Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,091 results · page 24 of 42

Jan 30, 2023Posts List Designer by Category: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4749 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Posts List Designer by Category
Fixed in
3.2
What to do
Update Posts List Designer by Category to 3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023MediaElement.js: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4699 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
Product
MediaElement.js
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update MediaElement.js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023PixCodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
PixCodes
Fixed in
2.3.7
What to do
Update PixCodes to 2.3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023Pricing Tables: Does not validate and escape one of its shortcode attributesCVE-2022-4654 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
Pricing Tables
Fixed in
3.2.3
What to do
Update Pricing Tables to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023Justified Gallery: Does not validate and escape one of its shortcode attributesCVE-2022-4651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
Justified Gallery
Fixed in
1.7.1
What to do
Update Justified Gallery to 1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023WP Extended Search: Does not validate and escape one of its shortcode attributesCVE-2022-4649 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
WP Extended Search
Fixed in
2.1.2
What to do
Update WP Extended Search to 2.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023Simple Sitemap: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4472 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Simple Sitemap
Fixed in
3.5.8
What to do
Update Simple Sitemap to 3.5.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023Widgets for Google Reviews: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4470 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Widgets for Google Reviews
Fixed in
9.8
What to do
Update Widgets for Google Reviews to 9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 26, 2023Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the applicationCVE-2023-23951 · Other software · Broadcom · reported by secure@symantec.comMedium 6.1
Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application
Product
Symantec Identity Governance And Administration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Jan 23, 2023Store Locator: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4832 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Store Locator
Fixed in
1.4.9
What to do
Update Store Locator to 1.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023WP Google My Business Auto Publish: Does not validate and escape one of its shortcode attributesCVE-2022-4790 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
WP Google My Business Auto Publish
Fixed in
3.4
What to do
Update WP Google My Business Auto Publish to 3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023WPZOOM Portfolio: Does not validate and escape one of its shortcode attributesCVE-2022-4789 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
WPZOOM Portfolio
Fixed in
1.2.2
What to do
Update WPZOOM Portfolio to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023GeoDirectory: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4775 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
GeoDirectory
Fixed in
2.2.22
What to do
Update GeoDirectory to 2.2.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023OneClick Chat to Order: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
OneClick Chat to Order
Fixed in
1.0.4.2
What to do
Update OneClick Chat to Order to 1.0.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 202310WebMapBuilder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4758 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
10WebMapBuilder
Fixed in
1.0.72
What to do
Update 10WebMapBuilder to 1.0.72 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Print-O-Matic: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4753 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Print-O-Matic
Fixed in
2.1.8
What to do
Update Print-O-Matic to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Word Balloon: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4751 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Word Balloon
Fixed in
4.19.3
What to do
Update Word Balloon to 4.19.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Landing Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Landing Page Builder
Fixed in
1.4.9.9
What to do
Update Landing Page Builder to 1.4.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023WP Popups: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
WP Popups
Fixed in
2.1.4.8
What to do
Update WP Popups to 2.1.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Structured Content: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4715 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Structured Content
Fixed in
1.5.1
What to do
Update Structured Content to 1.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Genesis Columns Advanced: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4706 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
Product
Genesis Columns Advanced
Fixed in
2.0.4
What to do
Update Genesis Columns Advanced to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Mongoose Page: Does not validate and escape one of its shortcode attributesCVE-2022-4675 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
Mongoose Page
Fixed in
1.9.0
What to do
Update Mongoose Page to 1.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Rate my Post: Does not validate and escape one of its shortcode attributesCVE-2022-4673 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
Rate my Post
Fixed in
3.3.9
What to do
Update Rate my Post to 3.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023WordPress Simple Shopping Cart: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4672 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
WordPress Simple Shopping Cart
Fixed in
4.6.2
What to do
Update WordPress Simple Shopping Cart to 4.6.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Easy Appointments: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4668 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Easy Appointments
Fixed in
3.11.2
What to do
Update Easy Appointments to 3.11.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023HashBar: Does not validate and escape one of its shortcode attributesCVE-2022-4650 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
HashBar
Fixed in
1.3.6
What to do
Update HashBar to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Product Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4629 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Product Slider for WooCommerce
Fixed in
2.6.4
What to do
Update Product Slider for WooCommerce to 2.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023ShiftNav: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
ShiftNav
Fixed in
1.7.2
What to do
Update ShiftNav to 1.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Login Logout Menu: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4625 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Login Logout Menu
Fixed in
1.4.0
What to do
Update Login Logout Menu to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023GS Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4624 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
GS Logo Slider
Fixed in
3.3.8
What to do
Update GS Logo Slider to 3.3.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Easy Bootstrap Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4576 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Easy Bootstrap Shortcode
Affected
up to 4.5.4
What to do
Affects up to 4.5.4. Update Easy Bootstrap Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Top 10: Does not validate and escape some of its Block attributes before outputting them back in the pageCVE-2022-4570 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Top 10
Fixed in
3.2.3
What to do
Update Top 10 to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Sitemap: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4545 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Sitemap
Fixed in
4.4
What to do
Update Sitemap to 4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Compact WP Audio Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4542 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Compact WP Audio Player
Fixed in
1.9.8
What to do
Update Compact WP Audio Player to 1.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Content Control: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.
Product
Content Control
Fixed in
1.1.10
What to do
Update Content Control to 1.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Page-list: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4485 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Page-list
Fixed in
5.3
What to do
Update Page-list to 5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Collapse-O-Matic: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4475 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Product
Collapse-O-Matic
Fixed in
1.8.3
What to do
Update Collapse-O-Matic to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Easy Social Feed: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4474 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Product
Easy Social Feed
Fixed in
6.4.0
What to do
Update Easy Social Feed to 6.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Search & Filter: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4467 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Product
Search & Filter
Fixed in
1.2.16
What to do
Update Search & Filter to 1.2.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 20, 2023The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attriCVE-2023-24038 · Other software · Html-stripscripts Project · reported by MITREHigh 7.5
The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attributes.
Product
Html-stripscripts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.debian.org
Jan 20, 2023EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char.CVE-2022-45541 · Other software · Eyoucms · reported by MITREMedium 6.1
EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char.
Product
Eyoucms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 16, 2023RSSImport: Does not validate and escape one of its shortcode attributesCVE-2022-4658 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
RSSImport
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update RSSImport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Welcart e-Commerce: Does not validate and escapes one of its shortcode attributesCVE-2022-4655 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
Product
Welcart e-Commerce
Fixed in
2.8.9
What to do
Update Welcart e-Commerce to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Greenshift: Does not validate and escape one of its shortcode attributesCVE-2022-4653 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
Greenshift
Fixed in
4.8.9
What to do
Update Greenshift to 4.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Real Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4648 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Real Testimonials
Fixed in
2.6.0
What to do
Update Real Testimonials to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Video Conferencing with Zoom: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4578 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Video Conferencing with Zoom
Fixed in
4.0.10
What to do
Update Video Conferencing with Zoom to 4.0.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Seriously Simple Podcasting: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Seriously Simple Podcasting
Fixed in
2.19.1
What to do
Update Seriously Simple Podcasting to 2.19.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023MashShare: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
MashShare
Fixed in
3.8.7
What to do
Update MashShare to 3.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023ConvertKit: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4508 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
Product
ConvertKit
Fixed in
2.0.5
What to do
Update ConvertKit to 2.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Real Cookie Banner: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4507 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
Product
Real Cookie Banner
Fixed in
3.4.10
What to do
Update Real Cookie Banner to 3.4.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.