Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 27 of 39
Oct 10, 2022Taskbuilder: Does not validate and sanitise task's attachmentsCVE-2022-3137 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file
- Product
- Taskbuilder
- Fixed in
- 1.0.8
- What to do
- Update Taskbuilder to 1.0.8 or newer.
Oct 10, 2022Social Rocket: Does not sanitise and escape some of its settingsCVE-2022-3136 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Rocket
- Fixed in
- 1.3.3
- What to do
- Update Social Rocket to 1.3.3 or newer.
Oct 10, 2022Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its Gallery Image parametersCVE-2022-2823 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Slider, Gallery, and Carousel by MetaSlider
- Fixed in
- 3.27.9
- What to do
- Update Slider, Gallery, and Carousel by MetaSlider to 3.27.9 or newer.
Oct 10, 2022Top Bar: Does not sanitise and escape some of its settings before outputting them in frontend pagesCVE-2022-2629 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Top Bar
- Fixed in
- 3.0.4
- What to do
- Update Top Bar to 3.0.4 or newer.
Oct 10, 2022reSmush.it: Does not sanitise and escape some of its settingsCVE-2022-2448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- reSmush.it
- Fixed in
- 0.4.6
- What to do
- Update reSmush.it to 0.4.6 or newer.
Oct 10, 2022Cryptocurrency Pricing list and Ticker: Does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embedCVE-2021-25044 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue
- Product
- Cryptocurrency Pricing list and Ticker
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Cryptocurrency Pricing list and Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2022Goolytics: Does not sanitise and escape some of its settingsCVE-2022-3132 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Goolytics
- Fixed in
- 1.1.2
- What to do
- Update Goolytics to 1.1.2 or newer.
Oct 3, 2022Donation Thermometer: Does not sanitise and escape some of its settingsCVE-2022-3128 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Donation Thermometer
- Fixed in
- 2.1.3
- What to do
- Update Donation Thermometer to 2.1.3 or newer.
Oct 3, 2022WP Socializer: Does not sanitise and escape some of its Icons settingsCVE-2022-2763 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Socializer
- Fixed in
- 7.3
- What to do
- Update WP Socializer to 7.3 or newer.
Oct 3, 2022DSGVO All in one for WP: Does not sanitise and escape some of its settingsCVE-2022-2628 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DSGVO All in one for WP
- Fixed in
- 4.2
- What to do
- Update DSGVO All in one for WP to 4.2 or newer.
Sep 26, 2022SEO Smart Links: Does not sanitise and escape some of its settingsCVE-2022-3135 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SEO Smart Links
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update SEO Smart Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Generate PDF: Does not sanitise and escape its settingsCVE-2022-3070 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Generate PDF
- Fixed in
- 3.6
- What to do
- Update Generate PDF to 3.6 or newer.
Sep 26, 2022WordLift: Does not sanitise and escape its settingsCVE-2022-3069 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordLift
- Fixed in
- 3.37.2
- What to do
- Update WordLift to 3.37.2 or newer.
Sep 26, 2022WP Popup Builder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2404 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Popup Builder
- Fixed in
- 1.2.9
- What to do
- Update WP Popup Builder to 1.2.9 or newer.
Sep 19, 2022NEX-Forms: Does not properly sanitise and escape user input before using it in SQL statementsCVE-2022-3142 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Product
- NEX-Forms
- Fixed in
- 7.9.7
- What to do
- Update NEX-Forms to 7.9.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.commedium.com
Sep 19, 2022Gettext override translations: Does not sanitise and escape some of its settingsCVE-2022-3036 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Gettext override translations
- Fixed in
- 2.0.0
- What to do
- Update Gettext override translations to 2.0.0 or newer.
Sep 19, 2022Slickr Flickr: Does not sanitise and escape its settingsCVE-2022-3021 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Slickr Flickr
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Slickr Flickr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022BadgeOS: Does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated usersCVE-2022-2958 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections
- Product
- BadgeOS
- Fixed in
- 3.7.1.3
- What to do
- Update BadgeOS to 3.7.1.3 or newer.
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.5
- What to do
- Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 19, 2022Ketchup Restaurant Reservations: Does not sanitise and escape some of the reservation user inputsCVE-2022-2753 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made
- Product
- Ketchup Restaurant Reservations
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ketchup Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022Form Builder CP: Does not sanitise and escape some of its form settingsCVE-2022-2567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Form Builder CP
- Fixed in
- 1.2.32
- What to do
- Update Form Builder CP to 1.2.32 or newer.
Sep 16, 2022Migration, Backup, Staging: Does not sanitise and validate a parameter before using it to read the content of a fileCVE-2022-2863 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.76
- What to do
- Update Migration, Backup, Staging to 0.9.76 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 16, 2022Affiliates Manager: Does not sanitise and escape some of its settingsCVE-2022-2799 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Affiliates Manager
- Fixed in
- 2.9.14
- What to do
- Update Affiliates Manager to 2.9.14 or newer.
Sep 16, 2022Affiliates Manager: Does not validate and sanitise the affiliate dataCVE-2022-2798 · WordPress plugins & themes · reported by WPScanHigh 8
The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data
- Product
- Affiliates Manager
- Fixed in
- 2.9.14
- What to do
- Update Affiliates Manager to 2.9.14 or newer.
Sep 16, 2022WP STAGING: Does not sanitise and escape some of its settingsCVE-2022-2737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP STAGING
- Fixed in
- 2.9.18
- What to do
- Update WP STAGING to 2.9.18 or newer.
Sep 16, 2022WP Taxonomy Import: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2669 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Taxonomy Import
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP Taxonomy Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2022Autoptimize: Does not sanitise and escape some of its settingsCVE-2022-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Autoptimize
- Fixed in
- 3.1.1
- What to do
- Update Autoptimize to 3.1.1 or newer.
Sep 16, 2022WBW Currency Switcher for WooCommerce: Does not sanitise and escape some of its settingsCVE-2022-2575 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WBW Currency Switcher for WooCommerce
- Fixed in
- 1.6.6
- What to do
- Update WBW Currency Switcher for WooCommerce to 1.6.6 or newer.
Sep 5, 2022Fast Flow: Does not sanitise and escape some of its Widget settingsCVE-2022-2775 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fast Flow
- Fixed in
- 1.2.13
- What to do
- Update Fast Flow to 1.2.13 or newer.
Sep 5, 2022Simple Payment Donations & Subscriptions: Does not sanitise and escape user input given in its formsCVE-2022-2565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
- Product
- Simple Payment Donations & Subscriptions
- Fixed in
- 4.2.1
- What to do
- Update Simple Payment Donations & Subscriptions to 4.2.1 or newer.
Aug 29, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape some parameters before outputting them back in an admin dashboardCVE-2022-2599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting
- Product
- Anti-Malware Security and Brute-Force Firewall
- Fixed in
- 4.21.83
- What to do
- Update Anti-Malware Security and Brute-Force Firewall to 4.21.83 or newer.
Aug 29, 2022Fluent Support: Does not properly sanitiseCVE-2022-2559 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users
- Product
- Fluent Support
- Fixed in
- 1.5.8
- What to do
- Update Fluent Support to 1.5.8 or newer.
Aug 29, 2022WooCommerce PDF Invoices & Packing Slips: Does not sanitise and escape some parameters before outputting them back in an attributes of an admin pageCVE-2022-2537 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Fixed in
- 3.0.1
- What to do
- Update WooCommerce PDF Invoices & Packing Slips to 3.0.1 or newer.
Aug 29, 2022Simply Schedule Appointments: Does not sanitise and escape some of its settingsCVE-2022-2374 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simply Schedule Appointments
- Fixed in
- 1.5.7.7
- What to do
- Update Simply Schedule Appointments to 1.5.7.7 or newer.
Aug 22, 2022Better Search Replace: Does not properly sanitise and escape table data before inserting it into a SQL queryCVE-2022-2593 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks
- Product
- Better Search Replace
- Fixed in
- 1.4.1
- What to do
- Update Better Search Replace to 1.4.1 or newer.
Aug 22, 2022Feed Them Social: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2532 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Feed Them Social
- Fixed in
- 3.0.1
- What to do
- Update Feed Them Social to 3.0.1 or newer.
Aug 22, 2022Feed Them Social: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2383 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Feed Them Social
- Fixed in
- 3.0.1
- What to do
- Update Feed Them Social to 3.0.1 or newer.
Aug 22, 2022WP Social Chat: Does not sanitise and escape some of its settingsCVE-2022-2361 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks.
- Product
- WP Social Chat
- Fixed in
- 6.0.5
- What to do
- Update WP Social Chat to 6.0.5 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the order and orderby parameters before using them in a SQL statementCVE-2022-25811 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Rezgo Online Booking: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2022-1932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file
- Product
- Rezgo Online Booking
- Fixed in
- 4.1.8
- What to do
- Update Rezgo Online Booking to 4.1.8 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the tk0 parameter from the tp_translation AJAX actionCVE-2021-24911 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated usersCVE-2021-24910 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 15, 2022Digital Publications by Supsystic: Does not sanitise and escape its settingsCVE-2022-2384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Digital Publications by Supsystic
- Fixed in
- 1.7.4
- What to do
- Update Digital Publications by Supsystic to 1.7.4 or newer.
Aug 15, 2022Easy Student Results: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2378 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Easy Student Results
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Easy Student Results to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 15, 2022WP-DBManager: Does not prevent administrators from running arbitrary commands on the server in multisite installationsCVE-2022-2354 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.
- Product
- WP-DBManager
- Fixed in
- 2.80.8
- What to do
- Update WP-DBManager to 2.80.8 or newer.
Aug 15, 2022Duplicate Page and Post: Does not sanitise and escape its settingsCVE-2022-2152 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Duplicate Page and Post
- Fixed in
- 2.8
- What to do
- Update Duplicate Page and Post to 2.8 or newer.
Aug 15, 2022Contact Form DB: Does not sanitise and escape some parameters before outputting them back in attributesCVE-2022-2116 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Contact Form DB
- Fixed in
- 1.8.0
- What to do
- Update Contact Form DB to 1.8.0 or newer.
Aug 8, 2022Thinkific Uploader: Does not sanitise and escape its settingsCVE-2022-2426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.
- Product
- Thinkific Uploader
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Thinkific Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022WP DS Blog Map: Does not sanitise and escape some of its settingsCVE-2022-2425 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP DS Blog Map
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update WP DS Blog Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Google Maps Anywhere: Does not sanitise and escape any of its settingsCVE-2022-2424 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Google Maps Anywhere
- Affected
- up to 1.2.6.3
- What to do
- Affects up to 1.2.6.3. Update Google Maps Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.