Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
214 results · page 3 of 5
May 17, 2024Defender Security: Authentication Bypass by SpoofingCVE-2024-25595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1.
- Product
- Defender Security
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Defender Security: Insecure Storage of Sensitive InformationCVE-2022-44581 · WordPress plugins & themes · reported by PatchstackMedium 5
Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.
- Product
- Defender Security
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Jetpack – WP Security, Backup, Speed, & Growth: Stored Cross-Site ScriptingCVE-2024-4392 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Jetpack – WP Security, Backup, Speed, & Growth
- Affected
- up to 13.3.1
- What to do
- Affects up to 13.3.1. Update Jetpack – WP Security, Backup, Speed, & Growth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 4, 2024Stop Spammers Security | Block Spam Users, Comments, Forms: Cross-Site Request ForgeryCVE-2023-7065 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfs_process AJAX action. This makes it possible for unauthenticated attackers to add arbitrary IPs to the plugin's allowlist and blocklist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Affected
- up to 2024.4
- What to do
- Affects up to 2024.4. Update Stop Spammers Security | Block Spam Users, Comments, Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 25, 2024Anti-Malware Security and Brute-Force Firewall: Improper Control of Generation of Code ('Code Injection')CVE-2024-22144 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Control of Generation of Code ('Code Injection') vulnerability in Eli Scheetz Anti-Malware Security and Brute-Force Firewall gotmls allows Code Injection.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through 4.21.96.
- Product
- Anti-Malware Security and Brute-Force Firewall
- Affected
- up to 4.21.96
- What to do
- Affects up to 4.21.96. Update Anti-Malware Security and Brute-Force Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 2, 2024SecuPress Free — WordPress Security: Cross-Site Request ForgeryCVE-2024-1504 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5.1. This is due to missing or incorrect nonce validation on the secupress_blackhole_ban_ip() function. This makes it possible for unauthenticated attackers to block a user's IP via a forged request granted they can trick the user into performing an action such as clicking on a link.
- Product
- SecuPress Free — WordPress Security
- Affected
- up to 2.2.5.1
- What to do
- Affects up to 2.2.5.1. Update SecuPress Free — WordPress Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 29, 2024All In One WP Security & Firewall: Cross-Site Request Forgery (CSRF)CVE-2024-30468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6.
- Product
- All In One WP Security & Firewall
- Affected
- up to 5.2.6
- What to do
- Affects up to 5.2.6. Update All In One WP Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 7, 2024All-In-One Security (AIOS) – Security and Firewall: Reflected Cross-Site ScriptingCVE-2024-1037 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- All-In-One Security (AIOS) – Security and Firewall
- Affected
- up to 5.2.5
- What to do
- Affects up to 5.2.5. Update All-In-One Security (AIOS) – Security and Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 5, 2024UserPro: Security Feature BypassCVE-2024-0701 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the plugin's General settings. This makes it possible for unauthenticated attackers to register an account even when account registration has been disabled by an administrator.
- Product
- UserPro
- Affected
- up to 5.1.6
- What to do
- Affects up to 5.1.6. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Feb 5, 2024Shield Security – Smart Bot Blocking & Intrusion Prevention Security: Local File InclusionCVE-2023-6989 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
- Product
- Shield Security – Smart Bot Blocking & Intrusion Prevention Security
- Affected
- up to 18.5.9
- What to do
- Affects up to 18.5.9. Update Shield Security – Smart Bot Blocking & Intrusion Prevention Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 1, 2024Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51674 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
- Product
- Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
- Affected
- up to 6.9.18
- What to do
- Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 31, 2024Shield Security – Smart Bot Blocking & Intrusion Prevention Security: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22163 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shield Security Shield Security – Smart Bot Blocking & Intrusion Prevention Security allows Stored XSS.This issue affects Shield Security – Smart Bot Blocking & Intrusion Prevention Security: from n/a through 18.5.7.
- Product
- Shield Security – Smart Bot Blocking & Intrusion Prevention Security
- Affected
- up to 18.5.7
- What to do
- Affects up to 18.5.7. Update Shield Security – Smart Bot Blocking & Intrusion Prevention Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 8, 2024Defender Security – Malware Scanner, Login Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51490 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
- Product
- Defender Security – Malware Scanner, Login Security & Firewall
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Defender Security – Malware Scanner, Login Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-51675 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.
- Product
- Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
- Affected
- up to 6.9.18
- What to do
- Affects up to 6.9.18. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-50881 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.
- Product
- Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
- Affected
- up to 6.9.15
- What to do
- Affects up to 6.9.15. Update Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Solid Security – Password, Two Factor Authentication, and Brute Force Protection: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-28786 · WordPress plugins & themes · reported by PatchstackLow 3.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.
- Product
- Solid Security – Password, Two Factor Authentication, and Brute Force Protection
- Affected
- up to 8.1.4
- What to do
- Affects up to 8.1.4. Update Solid Security – Password, Two Factor Authentication, and Brute Force Protection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Cookies and Content Security Policy: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-40662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jonk @ Follow me Darling Cookies and Content Security Policy.This issue affects Cookies and Content Security Policy: from n/a through 2.15.
- Product
- Cookies and Content Security Policy
- Affected
- up to 2.15
- What to do
- Affects up to 2.15. Update Cookies and Content Security Policy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 30, 2023Jetpack – WP Security, Backup, Speed, & Growth: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-45050 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1.
- Product
- Jetpack – WP Security, Backup, Speed, & Growth
- Affected
- up to 12.8-a.1
- What to do
- Affects up to 12.8-a.1. Update Jetpack – WP Security, Backup, Speed, & Growth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 27, 2023Security & Malware scan by CleanTalk: Retrieves client IP addresses from potentially untrusted headersCVE-2023-5239 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection.
- Product
- Security & Malware scan by CleanTalk
- Fixed in
- 2.121
- What to do
- Update Security & Malware scan by CleanTalk to 2.121 or newer.
Nov 6, 2023GD Security Headers: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-46821 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers allows auth. (admin+) SQL Injection.This issue affects GD Security Headers: from n/a through 1.7.
- Product
- GD Security Headers
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update GD Security Headers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 20, 2023WP Cerber Security: Stored cross-site scriptingCVE-2022-4712 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, and including, 9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Cerber Security
- Affected
- up to 9.1
- What to do
- Affects up to 9.1. Update WP Cerber Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 20, 2023Security & Malware scan by CleanTalk: Unauthorized user interactionCVE-2020-36698 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to call functions and delete and/or upload files.
- Product
- Security & Malware scan by CleanTalk
- Affected
- up to 2.50
- What to do
- Affects up to 2.50. Update Security & Malware scan by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwpscan.com
Oct 16, 2023Defender Security: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2023-5089 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
- Product
- Defender Security
- Fixed in
- 4.1.0
- What to do
- Update Defender Security to 4.1.0 or newer.
Full record and what to do →NVD recordwpscan.comsprocketsecurity.com
Oct 16, 2023DoLogin Security: Does not restrict the access of a widget that shows the IPs of failed logins to low privileged usersCVE-2023-4800 · WordPress plugins & themes · reported by WPScanMedium 6.5
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
- Product
- DoLogin Security
- Fixed in
- 3.7.1
- What to do
- Update DoLogin Security to 3.7.1 or newer.
Sep 25, 2023DoLogin Security: Uses headers suchCVE-2023-4631 · WordPress plugins & themes · reported by WPScanMedium 5.3
The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing.
- Product
- DoLogin Security
- Fixed in
- 3.7
- What to do
- Update DoLogin Security to 3.7 or newer.
Sep 25, 2023DoLogin Security: Does not properly sanitize IP addresses coming from the X-Forwarded-For headerCVE-2023-4549 · WordPress plugins & themes · reported by WPScanMedium 6.1
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
- Product
- DoLogin Security
- Fixed in
- 3.7
- What to do
- Update DoLogin Security to 3.7 or newer.
Aug 30, 2023Ninja Forms WordPress Ninja Forms Contact Form: Was affected by a HTML Injection security vulnerabilityCVE-2023-4109 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.
- Product
- Ninja Forms WordPress Ninja Forms Contact Form
- Fixed in
- 3.6.26
- What to do
- Update Ninja Forms WordPress Ninja Forms Contact Form to 3.6.26 or newer.
Jul 12, 2023Defender Security: Cross-Site Request ForgeryCVE-2021-4425 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenticated attackers to verify a one time login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Defender Security
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jul 1, 2023WP Security Question: Cross-Site Request ForgeryCVE-2021-4386 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Security Question
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WP Security Question to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 9, 2023Shield Security: Missing Authorization on the 'theme-plugin-file' AJAX actionCVE-2023-0993 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a vector for Cross-Site Scripting via CVE-2023-0992.
- Product
- Shield Security
- Affected
- up to 17.0.17
- What to do
- Affects up to 17.0.17. Update Shield Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 9, 2023Shield Security: Stored Cross-Site ScriptingCVE-2023-0992 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Shield Security
- Affected
- up to 17.0.17
- What to do
- Affects up to 17.0.17. Update Shield Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 6, 2023uListing: Authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validatedCVE-2021-4370 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to conduct numerous administrative actions, including those less critical than the explicitly outlined ones in our detection.
- Product
- uListing
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
May 8, 2023Hide My WP Ghost – Security: IP Address SpoofingCVE-2022-4537 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Hide My WP Ghost – Security Plugin plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.0.18. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in.
- Product
- Hide My WP Ghost – Security
- Affected
- up to 5.0.18
- What to do
- Affects up to 5.0.18. Update Hide My WP Ghost – Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 10, 2023All-In-One Security (AIOS): Does not escape the content of log files before outputting it to the plugin admin pageCVE-2023-0157 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.5
- What to do
- Update All-In-One Security (AIOS) to 5.1.5 or newer.
Apr 10, 2023All-In-One Security (AIOS): Does not limit what log files to display in it's settings pagesCVE-2023-0156 · WordPress plugins & themes · reported by WPScanMedium 4.9
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.5
- What to do
- Update All-In-One Security (AIOS) to 5.1.5 or newer.
Feb 6, 2023SiteGround Security: Does not properly sanitize user input before using it in an SQL queryCVE-2023-0234 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
- Product
- SiteGround Security
- Fixed in
- 1.3.1
- What to do
- Update SiteGround Security to 1.3.1 or newer.
Jan 23, 2023User Verification: Was affected by an Auth Bypass security vulnerabilityCVE-2022-4693 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website.
- Product
- User Verification
- Fixed in
- 1.0.94
- What to do
- Update User Verification to 1.0.94 or newer.
Jan 23, 2023All-In-One Security (AIOS): Leaked settings of the plugin publiclyCVE-2022-4346 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.3
- What to do
- Update All-In-One Security (AIOS) to 5.1.3 or newer.
Jan 4, 2023WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes CVE-2023-22622 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddeveloper.wordpress.orggithub.com
Jan 2, 2023WP Cerber Security, Anti-spam & Malware Scan: Does not properly block access to the REST API users endpointCVE-2022-4417 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 9.3.3
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 9.3.3 or newer.
Dec 26, 2022Stop Spammers Security | Block Spam Users, Comments, Forms: Passes base64 encoded user input to the unserialize() PHP functionCVE-2022-4120 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2022.6
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2022.6 or newer.
Dec 12, 2022All-In-One Security (AIOS): Is susceptible to IP Spoofing attacksCVE-2022-4097 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.0.8
- What to do
- Update All-In-One Security (AIOS) to 5.0.8 or newer.
Nov 22, 2022Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.CVE-2022-44737 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 23, 2022Wordfence Security – Firewall & Malware Scan: Stored Cross-Site ScriptingCVE-2022-3144 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.
- Product
- Wordfence Security – Firewall & Malware Scan
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update Wordfence Security – Firewall & Malware Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 16, 2022Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation.CVE-2022-29489 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation.
- Affected
- up to 1.8.33
- What to do
- Affects up to 1.8.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 16, 2022Titan Anti-spam & Security: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-2877 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- Titan Anti-spam & Security
- Fixed in
- 7.3.1
- What to do
- Update Titan Anti-spam & Security to 7.3.1 or newer.
Sep 6, 2022WP Cerber Security: Security protection bypassCVE-2022-2939 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author' parameter found in the ~/cerber-load.php file. In vulnerable versions, the plugin only blocks requests if the value supplied is numeric, making it possible for attackers to supply additional non-numeric characters to bypass the protection. The non-numeric characters are stripped and the user requested is displayed. This can be used by unauthenticated attackers to gather information about users that can targeted in further attacks.
- Product
- WP Cerber Security
- Affected
- up to 9.0
- What to do
- Affects up to 9.0. Update WP Cerber Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 29, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape some parameters before outputting them back in an admin dashboardCVE-2022-2599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting
- Product
- Anti-Malware Security and Brute-Force Firewall
- Fixed in
- 4.21.83
- What to do
- Update Anti-Malware Security and Brute-Force Firewall to 4.21.83 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.