Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 26 of 39
Dec 12, 2022Livemesh Addons for Elementor: Does not sanitise and escape some of its settingsCVE-2022-3862 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Livemesh Addons for Elementor
- Fixed in
- 7.2.4
- What to do
- Update Livemesh Addons for Elementor to 7.2.4 or newer.
Dec 12, 2022GetYourGuide Ticketing: Does not sanitise and escape some parametersCVE-2022-3609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GetYourGuide Ticketing
- Fixed in
- 1.0.4
- What to do
- Update GetYourGuide Ticketing to 1.0.4 or newer.
Dec 5, 2022Add Comments: Does not sanitise and escape some of its settingsCVE-2022-3909 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Add Comments
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Add Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3858 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin.
- Product
- Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button
- Fixed in
- 3.0.3
- What to do
- Update Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button to 3.0.3 or newer.
Dec 5, 2022WPUpper Share Buttons: Does not sanitise and escape some of its settingsCVE-2022-3838 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WPUpper Share Buttons
- Affected
- up to 3.42
- What to do
- Affects up to 3.42. Update WPUpper Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022Uji Countdown: Does not sanitise and escape some of its settingsCVE-2022-3837 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Uji Countdown
- Fixed in
- 2.3.1
- What to do
- Update Uji Countdown to 2.3.1 or newer.
Dec 5, 2022WP Page Builder: Does not sanitise and escape some of its settingsCVE-2022-3830 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Page Builder
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update WP Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022Advanced WP Columns: Does not sanitise and escape some of its settingsCVE-2022-3426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Advanced WP Columns
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Advanced WP Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022WP CSV Exporter: Does not properly sanitise and escape some parameters before using them in a SQL statementCVE-2022-3249 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high privilege users such as admin to perform SQL injection attacks
- Product
- WP CSV Exporter
- Fixed in
- 1.3.7
- What to do
- Update WP CSV Exporter to 1.3.7 or newer.
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3849 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3848 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022Analytics for WP: Does not sanitise and escape some of its settingsCVE-2022-3839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Analytics for WP WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Analytics for WP
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Analytics for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Google Forms: Does not sanitise and escape some of its settingsCVE-2022-3834 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Google Forms
- Affected
- up to 0.95
- What to do
- Affects up to 0.95. Update Google Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Fancier Author Box by ThematoSoup: Does not sanitise and escape some of its settingsCVE-2022-3833 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Fancier Author Box by ThematoSoup
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Fancier Author Box by ThematoSoup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022reCAPTCHA: Does not sanitise and escape some of its settingsCVE-2022-3831 · WordPress plugins & themes · reported by WPScanMedium 4.8
The reCAPTCHA WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- reCAPTCHA
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Video Thumbnails: Does not sanitise and escape some of its settingsCVE-2022-3828 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Video Thumbnails
- Affected
- up to 2.12.3
- What to do
- Affects up to 2.12.3. Update Video Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022WP Admin UI Customize: Does not sanitise and escape some of its settingsCVE-2022-3824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Admin UI Customize
- Fixed in
- 1.5.13
- What to do
- Update WP Admin UI Customize to 1.5.13 or newer.
Nov 28, 2022Beautiful Cookie Consent Banner: Does not sanitise and escape some of its settingsCVE-2022-3823 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Beautiful Cookie Consent Banner
- Fixed in
- 2.9.1
- What to do
- Update Beautiful Cookie Consent Banner to 2.9.1 or newer.
Nov 28, 2022Donations via PayPal: Does not sanitise and escape some of its settingsCVE-2022-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Donations via PayPal
- Fixed in
- 1.9.9
- What to do
- Update Donations via PayPal to 1.9.9 or newer.
Nov 28, 2022OWM Weather: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3769 · WordPress plugins & themes · reported by WPScanHigh 8.8
The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as contributor
- Product
- OWM Weather
- Fixed in
- 5.6.9
- What to do
- Update OWM Weather to 5.6.9 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WPSmartContracts: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3768 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
- Product
- WPSmartContracts
- Fixed in
- 1.3.12
- What to do
- Update WPSmartContracts to 1.3.12 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022Jeeng Push Notifications: Does not sanitise and escape some of its settingsCVE-2022-3610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Jeeng Push Notifications
- Fixed in
- 2.0.4
- What to do
- Update Jeeng Push Notifications to 2.0.4 or newer.
Nov 28, 2022Image Hover Effects Css3: Does not sanitise and escape some of its settingsCVE-2022-3601 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Hover Effects Css3
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update Image Hover Effects Css3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2022Popup Maker: Does not sanitise and escape some of its Popup optionsCVE-2022-3690 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins
- Product
- Popup Maker
- Fixed in
- 1.16.11
- What to do
- Update Popup Maker to 1.16.11 or newer.
Nov 14, 2022ProfileGrid: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-3578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- ProfileGrid
- Fixed in
- 5.1.1
- What to do
- Update ProfileGrid to 5.1.1 or newer.
Nov 14, 2022Chat Bubble: Does not sanitise and escape some contact parametersCVE-2022-3415 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message
- Product
- Chat Bubble
- Fixed in
- 2.3
- What to do
- Update Chat Bubble to 2.3 or newer.
Nov 7, 2022WooCommerce Dropshipping: Does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated usersCVE-2022-3481 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
- Product
- WooCommerce Dropshipping
- Fixed in
- 4.4
- What to do
- Update WooCommerce Dropshipping to 4.4 or newer.
Nov 7, 2022Highlight Focus: Does not sanitise and escape some of its settingsCVE-2022-3462 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Highlight Focus
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Highlight Focus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2022Rock Convert: Does not sanitise and escape some of its settingsCVE-2022-3441 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Rock Convert
- Fixed in
- 2.11.0
- What to do
- Update Rock Convert to 2.11.0 or newer.
Oct 31, 2022Rock Convert: Does not sanitise and escape an URL before outputting it back in an attributeCVE-2022-3440 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting
- Product
- Rock Convert
- Fixed in
- 2.11.0
- What to do
- Update Rock Convert to 2.11.0 or newer.
Oct 31, 2022Official Integration for Billingo: Does not sanitise and escape some of its settingsCVE-2022-3420 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users with a role as low as Shop Manager to perform Stored Cross-Site Scripting attacks.
- Product
- Official Integration for Billingo
- Fixed in
- 3.4.0
- What to do
- Update Official Integration for Billingo to 3.4.0 or newer.
Oct 31, 2022WP Word Count: Does not sanitise and escape some of its settingsCVE-2022-3408 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Word Count WordPress plugin through 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WP Word Count
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update WP Word Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2022WordPress Classifieds: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users andCVE-2022-3254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection
- Product
- WordPress Classifieds
- Fixed in
- 4.3
- What to do
- Update WordPress Classifieds to 4.3 or newer.
Oct 31, 2022Newspaper: Does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX actionCVE-2022-2627 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting.
- Product
- Newspaper
- Fixed in
- 12
- What to do
- Update Newspaper to 12 or newer.
Oct 31, 2022Newspaper: Does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX actionCVE-2022-2167 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- Newspaper
- Fixed in
- 12
- What to do
- Update Newspaper to 12 or newer.
Oct 25, 2022WP Humans.txt: Does not sanitise and escape some of its settingsCVE-2022-3392 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Humans.txt WordPress plugin through 1.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Humans.txt
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP Humans.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2022Retain Live Chat: Does not sanitise and escape some of its settingsCVE-2022-3391 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Retain Live Chat
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Retain Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2022Contact Bank: Does not sanitise and escape some of its Form settingsCVE-2022-3350 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Contact Bank
- Affected
- up to 3.0.30
- What to do
- Affects up to 3.0.30. Update Contact Bank to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2022Spam protection, AntiSpam, FireWall by CleanTalk: Does not validate ids before using them in a SQL statementCVE-2022-3302 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statement, which could lead to SQL injection exploitable by high privilege users such as admin
- Product
- Spam protection, AntiSpam, FireWall by CleanTalk
- Fixed in
- 5.185.1
- What to do
- Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.185.1 or newer.
Oct 25, 2022Form Maker by 10Web: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3300 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.6
- What to do
- Update Form Maker by 10Web to 1.15.6 or newer.
Oct 25, 2022Blog2Social: Social Media Auto Post & Scheduler: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3246 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers
- Product
- Blog2Social: Social Media Auto Post & Scheduler
- Fixed in
- 6.9.10
- What to do
- Update Blog2Social: Social Media Auto Post & Scheduler to 6.9.10 or newer.
Oct 17, 2022Import all XML, CSV & TXT: Does not properly sanitise and escape imported data before using them back SQL statementsCVE-2022-3243 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
- Product
- Import all XML, CSV & TXT
- Fixed in
- 6.5.8
- What to do
- Update Import all XML, CSV & TXT to 6.5.8 or newer.
Oct 17, 2022WP Custom Cursors: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3150 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users such as admin
- Product
- WP Custom Cursors
- Fixed in
- 3.2
- What to do
- Update WP Custom Cursors to 3.2 or newer.
Oct 17, 2022We’re Open!: Does not sanitise and escape some of its settingsCVE-2022-3139 · WordPress plugins & themes · reported by WPScanMedium 4.8
The We’re Open! WordPress plugin before 1.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- We’re Open!
- Fixed in
- 1.42
- What to do
- Update We’re Open! to 1.42 or newer.
Oct 17, 2022Search Logger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3131 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Search Logger WordPress plugin through 0.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
- Product
- Search Logger
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Search Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2022Meks Easy Social Share: Does not sanitise and escape some of its settingsCVE-2022-2574 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Meks Easy Social Share WordPress plugin before 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Meks Easy Social Share
- Fixed in
- 1.2.8
- What to do
- Update Meks Easy Social Share to 1.2.8 or newer.
Oct 10, 2022Advanced Comment Form: Does not sanitise and escape its settingsCVE-2022-3220 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Advanced Comment Form
- Fixed in
- 1.2.1
- What to do
- Update Advanced Comment Form to 1.2.1 or newer.
Oct 10, 2022soledad: Does not sanitise the {idCVE-2022-3209 · WordPress plugins & themes · reported by WPScanMedium 6.1
The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
- Product
- soledad
- Fixed in
- 8.2.5
- What to do
- Update soledad to 8.2.5 or newer.
Oct 10, 2022Simple File List: Does not sanitise and escape some of its settingsCVE-2022-3207 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple File List
- Fixed in
- 4.4.12
- What to do
- Update Simple File List to 4.4.12 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.