSRF check in placeCVE-2022-1779 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.
- Product
- Auto Delete Posts
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Auto Delete Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Filr: Does not have authorisation check in two of its AJAX actionsCVE-2022-1777 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
- Product
- Filr
- Fixed in
- 1.2.2.1
- What to do
- Update Filr to 1.2.2.1 or newer.
Jun 13, 2022WP-chgFontSize: Does not have CSRF check in placeCVE-2022-1764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- WP-chgFontSize
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update WP-chgFontSize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including rCVE-2022-1763 · WordPress plugins & themes · reported by WPScanMedium 5.4
Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022iQ Block Country: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-1762 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- iQ Block Country
- Fixed in
- 1.2.20
- What to do
- Update iQ Block Country to 1.2.20 or newer.
Jun 13, 2022Peter’s Collaboration E-mails: Is vulnerable to CSRF due to missing nonce checksCVE-2022-1761 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more.
- Product
- Peter’s Collaboration E-mails
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Peter’s Collaboration E-mails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.