Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
110 results · page 3 of 3
Jun 3, 2023The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WorCVE-2023-2406 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Event Registration Calendar By vcita plugin, versions up to and including 3.9.1, and Online Payments – Get Paid with PayPal, Square & Stripe plugin, for WordPress are vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.jonh.euplugins.trac.wordpress.org
Mar 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin Accept Stripe Donation – AidWP plugin <= 3.1.5 versions.CVE-2022-47422 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin Accept Stripe Donation – AidWP plugin <= 3.1.5 versions.
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.CVE-2023-23865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.
- Fixed in
- 1.4.11
- What to do
- Update the plugin to 1.4.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 19, 2022WP Stripe Checkout: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3986 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WP Stripe Checkout
- Fixed in
- 1.2.2.21
- What to do
- Update WP Stripe Checkout to 1.2.2.21 or newer.
Jul 17, 2022Accept Stripe Payments: Does not sanitize and escape some of its settingsCVE-2022-2194 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Accept Stripe Payments
- Fixed in
- 2.0.64
- What to do
- Update Accept Stripe Payments to 2.0.64 or newer.
Oct 4, 2021The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.pCVE-2021-39347 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases with their payment accounts. This affects versions 3.0.0 - 3.3.9.
- Affected
- 3.0.0 to 3.3.9
- What to do
- Affects 3.0.0 to 3.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 17, 2021GiveWP – Donation Plugin and Fundraising Platform: Did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settingsCVE-2021-24315 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated (admin+) Stored XSS issues.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Fixed in
- 2.10.4
- What to do
- Update GiveWP – Donation Plugin and Fundraising Platform to 2.10.4 or newer.
Aug 31, 2020The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.CVE-2020-20627 · WordPress plugins & themes · reported by MITREMedium 5.3
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
- Product
- includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP
- Affected
- up to 2.5.9
- What to do
- Affects up to 2.5.9. Update includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Oct 23, 2019The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.CVE-2015-9529 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
- Fixed in
- 1.8.7
- What to do
- Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD recordweb.archive.orgweb.archive.org
Aug 28, 2019Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9374 · WordPress plugins & themes · reported by MITREMedium 6.1
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
- Product
- Stripe Add-on for iThemes Exchange
- Fixed in
- 1.2.0
- What to do
- Update Stripe Add-on for iThemes Exchange to 1.2.0 or newer.
Full record and what to do →NVD recordblog.sucuri.netithemes.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.