Updated 25 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,938 results · page 24 of 39

Apr 24, 2023Easy Forms for Mailchimp: Does not sanitise and escape some parameters before outputting them back in the responseCVE-2023-1324 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.8 does not sanitise and escape some parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Easy Forms for Mailchimp
Fixed in
6.8.8
What to do
Update Easy Forms for Mailchimp to 6.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023WP FEvents Book: Does not sanitise and escape some parametersCVE-2023-1126 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP FEvents Book WordPress plugin through 0.46 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Cross-Site Scripting attacks
Product
WP FEvents Book
Affected
up to 0.46
What to do
Affects up to 0.46. Update WP FEvents Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
Steveas WP Live Chat Shoutbox
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before outputting it back in the ShoutboxCVE-2023-0899 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins.
Product
Steveas WP Live Chat Shoutbox
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023MS-Reviews: Does not sanitise and escape reviewsCVE-2023-0424 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks
Product
MS-Reviews
Affected
up to 1.5
What to do
Affects up to 1.5. Update MS-Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2023-1473 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Fixed in
3.29.1
What to do
Update the plugin to 3.29.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023WP VR: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-1413 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WP VR
Fixed in
8.2.9
What to do
Update WP VR to 8.2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023WC Fields Factory: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0277 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
WC Fields Factory
Affected
up to 4.1.5
What to do
Affects up to 4.1.5. Update WC Fields Factory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Apr 10, 2023WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins
Product
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
Fixed in
2.7.9.4
What to do
Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to 2.7.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Simple Giveaways: Does not sanitise and escape some of its Giveaways optionsCVE-2023-1122 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Simple Giveaways
Fixed in
2.45.1
What to do
Update Simple Giveaways to 2.45.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Simple Giveaways: Does not sanitise and escape some of its settingsCVE-2023-1121 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Simple Giveaways
Fixed in
2.45.1
What to do
Update Simple Giveaways to 2.45.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Simple Giveaways: Does not sanitise and escape some of its settingsCVE-2023-1120 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Simple Giveaways
Fixed in
2.45.1
What to do
Update Simple Giveaways to 2.45.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023stylish-cost-calculator-premium: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0983 · WordPress plugins & themes · reported by WPScanMedium 6.1
The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form.
Product
stylish-cost-calculator-premium
Fixed in
7.9.0
What to do
Update stylish-cost-calculator-premium to 7.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Time Sheets: Does not sanitise and escape some of its settingsCVE-2023-0893 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Time Sheets
Fixed in
1.29.3
What to do
Update Time Sheets to 1.29.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Auto Rename Media On Upload: Does not sanitise and escape some of its settingsCVE-2023-0605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Auto Rename Media On Upload
Fixed in
1.1.0
What to do
Update Auto Rename Media On Upload to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023WordPress Amazon S3: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0423 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WordPress Amazon S3
Fixed in
1.6
What to do
Update WordPress Amazon S3 to 1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 3, 2023Solidres: Does not sanitise and escape numerous parameter before outputting them back in pagesCVE-2023-1377 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Solidres
Affected
up to 0.9.4
What to do
Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Modern Events Calendar Lite: Does not sanitise and escape some of its settingsCVE-2023-1400 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Modern Events Calendar Lite
Fixed in
6.5.2
What to do
Update Modern Events Calendar Lite to 6.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Simple File List: Does not sanitise and escape some of its settingsCVE-2023-1025 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple File List
Fixed in
6.0.10
What to do
Update Simple File List to 6.0.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023WP Statistics: Does not escape a parameterCVE-2023-0955 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
Product
WP Statistics
Fixed in
14.0
What to do
Update WP Statistics to 14.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023WP Image Carousel: Does not sanitise and escape some parametersCVE-2023-0589 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
WP Image Carousel
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP Image Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 202310Web Map Builder for Google Maps: Does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated usersCVE-2023-0037 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Product
10Web Map Builder for Google Maps
Fixed in
1.0.73
What to do
Update 10Web Map Builder for Google Maps to 1.0.73 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Mar 13, 2023SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.CVE-2022-38074 · WordPress plugins & themes · reported by PatchstackHigh 7.1
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.
Affected
up to 13.2.10
What to do
Affects up to 13.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 7, 2023WP Statistics: Cross-Site Request ForgeryCVE-2021-4333 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Statistics
Affected
up to 13.1.1
What to do
Affects up to 13.1.1. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2023My Sticky Elements: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0487 · WordPress plugins & themes · reported by WPScanHigh 7.2
The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin
Product
My Sticky Elements
Fixed in
2.0.9
What to do
Update My Sticky Elements to 2.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2023ShortPixel Adaptive Images: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0334 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin
Product
ShortPixel Adaptive Images
Fixed in
3.6.3
What to do
Update ShortPixel Adaptive Images to 3.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2023Media Library Assistant: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0279 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
Media Library Assistant
Fixed in
3.06
What to do
Update Media Library Assistant to 3.06 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Feb 27, 2023GeoDirectory: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0278 · WordPress plugins & themes · reported by WPScanHigh 7.2
The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
GeoDirectory
Fixed in
2.2.24
What to do
Update GeoDirectory to 2.2.24 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Feb 27, 2023Custom Add User: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0043 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Custom Add User
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Custom Add User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Watu Quiz: Does not sanitise and escape some of its settingsCVE-2023-0429 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Watu Quiz
Fixed in
3.3.8.2
What to do
Update Watu Quiz to 3.3.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Watu Quiz: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Watu Quiz
Fixed in
3.3.8.2
What to do
Update Watu Quiz to 3.3.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Real Media Library: Does not sanitise and escape the created folder namesCVE-2023-0285 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
Product
Real Media Library
Fixed in
4.18.29
What to do
Update Real Media Library to 4.18.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023BackupBuddy: Does not sanitise and escape some parameters before outputting them back in various placesCVE-2022-4897 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting
Product
BackupBuddy
Fixed in
8.8.3
What to do
Update BackupBuddy to 8.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023WP Yelp Review Slider: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0263 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Yelp Review Slider WordPress plugin before 7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Product
WP Yelp Review Slider
Fixed in
7.1
What to do
Update WP Yelp Review Slider to 7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023WP Airbnb Review Slider: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0262 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Product
WP Airbnb Review Slider
Fixed in
3.3
What to do
Update WP Airbnb Review Slider to 3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023WP TripAdvisor Review Slider: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0261 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Product
WP TripAdvisor Review Slider
Fixed in
10.8
What to do
Update WP TripAdvisor Review Slider to 10.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023WP Review Slider: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0260 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Product
WP Review Slider
Fixed in
12.2
What to do
Update WP Review Slider to 12.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023WP Google Review Slider: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0259 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
Product
WP Google Review Slider
Fixed in
11.8
What to do
Update WP Google Review Slider to 11.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Simple URLs: Does not sanitise and escape some parameters before outputting them back in some pagesCVE-2023-0099 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple URLs WordPress plugin before 115 does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Simple URLs
Fixed in
115
What to do
Update Simple URLs to 115 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Feb 13, 2023WP Visitor Statistics (Real Time Traffic): Does not validate and escape one of its shortcode attributesCVE-2022-4656 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
WP Visitor Statistics (Real Time Traffic)
Fixed in
6.5
What to do
Update WP Visitor Statistics (Real Time Traffic) to 6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Mapwiz: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4546 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
Mapwiz
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Mapwiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Feb 13, 2023FL3R FeelBox: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4445 · WordPress plugins & themes · reported by WPScanCritical 9.8
The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
FL3R FeelBox
Affected
up to 8.1
What to do
Affects up to 8.1. Update FL3R FeelBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Tutor LMS: Does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributesCVE-2023-0236 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Tutor LMS
Fixed in
2.0.10
What to do
Update Tutor LMS to 2.0.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium MultisiCVE-2022-4496 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.
Product
SAML SSO Standard
Fixed in
16.0.8
What to do
Update SAML SSO Standard to 16.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023پلاگین پرداخت دلخواه: Does not sanitise and escape some parametersCVE-2022-4307 · WordPress plugins & themes · reported by WPScanMedium 6.1
The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users such as admin visits a page from the plugin.
Product
پلاگین پرداخت دلخواه
Fixed in
2.9.3
What to do
Update پلاگین پرداخت دلخواه to 2.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023WP Statistics: Does not escape a parameterCVE-2022-4230 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
Product
WP Statistics
Fixed in
13.2.9
What to do
Update WP Statistics to 13.2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023EU Cookie Law for GDPR/CCPA: Does not sanitise and escape some of its settingsCVE-2022-3811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
EU Cookie Law for GDPR/CCPA
Affected
up to 3.1.6
What to do
Affects up to 3.1.6. Update EU Cookie Law for GDPR/CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Conditional Payment Methods for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4547 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin.
Product
Conditional Payment Methods for WooCommerce
Affected
up to 1.0
What to do
Affects up to 1.0. Update Conditional Payment Methods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jan 16, 2023WP Attachments: Does not sanitise and escape some of its settingsCVE-2022-4330 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Attachments
Fixed in
5.0.6
What to do
Update WP Attachments to 5.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Metricool: Does not sanitise and escape some of its settingsCVE-2022-4299 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Metricool
Fixed in
1.18
What to do
Update Metricool to 1.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.