Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

172 results · page 3 of 4

May 22, 2024WP Font Awesome Share Icons: Stored Cross-Site ScriptingCVE-2024-3198 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Font Awesome Share Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpfai_social' shortcode in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Font Awesome Share Icons
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Font Awesome Share Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
May 21, 2024Social Icons Widget & Block by WPZOOM: Does not sanitise and escape some of its Widget settingsCVE-2024-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Social Icons Widget & Block by WPZOOM
Fixed in
4.2.18
What to do
Update Social Icons Widget & Block by WPZOOM to 4.2.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2024Menu Icons by ThemeIsle: Stored Cross-Site ScriptingCVE-2024-4635 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘add_mime_type’ function in versions up to, and including, 0.13.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Menu Icons by ThemeIsle
Affected
up to 0.13.13
What to do
Affects up to 0.13.13. Update Menu Icons by ThemeIsle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 14, 2024Pk Favicon Manager: Unrestricted Upload of File with Dangerous TypeCVE-2024-34416 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Pk Favicon Manager.This issue affects Pk Favicon Manager: from n/a through 2.1.
Product
Pk Favicon Manager
Affected
up to 2.1
What to do
Affects up to 2.1. Update Pk Favicon Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2024Icon Widget: Stored Cross-Site ScriptingCVE-2024-1993 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Icon Widget
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Icon Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 29, 2024Easy Set Favicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eftakhairul Islam & Sirajus Salayhin Easy Set Favicon allows Reflected XSS.This issue affects Easy Set Favicon: from n/a through 1.1.
Product
Easy Set Favicon
Affected
up to 1.1
What to do
Affects up to 1.1. Update Easy Set Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 24, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-2972 · WordPress plugins & themes · reported by WPScanLow 3.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
Fixed in
3.1.9
What to do
Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2024JVM rich text icons: Missing AuthorizationCVE-2023-51418 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Missing Authorization vulnerability in Joris van Montfort JVM rich text icons.This issue affects JVM rich text icons: from n/a through 1.2.6.
Product
JVM rich text icons
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update JVM rich text icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Social Media Share Buttons & Social Sharing Icons: Does not sanitise and escape some of its settingsCVE-2024-2118 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Social Media Share Buttons & Social Sharing Icons
Fixed in
2.8.9
What to do
Update Social Media Share Buttons & Social Sharing Icons to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Favicon: Cross-Site Request Forgery (CSRF)CVE-2024-31422 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Philippe Bernard Favicon.This issue affects Favicon: from n/a through 1.3.29.
Product
Favicon
Affected
up to 1.3.29
What to do
Affects up to 1.3.29. Update Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Web Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30445 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab, Inc. Web Icons allows Stored XSS.This issue affects Web Icons: from n/a through 1.0.0.10.
Product
Web Icons
Affected
up to 1.0.0.10
What to do
Affects up to 1.0.0.10. Update Web Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2024Lordicon Animated Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30519 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lordicon Lordicon Animated Icons allows Stored XSS.This issue affects Lordicon Animated Icons: from n/a through 2.0.1.
Product
Lordicon Animated Icons
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Lordicon Animated Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2024Favicon Rotator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-28001 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Archetyped Favicon Rotator allows Reflected XSS.This issue affects Favicon Rotator: from n/a through 1.2.10.
Product
Favicon Rotator
Affected
up to 1.2.10
What to do
Affects up to 1.2.10. Update Favicon Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2024Web Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29933 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab, Inc. Web Icons allows Stored XSS.This issue affects Web Icons: from n/a through 1.0.0.10.
Product
Web Icons
Affected
up to 1.0.0.10
What to do
Affects up to 1.0.0.10. Update Web Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 19, 2024WooThumbs for WooCommerce by Iconic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29116 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IconicWP WooThumbs for WooCommerce by Iconic allows Reflected XSS.This issue affects WooThumbs for WooCommerce by Iconic: from n/a through 5.5.3.
Product
WooThumbs for WooCommerce by Iconic
Affected
up to 5.5.3
What to do
Affects up to 5.5.3. Update WooThumbs for WooCommerce by Iconic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2024Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: Stored Cross-Site ScriptingCVE-2024-0898 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
Affected
up to 2.3
What to do
Affects up to 2.3. Update Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 26, 2024Icons Font Loader: Unrestricted Upload of File with Dangerous TypeCVE-2024-24714 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Unrestricted Upload of File with Dangerous Type vulnerability in bPlugins LLC Icons Font Loader.This issue affects Icons Font Loader: from n/a through 1.1.4.
Product
Icons Font Loader
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Icons Font Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 23, 2024All In One Favicon: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-24416 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7.
Product
All In One Favicon
Affected
up to 4.7
What to do
Affects up to 4.7. Update All In One Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 1, 2024Themify Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51693 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Icons allows Stored XSS.This issue affects Themify Icons: from n/a through 2.0.1.
Product
Themify Icons
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update Themify Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 29, 2023JVM Gutenberg Rich Text Icons: Unrestricted Upload of File with Dangerous TypeCVE-2023-51417 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.
Product
JVM Gutenberg Rich Text Icons
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update JVM Gutenberg Rich Text Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Menu Image, Icons made easy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50826 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Freshlight Lab Menu Image, Icons made easy allows Stored XSS.This issue affects Menu Image, Icons made easy: from n/a through 3.10.
Product
Menu Image, Icons made easy
Affected
up to 3.10
What to do
Affects up to 3.10. Update Menu Image, Icons made easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 21, 2023Dashicons + Custom Post Types: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2023-22674 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Hal Gatewood Dashicons + Custom Post Types.This issue affects Dashicons + Custom Post Types: from n/a through 1.0.2.
Product
Dashicons + Custom Post Types
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Dashicons + Custom Post Types to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Add to Cart Text Changer and Customize Button, Add Custom Icon: Cross-Site Request Forgery (CSRF)CVE-2023-49153 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart Text Changer and Customize Button, Add Custom Icon: from n/a through 2.0.
Product
Add to Cart Text Changer and Customize Button, Add Custom Icon
Affected
up to 2.0
What to do
Affects up to 2.0. Update Add to Cart Text Changer and Customize Button, Add Custom Icon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: Cross-Site Request Forgery (CSRF)CVE-2023-48769 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3.
Product
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
Affected
up to 2.3
What to do
Affects up to 2.3. Update Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Menu Bar Cart Icon For WooCommerce By Binary Carpenter: Cross-Site Request Forgery (CSRF)CVE-2023-49855 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in BinaryCarpenter Menu Bar Cart Icon For WooCommerce By Binary Carpenter.This issue affects Menu Bar Cart Icon For WooCommerce By Binary Carpenter: from n/a through 1.49.3.
Product
Menu Bar Cart Icon For WooCommerce By Binary Carpenter
Affected
up to 1.49.3
What to do
Affects up to 1.49.3. Update Menu Bar Cart Icon For WooCommerce By Binary Carpenter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Easy Social Icons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48336 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cybernetikz Easy Social Icons allows Stored XSS.This issue affects Easy Social Icons: from n/a through 3.2.4.
Product
Easy Social Icons
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update Easy Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Icons Font Loader: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-46084 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This issue affects Icons Font Loader: from n/a through 1.1.2.
Product
Icons Font Loader
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Icons Font Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 2, 2023Icons Font Loader: Arbitrary file uploadsCVE-2023-5860 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Icons Font Loader
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Icons Font Loader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Social Media Share Buttons & Social Sharing Icons: Cross-Site Request ForgeryCVE-2023-5602 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Social Media Share Buttons & Social Sharing Icons
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Social Media Share Buttons & Social Sharing Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Social Media Share Buttons & Social Sharing Icons: Sensitive Information ExposureCVE-2023-5070 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.
Product
Social Media Share Buttons & Social Sharing Icons
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Social Media Share Buttons & Social Sharing Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Matias s Shockingly Simple Favicon plugin <= 1.8.2 versions.CVE-2023-44246 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Matias s Shockingly Simple Favicon plugin <= 1.8.2 versions.
Affected
up to 1.8.2
What to do
Affects up to 1.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 28, 2023Font Awesome More Icons: Stored Cross-Site ScriptingCVE-2023-5232 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Font Awesome More Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' shortcode in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Font Awesome More Icons
Affected
up to 3.5
What to do
Affects up to 3.5. Update Font Awesome More Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions.CVE-2023-25036 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions.
Affected
up to 1.6
What to do
Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 5, 2023A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress.CVE-2015-10116 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_new_favicon of the file admin/class-favicon-by-realfavicongenerator-admin.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.2.13 is able to address this issue. The identifier of the patch is 949a1ae7216216350458844f50a72f100b56d4e7. It is recommended to upgrade the affected component. The identifier VDB-230661 was assigned to this vulnerability.
Product
RealFaviconGenerator Favicon
Affected
up to 1.2.12
What to do
Affects up to 1.2.12. Update RealFaviconGenerator Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Apr 30, 2023A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress.CVE-2015-10104 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.
Affected
1.0.0 to 1.0.0
What to do
Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion.CVE-2023-23983 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion.
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.CVE-2023-24382 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Photon WP Material Design Icons for Page Builders plugin <= 1.4.2 versions.
Fixed in
1.4.3
What to do
Update the plugin to 1.4.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 30, 2023Icon Widget: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4763 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Icon Widget
Fixed in
1.3.0
What to do
Update Icon Widget to 1.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3858 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin.
Product
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button
Fixed in
3.0.3
What to do
Update Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button to 3.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 3, 2022WP Socializer: Does not sanitise and escape some of its Icons settingsCVE-2022-2763 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Socializer
Fixed in
7.3
What to do
Update WP Socializer to 7.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 21, 2022SedLex FavIcon Switcher plugin <= 1.2.11 at: Cross-Site Request Forgery (CSRF)CVE-2022-40219 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in SedLex FavIcon Switcher plugin <= 1.2.11 at WordPress allows plugin settings change.
Product
SedLex FavIcon Switcher plugin <= 1.2.11 at
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update SedLex FavIcon Switcher plugin <= 1.2.11 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 25, 2022Professional Social Sharing Buttons, Icons & Related Posts: Does not have proper authorisation check in one of the AJAX actionCVE-2022-0594 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
Product
Professional Social Sharing Buttons, Icons & Related Posts
Fixed in
9.7.6
What to do
Update Professional Social Sharing Buttons, Icons & Related Posts to 9.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022WP SVG Icons: Does not properly validate uploaded custom icon packsCVE-2022-0863 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
Product
WP SVG Icons
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update WP SVG Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Easy Social Icons: Does not properly escape the image_file fieldCVE-2022-0840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
Product
Easy Social Icons
Fixed in
3.2.1
What to do
Update Easy Social Icons to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Favicon by RealFaviconGenerator: Does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboardCVE-2022-0471 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Favicon by RealFaviconGenerator
Fixed in
1.3.23
What to do
Update Favicon by RealFaviconGenerator to 1.3.23 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022Easy Social Icons: Does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statementCVE-2022-0887 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.
Product
Easy Social Icons
Fixed in
3.1.4
What to do
Update Easy Social Icons to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Menu Image, Icons made easy: Does not have authorisation and CSRF checksCVE-2022-0450 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and does not validate, sanitise and escape them. As a result, any authenticate users, such as subscriber can update the settings or arbitrary menu and put Cross-Site Scripting payloads in them which will be triggered in the related menu in the frontend
Product
Menu Image, Icons made easy
Fixed in
3.0.6
What to do
Update Menu Image, Icons made easy to 3.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022WP Voting Contest: Does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Product
WP Voting Contest
Fixed in
3.0
What to do
Update WP Voting Contest to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs: Was vulnerable to reflected XSS on the my-sticky-elements-leads admin pageCVE-2022-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
Product
All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs
Fixed in
2.0.4
What to do
Update All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs to 2.0.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 1, 2022Asset CleanUp: Page Speed Booster: Does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users)CVE-2021-24983 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sent to the wpassetcleanup_fetch_active_plugins_icons AJAX action (available to admin users), leading to a Reflected Cross-Site Scripting issue
Product
Asset CleanUp: Page Speed Booster
Fixed in
1.3.8.5
What to do
Update Asset CleanUp: Page Speed Booster to 1.3.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.