Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,626 results · page 278 of 313
Nov 28, 2022Image Hover Effects Css3: Does not sanitise and escape some of its settingsCVE-2022-3601 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Hover Effects Css3
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update Image Hover Effects Css3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Checkout Field Editor (Checkout Manager) for WooCommerce: Unserializes user input provided via the settingsCVE-2022-3490 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Checkout Field Editor (Checkout Manager) for WooCommerce
- Fixed in
- 1.8.0
- What to do
- Update Checkout Field Editor (Checkout Manager) for WooCommerce to 1.8.0 or newer.
Nov 28, 2022Salat Times: Does not sanitize and escapes its settingsCVE-2022-2983 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Salat Times
- Fixed in
- 3.2.2
- What to do
- Update Salat Times to 3.2.2 or newer.
Nov 28, 2022Find and Replace All: Does not sanitize and escape some parameters from its setting page before outputting them back to the userCVE-2022-2311 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 21, 2022Evaluate: Does not sanitize and escapes some of its settingsCVE-2022-3753 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Evaluate
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Evaluate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2022The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.CVE-2022-3750 · WordPress plugins & themes · reported by WPScanMedium 4.7
The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.
- Fixed in
- 6.8.7
- What to do
- Update the plugin to 6.8.7 or newer.
Nov 21, 2022Spacer: Does not sanitize and escapes some of its settingsCVE-2022-3618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Spacer
- Fixed in
- 3.0.7
- What to do
- Update Spacer to 3.0.7 or newer.
Nov 21, 2022WP-Polls: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1581 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
- Product
- WP-Polls
- Fixed in
- 2.76.0
- What to do
- Update WP-Polls to 2.76.0 or newer.
Full record and what to do →NVD recordwpscan.comhightechdad.com
Nov 18, 2022Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.CVE-2022-41615 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 18, 2022Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.CVE-2022-40695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.
- Affected
- up to 8.9
- What to do
- Affects up to 8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 18, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.CVE-2022-38075 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
- Affected
- up to 0.13
- What to do
- Affects up to 0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 17, 2022Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.CVE-2022-41132 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.
- Affected
- up to 2.8.8
- What to do
- Affects up to 2.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 16, 2022The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1.CVE-2022-4022 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are not sanitized. While version 2.5 adds the ability to sanitize image as they are uploaded, the plugin defaults to disable sanitization and does not restrict SVG upload to only administrators. This allows authenticated attackers, with author-level privileges and higher, to upload malicious SVG files that can be embedded in posts and pages by higher privileged users. Additionally, the embedded JavaScript is also triggered on visiting the image URL, which allows an attacker to execute malicious code in browsers visiting that URL.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 14, 2022OAuth Client by DigitialPixies: Does not sanitize and escapes some of its settingsCVE-2022-3631 · WordPress plugins & themes · reported by WPScanMedium 4.8
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- OAuth Client by DigitialPixies
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2022ProfileGrid: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-3578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- ProfileGrid
- Fixed in
- 5.1.1
- What to do
- Update ProfileGrid to 5.1.1 or newer.
Nov 14, 2022Testimonials WordPress plugin before 2.7, super-testimonial-pro: Do not sanitize and escape its settingsCVE-2022-3539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Testimonials WordPress plugin before 2.7, super-testimonial-pro
- Fixed in
- 2.7
- What to do
- Update Testimonials WordPress plugin before 2.7, super-testimonial-pro to 2.7 or newer.
Nov 14, 2022The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.CVE-2022-3484 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- What to do
- Update the plugin to the newest version.
Nov 14, 2022WP Attachments: Does not sanitize and escapes some of its settingsCVE-2022-3469 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- WP Attachments
- Fixed in
- 5.0.5
- What to do
- Update WP Attachments to 5.0.5 or newer.
Nov 10, 2022Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.CVE-2022-42460 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.CVE-2022-44741 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.CVE-2022-43491 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.
- Affected
- up to 4.1.5
- What to do
- Affects up to 4.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPCVE-2022-41136 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.
- Affected
- up to 5.12.0
- What to do
- Affects up to 5.12.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 8, 2022Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.CVE-2022-40223 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comsearchwp.com
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.CVE-2022-32587 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.
- Affected
- up to 3.9
- What to do
- Affects up to 3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 7, 2022Highlight Focus: Does not sanitise and escape some of its settingsCVE-2022-3462 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Highlight Focus
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Highlight Focus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 7, 2022Import any XML or CSV File to: Is not validating the paths of files contained in uploaded zip archivesCVE-2022-2711 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.9
- What to do
- Update Import any XML or CSV File to to 3.6.9 or newer.
Nov 3, 2022JumpDEMAND Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-44628 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.
- Product
- JumpDEMAND Inc
- Affected
- up to 0.2.17
- What to do
- Affects up to 0.2.17. Update JumpDEMAND Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 31, 2022Rock Convert: Does not sanitise and escape some of its settingsCVE-2022-3441 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Rock Convert
- Fixed in
- 2.11.0
- What to do
- Update Rock Convert to 2.11.0 or newer.
Oct 31, 2022Rock Convert: Does not sanitise and escape an URL before outputting it back in an attributeCVE-2022-3440 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting
- Product
- Rock Convert
- Fixed in
- 2.11.0
- What to do
- Update Rock Convert to 2.11.0 or newer.
Oct 31, 2022Official Integration for Billingo: Does not sanitise and escape some of its settingsCVE-2022-3420 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users with a role as low as Shop Manager to perform Stored Cross-Site Scripting attacks.
- Product
- Official Integration for Billingo
- Fixed in
- 3.4.0
- What to do
- Update Official Integration for Billingo to 3.4.0 or newer.
Oct 31, 2022WP Word Count: Does not sanitise and escape some of its settingsCVE-2022-3408 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Word Count WordPress plugin through 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WP Word Count
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update WP Word Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2022WP Contact Slider: Does not sanitize and escape its settingsCVE-2022-3237 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Contact Slider
- Fixed in
- 2.4.8
- What to do
- Update WP Contact Slider to 2.4.8 or newer.
Oct 31, 2022WP Total Hacks: Does not prevent low privilege users from modifying the plugin's settingsCVE-2022-3096 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other users, like administrators, due to the lack of sanitisation and escaping as well.
- Product
- WP Total Hacks
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update WP Total Hacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2022Newspaper: Does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX actionCVE-2022-2627 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting.
- Product
- Newspaper
- Fixed in
- 12
- What to do
- Update Newspaper to 12 or newer.
Oct 31, 2022Gallery Plugin for: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2190 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- Gallery Plugin for
- Fixed in
- 1.8.4.7
- What to do
- Update Gallery Plugin for to 1.8.4.7 or newer.
Oct 31, 2022Newspaper: Does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX actionCVE-2022-2167 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- Newspaper
- Fixed in
- 12
- What to do
- Update Newspaper to 12 or newer.
Oct 28, 2022Log HTTP Requests: Stored Cross-Site ScriptingCVE-2022-3402 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers who can trick a site's administrator into performing an action like clicking on a link, or an authenticated user with access to a page that sends a request using user-supplied data via the server, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Log HTTP Requests
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Log HTTP Requests to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 25, 2022WP Humans.txt: Does not sanitise and escape some of its settingsCVE-2022-3392 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Humans.txt WordPress plugin through 1.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Humans.txt
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WP Humans.txt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2022Retain Live Chat: Does not sanitise and escape some of its settingsCVE-2022-3391 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Retain Live Chat
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Retain Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2022Contact Bank: Does not sanitise and escape some of its Form settingsCVE-2022-3350 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Contact Bank
- Affected
- up to 3.0.30
- What to do
- Affects up to 3.0.30. Update Contact Bank to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2022We’re Open!: Does not sanitise and escape some of its settingsCVE-2022-3139 · WordPress plugins & themes · reported by WPScanMedium 4.8
The We’re Open! WordPress plugin before 1.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- We’re Open!
- Fixed in
- 1.42
- What to do
- Update We’re Open! to 1.42 or newer.
Oct 17, 2022Meks Easy Social Share: Does not sanitise and escape some of its settingsCVE-2022-2574 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Meks Easy Social Share WordPress plugin before 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Meks Easy Social Share
- Fixed in
- 1.2.8
- What to do
- Update Meks Easy Social Share to 1.2.8 or newer.
Oct 11, 2022Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.CVE-2022-38086 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.
- Affected
- up to 5.12.0
- What to do
- Affects up to 5.12.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 11, 2022Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 at WordPress.CVE-2021-36899 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 at WordPress.
- Affected
- up to 1.3.8.4
- What to do
- Affects up to 1.3.8.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 11, 2022Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress.CVE-2022-33978 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability FontMeister plugin <= 1.08 at WordPress.
- Affected
- up to 1.08
- What to do
- Affects up to 1.08. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 10, 2022Advanced Comment Form: Does not sanitise and escape its settingsCVE-2022-3220 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Advanced Comment Form
- Fixed in
- 1.2.1
- What to do
- Update Advanced Comment Form to 1.2.1 or newer.
Oct 10, 2022Simple File List: Does not sanitise and escape some of its settingsCVE-2022-3207 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple File List
- Fixed in
- 4.4.12
- What to do
- Update Simple File List to 4.4.12 or newer.
Oct 10, 2022Social Rocket: Does not sanitise and escape some of its settingsCVE-2022-3136 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Rocket
- Fixed in
- 1.3.3
- What to do
- Update Social Rocket to 1.3.3 or newer.
Oct 10, 2022Top Bar: Does not sanitise and escape some of its settings before outputting them in frontend pagesCVE-2022-2629 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Top Bar
- Fixed in
- 3.0.4
- What to do
- Update Top Bar to 3.0.4 or newer.
Oct 10, 2022reSmush.it: Does not sanitise and escape some of its settingsCVE-2022-2448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- reSmush.it
- Fixed in
- 0.4.6
- What to do
- Update reSmush.it to 0.4.6 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.