Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,626 results · page 274 of 313
Jan 30, 2023Portfolio for Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Portfolio for Elementor
- Fixed in
- 2.3.1
- What to do
- Update Portfolio for Elementor to 2.3.1 or newer.
Jan 30, 2023Icon Widget: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4763 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Icon Widget
- Fixed in
- 1.3.0
- What to do
- Update Icon Widget to 1.3.0 or newer.
Jan 30, 2023Posts List Designer by Category: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4749 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Posts List Designer by Category
- Fixed in
- 3.2
- What to do
- Update Posts List Designer by Category to 3.2 or newer.
Jan 30, 2023MediaElement.js: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4699 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
- Product
- MediaElement.js
- Affected
- up to 4.2.8
- What to do
- Affects up to 4.2.8. Update MediaElement.js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023Revive Old Posts: Unserializes user input provided via the settingsCVE-2022-4680 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- Revive Old Posts
- Fixed in
- 9.0.11
- What to do
- Update Revive Old Posts to 9.0.11 or newer.
Jan 30, 2023PixCodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- PixCodes
- Fixed in
- 2.3.7
- What to do
- Update PixCodes to 2.3.7 or newer.
Jan 30, 2023RSS Aggregator by Feedzy: Does not validate and escape some of its block options before outputting them back in the pageCVE-2022-4667 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- RSS Aggregator by Feedzy
- Fixed in
- 4.1.1
- What to do
- Update RSS Aggregator by Feedzy to 4.1.1 or newer.
Jan 30, 2023Simple Sitemap: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4472 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Simple Sitemap
- Fixed in
- 3.5.8
- What to do
- Update Simple Sitemap to 3.5.8 or newer.
Jan 30, 2023Widgets for Google Reviews: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4470 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Widgets for Google Reviews
- Fixed in
- 9.8
- What to do
- Update Widgets for Google Reviews to 9.8 or newer.
Jan 30, 2023Panda Pods Repeater Field: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.
- Product
- Panda Pods Repeater Field
- Fixed in
- 1.5.4
- What to do
- Update Panda Pods Repeater Field to 1.5.4 or newer.
Jan 27, 2023Quick Restaurant Menu: Stored Cross-Site ScriptingCVE-2023-0553 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Quick Restaurant Menu
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Quick Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 26, 2023The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vuCVE-2023-0448 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.1
The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.
- Fixed in
- 4.3
- What to do
- Update the plugin to 4.3 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 23, 2023My YouTube Channel: Stored Cross-Site ScriptingCVE-2023-0446 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- My YouTube Channel
- Affected
- up to 3.0.12.1
- What to do
- Affects up to 3.0.12.1. Update My YouTube Channel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 23, 2023Store Locator: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4832 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Store Locator
- Fixed in
- 1.4.9
- What to do
- Update Store Locator to 1.4.9 or newer.
Jan 23, 2023GeoDirectory: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4775 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- GeoDirectory
- Fixed in
- 2.2.22
- What to do
- Update GeoDirectory to 2.2.22 or newer.
Jan 23, 2023OneClick Chat to Order: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- OneClick Chat to Order
- Fixed in
- 1.0.4.2
- What to do
- Update OneClick Chat to Order to 1.0.4.2 or newer.
Jan 23, 202310WebMapBuilder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4758 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- 10WebMapBuilder
- Fixed in
- 1.0.72
- What to do
- Update 10WebMapBuilder to 1.0.72 or newer.
Jan 23, 2023Print-O-Matic: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4753 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Print-O-Matic
- Fixed in
- 2.1.8
- What to do
- Update Print-O-Matic to 2.1.8 or newer.
Jan 23, 2023Word Balloon: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4751 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Word Balloon
- Fixed in
- 4.19.3
- What to do
- Update Word Balloon to 4.19.3 or newer.
Jan 23, 2023FluentAuth: Prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-4746 · WordPress plugins & themes · reported by WPScanHigh 7.5
The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.
- Product
- FluentAuth
- Fixed in
- 1.0.2
- What to do
- Update FluentAuth to 1.0.2 or newer.
Jan 23, 2023Landing Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Landing Page Builder
- Fixed in
- 1.4.9.9
- What to do
- Update Landing Page Builder to 1.4.9.9 or newer.
Jan 23, 2023WP Popups: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4716 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Popups
- Fixed in
- 2.1.4.8
- What to do
- Update WP Popups to 2.1.4.8 or newer.
Jan 23, 2023Structured Content: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4715 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Structured Content
- Fixed in
- 1.5.1
- What to do
- Update Structured Content to 1.5.1 or newer.
Jan 23, 2023Genesis Columns Advanced: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4706 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
- Product
- Genesis Columns Advanced
- Fixed in
- 2.0.4
- What to do
- Update Genesis Columns Advanced to 2.0.4 or newer.
Jan 23, 2023WordPress Simple Shopping Cart: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4672 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WordPress Simple Shopping Cart
- Fixed in
- 4.6.2
- What to do
- Update WordPress Simple Shopping Cart to 4.6.2 or newer.
Jan 23, 2023Easy Appointments: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4668 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Appointments
- Fixed in
- 3.11.2
- What to do
- Update Easy Appointments to 3.11.2 or newer.
Jan 23, 2023Product Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4629 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Product Slider for WooCommerce
- Fixed in
- 2.6.4
- What to do
- Update Product Slider for WooCommerce to 2.6.4 or newer.
Jan 23, 2023ShiftNav: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- ShiftNav
- Fixed in
- 1.7.2
- What to do
- Update ShiftNav to 1.7.2 or newer.
Jan 23, 2023Login Logout Menu: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4625 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Login Logout Menu
- Fixed in
- 1.4.0
- What to do
- Update Login Logout Menu to 1.4.0 or newer.
Jan 23, 2023GS Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4624 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- GS Logo Slider
- Fixed in
- 3.3.8
- What to do
- Update GS Logo Slider to 3.3.8 or newer.
Jan 23, 2023Easy Bootstrap Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4576 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Bootstrap Shortcode
- Affected
- up to 4.5.4
- What to do
- Affects up to 4.5.4. Update Easy Bootstrap Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023Top 10: Does not validate and escape some of its Block attributes before outputting them back in the pageCVE-2022-4570 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Top 10
- Fixed in
- 3.2.3
- What to do
- Update Top 10 to 3.2.3 or newer.
Jan 23, 2023Sitemap: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4545 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Sitemap
- Fixed in
- 4.4
- What to do
- Update Sitemap to 4.4 or newer.
Jan 23, 2023Compact WP Audio Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4542 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Compact WP Audio Player
- Fixed in
- 1.9.8
- What to do
- Update Compact WP Audio Player to 1.9.8 or newer.
Jan 23, 2023Content Control: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.
- Product
- Content Control
- Fixed in
- 1.1.10
- What to do
- Update Content Control to 1.1.10 or newer.
Jan 23, 2023Page-list: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4485 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Page-list
- Fixed in
- 5.3
- What to do
- Update Page-list to 5.3 or newer.
Jan 23, 2023Collapse-O-Matic: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4475 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Collapse-O-Matic
- Fixed in
- 1.8.3
- What to do
- Update Collapse-O-Matic to 1.8.3 or newer.
Jan 23, 2023Easy Social Feed: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4474 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Easy Social Feed
- Fixed in
- 6.4.0
- What to do
- Update Easy Social Feed to 6.4.0 or newer.
Jan 23, 2023Search & Filter: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4467 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Search & Filter
- Fixed in
- 1.2.16
- What to do
- Update Search & Filter to 1.2.16 or newer.
Jan 23, 2023All-In-One Security (AIOS): Leaked settings of the plugin publiclyCVE-2022-4346 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.3
- What to do
- Update All-In-One Security (AIOS) to 5.1.3 or newer.
Jan 23, 2023Analyticator: Unserializes user input provided via the settingsCVE-2022-4323 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Analyticator
- Fixed in
- 6.5.6
- What to do
- Update Analyticator to 6.5.6 or newer.
Jan 23, 2023WP Limit Login Attempts: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-4303 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms.
- Product
- WP Limit Login Attempts
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update WP Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023EU Cookie Law for GDPR/CCPA: Does not sanitise and escape some of its settingsCVE-2022-3811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- EU Cookie Law for GDPR/CCPA
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update EU Cookie Law for GDPR/CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023Analyticator: Unserializes user input provided via the settingsCVE-2022-3425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- Analyticator
- Fixed in
- 6.5.6
- What to do
- Update Analyticator to 6.5.6 or newer.
Jan 20, 2023The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qemCVE-2023-23491 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.1
The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.
- Fixed in
- 9.7.5
- What to do
- Update the plugin to 9.7.5 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 16, 2023Real Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4648 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Real Testimonials
- Fixed in
- 2.6.0
- What to do
- Update Real Testimonials to 2.6.0 or newer.
Jan 16, 2023Video Conferencing with Zoom: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4578 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Video Conferencing with Zoom
- Fixed in
- 4.0.10
- What to do
- Update Video Conferencing with Zoom to 4.0.10 or newer.
Jan 16, 2023Seriously Simple Podcasting: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Seriously Simple Podcasting
- Fixed in
- 2.19.1
- What to do
- Update Seriously Simple Podcasting to 2.19.1 or newer.
Jan 16, 2023MashShare: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- MashShare
- Fixed in
- 3.8.7
- What to do
- Update MashShare to 3.8.7 or newer.
Jan 16, 2023ConvertKit: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4508 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- ConvertKit
- Fixed in
- 2.0.5
- What to do
- Update ConvertKit to 2.0.5 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.