Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

223 results · page 3 of 5

Mar 24, 2025jQuery Dropdown Menu: Cross-Site Request Forgery (CSRF)CVE-2025-30560 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0.
Product
jQuery Dropdown Menu
Affected
up to 3.0
What to do
Affects up to 3.0. Update jQuery Dropdown Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 11, 2025WP jQuery Persian Datepicker: Cross-Site Request Forgery (CSRF)CVE-2025-28861 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian Datepicker: from n/a through <= 0.1.0.
Product
WP jQuery Persian Datepicker
Affected
up to 0.1.0
What to do
Affects up to 0.1.0. Update WP jQuery Persian Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 23, 2025WP Query Creator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22264 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel WP Query Creator wp-query-creator allows Reflected XSS.This issue affects WP Query Creator: from n/a through <= 1.0.
Product
WP Query Creator
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Query Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 16, 2025Ajax WP Query Search Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23926 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Ajax WP Query Search Filter ajax-wp-query-search-filter allows Stored XSS.This issue affects Ajax WP Query Search Filter: from n/a through <= 1.0.7.
Product
Ajax WP Query Search Filter
Affected
up to 1.0.7
What to do
Affects up to 1.0.7. Update Ajax WP Query Search Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2025Responsive jQuery Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer Responsive jQuery Slider responsive-jquery-slider allows Stored XSS.This issue affects Responsive jQuery Slider: from n/a through <= 1.1.1.
Product
Responsive jQuery Slider
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Responsive jQuery Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025jQuery TwentyTwenty: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22546 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through <= 1.0.
Product
jQuery TwentyTwenty
Affected
up to 1.0
What to do
Affects up to 1.0. Update jQuery TwentyTwenty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP jQuery DataTable: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56287 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AppJetty WP jQuery DataTable wp-jquery-datatable allows Stored XSS.This issue affects WP jQuery DataTable: from n/a through <= 4.0.1.
Product
WP jQuery DataTable
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP jQuery DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 7, 2025WP jQuery DataTable: Stored Cross-Site ScriptingCVE-2024-12499 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP jQuery DataTable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_jdt' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP jQuery DataTable
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP jQuery DataTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 1, 2024Custom Query Blocks: Missing AuthorizationCVE-2024-38794 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in MediaRon LLC Custom Query Blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Custom Query Blocks: from n/a through 5.2.0.
Product
Custom Query Blocks
Affected
up to 5.2.0
What to do
Affects up to 5.2.0. Update Custom Query Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Oct 28, 2024WP Query Console: Improper Control of Generation of Code ('Code Injection')CVE-2024-50498 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.
Product
WP Query Console
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Query Console to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com github.com
Oct 10, 2024TI WooCommerce Wishlist: Is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL queryCVE-2024-9156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
TI WooCommerce Wishlist
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update TI WooCommerce Wishlist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 15, 2024Custom Query Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44059 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through <= 5.3.1.
Product
Custom Query Blocks
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Custom Query Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 29, 2024Greenshift Query and Meta Addon: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43942 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wpsoul Greenshift Query and Meta Addon allows SQL Injection.This issue affects Greenshift Query and Meta Addon: from n/a before 3.9.2.
Product
Greenshift Query and Meta Addon
Fixed in
3.9.2
What to do
Update Greenshift Query and Meta Addon to 3.9.2 or newer.
Full record and what to do →NVD record patchstack.com
Jun 26, 2024jQuery T(-) Countdown Widget: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37247 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in twinpictures, baden03 jQuery T(-) Countdown Widget allows Stored XSS.This issue affects jQuery T(-) Countdown Widget: from n/a through 2.3.25.
Product
jQuery T(-) Countdown Widget
Affected
up to 2.3.25
What to do
Affects up to 2.3.25. Update jQuery T(-) Countdown Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 7, 2024WP jQuery Lightbox: Stored Cross-Site ScriptingCVE-2024-5425 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP jQuery Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ attribute in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP jQuery Lightbox
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update WP jQuery Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
May 22, 2024jQuery T(-) Countdown Widget: Stored Cross-Site ScriptingCVE-2024-4783 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and including, 2.3.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37247 may be a duplicate of this issue.
Product
jQuery T(-) Countdown Widget
Affected
up to 2.3.25
What to do
Affects up to 2.3.25. Update jQuery T(-) Countdown Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 25, 2024Advanced Search: Does not properly escape parameters appended to an SQL queryCVE-2024-3265 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
Product
Advanced Search
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Advanced Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2024Quicksand Post Filter jQuery: Missing AuthorizationCVE-2024-24850 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Product
Quicksand Post Filter jQuery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Quicksand Post Filter jQuery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2024Quicksand Post Filter jQuery: Cross-Site Request Forgery (CSRF)CVE-2024-24849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mark Stockton Quicksand Post Filter jQuery Plugin.This issue affects Quicksand Post Filter jQuery Plugin: from n/a through 3.1.1.
Product
Quicksand Post Filter jQuery
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Quicksand Post Filter jQuery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 17, 2024Track The Click: Does not properly sanitize query parameters to the stats REST endpoint before using them in a database queryCVE-2023-5041 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them in a database query, allowing a logged in user with an author role or higher to perform time based blind SQLi attacks on the database.
Product
Track The Click
Fixed in
0.3.12
What to do
Update Track The Click to 0.3.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024ArtPlacer Widget: Does not sanitize and escape the "id" parameter before submitting the queryCVE-2023-6373 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
Product
ArtPlacer Widget
Fixed in
2.20.7
What to do
Update ArtPlacer Widget to 2.20.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Sessions Time Monitoring Full Automatic: Does not sanitize the request URL or query parameters before using them in an SQL queryCVE-2023-5203 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
Product
WP Sessions Time Monitoring Full Automatic
Fixed in
1.0.9
What to do
Update WP Sessions Time Monitoring Full Automatic to 1.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Jquery news ticker: Stored Cross-Site ScriptingCVE-2023-5432 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Jquery news ticker
Affected
up to 3.1
What to do
Affects up to 3.1. Update Jquery news ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not validate and sanitise the `wp_query` parameterCVE-2023-4724 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023Jquery accordion slideshow: SQL InjectionCVE-2023-5464 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Jquery accordion slideshow
Affected
up to 8.1
What to do
Affects up to 8.1. Update Jquery accordion slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 31, 2023Jquery news ticker: SQL InjectionCVE-2023-5430 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Jquery news ticker
Affected
up to 3.0
What to do
Affects up to 3.0. Update Jquery news ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023School Management System: Uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the queryCVE-2023-4776 · WordPress plugins & themes · reported by WPScanHigh 8.8
The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
Product
School Management System
Fixed in
2.2.5
What to do
Update School Management System to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023JQuery Accordion Menu Widget: Stored Cross-Site ScriptingCVE-2023-4890 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
JQuery Accordion Menu Widget
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update JQuery Accordion Menu Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 31, 2023Forminator: Does not properly escape values that are being reflected inside form fields that use pre-populated query parametersCVE-2023-3134 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
Product
Forminator
Fixed in
1.24.4
What to do
Update Forminator to 1.24.4 or newer.
Full record and what to do →NVD record wpscan.com onvio.nl
Jun 19, 2023QueryWall: Plug'n Play Firewall: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2492 · WordPress plugins & themes · reported by WPScanHigh 7.2
The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
QueryWall: Plug'n Play Firewall
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update QueryWall: Plug'n Play Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2023Fast & Effective Popups & Lead-Generation for: Concatenates user input into an SQL query without escaping it first in the plugin's report API endpointCVE-2023-2111 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL query without escaping it first in the plugin's report API endpoint, which could allow administrators in multi-site configuration to leak sensitive information from the site's database.
Product
Fast & Effective Popups & Lead-Generation for
Fixed in
2.1.4
What to do
Update Fast & Effective Popups & Lead-Generation for to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Cloud Manager: Does not sanitise and escape the query param ricerca before outputting it in an admin panelCVE-2023-0421 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.
Product
Cloud Manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update Cloud Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Paid Memberships Pro: Does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL queryCVE-2023-0631 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
Product
Paid Memberships Pro
Fixed in
2.9.12
What to do
Update Paid Memberships Pro to 2.9.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Slimstat Analytics: Does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL queryCVE-2023-0630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.
Product
Slimstat Analytics
Fixed in
4.9.3.3
What to do
Update Slimstat Analytics to 4.9.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Loan Comparison: Does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcodeCVE-2023-0442 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.
Product
Loan Comparison
Fixed in
1.5.3
What to do
Update Loan Comparison to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023SiteGround Security: Does not properly sanitize user input before using it in an SQL queryCVE-2023-0234 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
Product
SiteGround Security
Fixed in
1.3.1
What to do
Update SiteGround Security to 1.3.1 or newer.
Full record and what to do →NVD record github.com wpscan.com
Feb 6, 2023jQuery T(-) Countdown Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0171 · WordPress plugins & themes · reported by WPScanMedium 5.4
The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
jQuery T(-) Countdown Widget
Fixed in
2.3.24
What to do
Update jQuery T(-) Countdown Widget to 2.3.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activateCVE-2022-4166 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activate.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4165 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_multiple_files_for_post POST parameter before concatenating it to an SQL query in 0_change-galleryCVE-2022-4164 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_files_for_post POST parameter before concatenating it to an SQL query in 0_change-gallery.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_deactivate and cg_activate POST parameters before concatenating it to an SQL query in 2_deactivateCVE-2022-4163 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_deactivate and cg_activate POST parameters before concatenating it to an SQL query in 2_deactivate.php and 4_activate.php, respectively. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_row POST parameter before concatenating it to an SQL query in 3_row-orderCVE-2022-4162 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_row POST parameter before concatenating it to an SQL query in 3_row-order.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_copy_start POST parameter before concatenating it to an SQL query in copy-gallery-imagesCVE-2022-4161 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start POST parameter before concatenating it to an SQL query in copy-gallery-images.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_copy_id POST parameter before concatenating it to an SQL query in cg-copy-commentsCVE-2022-4160 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST parameter before concatenating it to an SQL query in cg-copy-comments.php and cg-copy-rating.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_id POST parameter before concatenating it to an SQL query in 0_change-galleryCVE-2022-4159 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_id POST parameter before concatenating it to an SQL query in 0_change-gallery.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-loginCVE-2022-4158 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-allCVE-2022-4157 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-all.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backendCVE-2022-4156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4155 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery Pro: Does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
Product
Contest Gallery Pro
Fixed in
19.1.5
What to do
Update Contest Gallery Pro to 19.1.5 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.