Updated 10 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,598 results · page 27 of 32

Aug 18, 2023Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager ProfesCVE-2023-31218 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.6 versions.
Fixed in
1.0.7
What to do
Update the plugin to 1.0.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 16, 2023WP Inventory Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2123 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Product
WP Inventory Manager
Fixed in
2.1.0.13
What to do
Update WP Inventory Manager to 2.1.0.13 or newer.
Full record and what to do →NVD record github.com wpscan.com
Aug 16, 2023Booking Manager: Does not validate URLs input in it's admin panel or in shortcodes for showing events from a remoteCVE-2023-1977 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
Product
Booking Manager
Fixed in
2.0.29
What to do
Update Booking Manager to 2.0.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 14, 2023Custom Field For WP Job Manager: Does not sanitise and escape some of its settingsCVE-2023-3328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Custom Field For WP Job Manager
Fixed in
1.2
What to do
Update Custom Field For WP Job Manager to 1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2023Real Estate Manager: Privilege escalationCVE-2023-4239 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
Product
Real Estate Manager
Affected
up to 7.2
What to do
Affects up to 7.2. Update Real Estate Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 7, 2023WP Food Manager: Does not sanitise and escape some of its settingsCVE-2023-0604 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Food Manager
Fixed in
1.0.4
What to do
Update WP Food Manager to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 31, 2023The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress pluginCVE-2022-4888 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts WordPress plugin before 1.0.2, Gift Registry for WooCommerce WordPress plugin through 1.0.1, Image Watermark for WooCommerce WordPress plugin before 1.0.1, Order Approval for WooCommerce WordPress plugin before 1.1.0, Order Tracking for WooCommerce WordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing and Discounts WordPress plugin through 1.0.6, Product Labels and Stickers WordPress plugin through 1.0.1 have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions
Affected
up to 1.0.1
Fixed in
1.0.2
What to do
Update the plugin to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 24, 2023Auto Location for WP Job Manager via Google: Does not sanitise and escape some of its settingsCVE-2023-3344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Auto Location for WP Job Manager via Google
Fixed in
1.1
What to do
Update Auto Location for WP Job Manager via Google to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 20233DPrint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-4023 · WordPress plugins & themes · reported by WPScanMedium 5.3
The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.
Product
3DPrint
Fixed in
3.5.6.9
What to do
Update 3DPrint to 3.5.6.9 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions.CVE-2023-35091 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions.
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions.CVE-2023-28986 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions.
Fixed in
2.9.21
What to do
Update the plugin to 2.9.21 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.CVE-2023-23787 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 1, 2023Lightweight Sidebar Manager: Cross-Site Request ForgeryCVE-2020-36747 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the metabox_save() function. This makes it possible for unauthenticated attackers to save metbox data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Lightweight Sidebar Manager
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Lightweight Sidebar Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 1, 2023WP Project Manager: Cross-Site Request ForgeryCVE-2020-36745 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due to missing or incorrect nonce validation on the do_updates() function. This makes it possible for unauthenticated attackers to trigger updates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Project Manager
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 29, 2023SP Project & Document Manager: Insecure Direct Object ReferencesCVE-2023-3063 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The SP Project & Document Manager plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.67. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers with subscriber privileges or above, to change user passwords and potentially take over administrator accounts.
Product
SP Project & Document Manager
Affected
up to 4.67
What to do
Affects up to 4.67. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 27, 2023WP Inventory Manager: Does not have CSRF checksCVE-2023-2842 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack
Product
WP Inventory Manager
Fixed in
2.1.0.14
What to do
Update WP Inventory Manager to 2.1.0.14 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023File Manager Advanced Shortcode: Does not adequately prevent uploading files with disallowed MIME typesCVE-2023-2068 · WordPress plugins & themes · reported by WPScanCritical 9.8
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
Product
File Manager Advanced Shortcode
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update File Manager Advanced Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions.CVE-2023-34028 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7 versions.
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2023Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.CVE-2023-34373 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Project Manager plugin <= 3.3.93 versions.
Affected
up to 3.3.93
What to do
Affects up to 3.3.93. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2023Download Manager: Stored Cross-Site ScriptingCVE-2023-2305 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Manager
Affected
up to 3.2.70
What to do
Affects up to 3.2.70. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Unauthenticated Content InjectionCVE-2021-4369 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to edit the content and title of every page on the site.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Authenticated Settings ChangeCVE-2021-4368 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfm_save_settings AJAX action. This makes it possible for subscriber-level attackers to edit the plugin settings, such as the allowed upload file types. This can lead to remote code execution through other vulnerabilities.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Unauthenticated Stored Cross-Site ScriptingCVE-2021-4365 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Unauthenticated Arbitrary Post DeletionCVE-2021-4359 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18.2. This is due to lacking authentication protections and lacking a security nonce on the wpfm_delete_file AJAX action. This makes it possible for unauthenticated attackers to delete any posts and pages on the site.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2.CVE-2021-4356 · WordPress plugins & themes · reported by WordfenceCritical 9
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to download arbitrary files on the site, potentially leading to site takeover.
Affected
up to 18.2
What to do
Affects up to 18.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Unauthenticated Post Meta ChangeCVE-2021-4351 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Post Meta Change in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to change the meta data of certain posts and pages.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Frontend File Manager: Unauthenticated HTML InjectionCVE-2021-4350 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This is due to lacking authentication protections on the wpfm_send_file_in_email AJAX action. This makes it possible for unauthenticated attackers to send emails using the site with a custom subject, recipient email, and body with unsanitized HTML content. This effectively lets the attacker use the site as a spam relay.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Frontend File Manager: Privilege EscalationCVE-2021-4344 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to lacking mishandling the use of user IDs that is accessible by the visitor. This makes it possible for unauthenticated or authenticated attackers to access the information and privileges of other users, including 'guest users', in their own category (authenticated, or unauthenticated guests).
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Newsletter Manager: Insecure deserializationCVE-2020-36727 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due to unsanitized input from the 'customFieldsDetails' parameter being passed through a deserialization function. This potentially makes it possible for unauthenticated attackers to inject a serialized PHP object.
Product
Newsletter Manager
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Newsletter Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 5, 2023A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress.CVE-2015-10115 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the function process_request of the file classes/class-woosidebars-sbm-converter.php. The manipulation leads to open redirect. It is possible to initiate the attack remotely. Upgrading to version 1.1.2 is able to address this issue. The patch is named a0efb4ffb9dfe2925b889c1aa5ea40b4abbbda8a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230655.
Product
WooSidebars Sidebar Manager Converter
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WooSidebars Sidebar Manager Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jun 3, 2023CRM and Lead Management by vcita: Cross-Site Request ForgeryCVE-2023-2405 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.0. This is due to missing nonce validation in the vcita-callback.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
CRM and Lead Management by vcita
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 3, 2023CRM and Lead Management by vcita: Stored Cross-Site ScriptingCVE-2023-2404 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CRM and Lead Management by vcita
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update CRM and Lead Management by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
May 30, 2023Download Manager: Does not adequately validate passwords for password-protected filesCVE-2023-1524 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's password.
Product
Download Manager
Fixed in
3.2.71
What to do
Update Download Manager to 3.2.71 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in conlabzgmbh WP Google Tag Manager plugin <= 1.1 versions.CVE-2023-22693 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in conlabzgmbh WP Google Tag Manager plugin <= 1.1 versions.
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.CVE-2022-47136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.
Affected
up to 4.3.4
What to do
Affects up to 4.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.CVE-2022-47164 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in User Meta Manager plugin <= 3.4.9 versions.CVE-2023-23712 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in User Meta Manager plugin <= 3.4.9 versions.
Affected
up to 3.4.9
What to do
Affects up to 3.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0763 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack
Product
Clock In Portal- Staff & Attendance Management
Affected
up to 2.1
What to do
Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0762 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack
Product
Clock In Portal- Staff & Attendance Management
Affected
up to 2.1
What to do
Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0761 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack
Product
Clock In Portal- Staff & Attendance Management
Affected
up to 2.1
What to do
Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023WP Inventory Manager: Does not sanitise and escape the message parameter before outputting it back in the pageCVE-2023-1806 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
Product
WP Inventory Manager
Fixed in
2.1.0.12
What to do
Update WP Inventory Manager to 2.1.0.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Video List Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1408 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Video List Manager
Affected
up to 1.7
What to do
Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Cloud Manager: Does not sanitise and escape the query param ricerca before outputting it in an admin panelCVE-2023-0421 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.
Product
Cloud Manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update Cloud Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2023Download Manager: Leaks master key information without the need for a passwordCVE-2023-1809 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files.
Product
Download Manager
Fixed in
6.3.0
What to do
Update Download Manager to 6.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023Custom Post Type and Taxonomy GUI Manager: Does not have CSRFCVE-2023-0420 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF
Product
Custom Post Type and Taxonomy GUI Manager
Affected
up to 1.1
What to do
Affects up to 1.1. Update Custom Post Type and Taxonomy GUI Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions.CVE-2023-22718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions.
Fixed in
3.5.0
What to do
Update the plugin to 3.5.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 16, 2023Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.CVE-2023-22687 · WordPress plugins & themes · reported by PatchstackLow 3.7
Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.
Affected
up to 1.9.4.0
What to do
Affects up to 1.9.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions.CVE-2023-23801 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions.
Fixed in
1.0.7
What to do
Update the plugin to 1.0.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 5, 2023WCFM Frontend Manager: Cross-Site Request ForgeryCVE-2022-4938 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WCFM Frontend Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.6.0 due to missing nonce checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying knowledge bases, modifying notices, modifying payments, managing vendors, capabilities, and so much more, via a forged request granted they can trick a site's administrator into performing an action such as clicking on a link. There were hundreds of AJAX endpoints affected.
Product
WCFM Frontend Manager
Affected
up to 6.6.0
What to do
Affects up to 6.6.0. Update WCFM Frontend Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 5, 2023WCFM Frontend Manager: Unauthorized modification and access of dataCVE-2022-4937 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying knowledge bases, modifying notices, modifying payments, managing vendors, capabilities, and so much more. There were hundreds of AJAX endpoints affected.
Product
WCFM Frontend Manager
Affected
up to 6.6.0
What to do
Affects up to 6.6.0. Update WCFM Frontend Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.