Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,154 results · page 30 of 44
Apr 24, 2023WP FEvents Book: Does not ensures that bookings to be updated belong to the user making the requestCVE-2023-1129 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP FEvents Book WordPress plugin through 0.46 does not ensures that bookings to be updated belong to the user making the request, allowing any authenticated user to book, add notes, or cancel booking on behalf of other users.
- Product
- WP FEvents Book
- Affected
- up to 0.46
- What to do
- Affects up to 0.46. Update WP FEvents Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Steveas WP Live Chat Shoutbox
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions.CVE-2023-22718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions.
- Fixed in
- 3.5.0
- What to do
- Update the plugin to 3.5.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 17, 2023- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege usersCVE-2023-1427 · WordPress plugins & themes · reported by WPScanMedium 4.9
- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.
- Fixed in
- 1.8.15
- What to do
- Update the plugin to 1.8.15 or newer.
Apr 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versioCVE-2022-41633 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versions.
- Fixed in
- 6.0.3.0
- What to do
- Update the plugin to 6.0.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 3, 2023User Role by BestWebSoft: Does not protect against CSRF in requests to update role capabilitiesCVE-2023-0820 · WordPress plugins & themes · reported by WPScanHigh 8.8
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
- Product
- User Role by BestWebSoft
- Fixed in
- 1.6.7
- What to do
- Update User Role by BestWebSoft to 1.6.7 or newer.
Mar 27, 2023Gallery Blocks with Lightbox: Has an AJAX endpoint that can be accessed by any authenticated usersCVE-2023-0441 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.
- Product
- Gallery Blocks with Lightbox
- Fixed in
- 3.0.8
- What to do
- Update Gallery Blocks with Lightbox to 3.0.8 or newer.
Mar 27, 2023The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through CVE-2020-36666 · WordPress plugins & themes · reported by WPScanHigh 8.8
The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
- Product
- directory-pro
- Fixed in
- 1.9.5
- What to do
- Update directory-pro to 1.9.5 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Mar 20, 2023ProfileGrid: Provides an AJAX endpoint for resetting a user password but does not implement proper authorizationCVE-2023-0940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
- Product
- ProfileGrid
- Fixed in
- 5.3.1
- What to do
- Update ProfileGrid to 5.3.1 or newer.
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not validate the user meta to be retrieved via the user shortcodeCVE-2023-0911 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
- Product
- WordPress Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 5.12.8
- What to do
- Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the requestCVE-2023-0890 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
- Product
- WordPress Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 5.12.8
- What to do
- Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Mar 20, 2023WooCommerce Multiple Customer Addresses & Shipping: Does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the requestCVE-2023-0865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.
- Product
- WooCommerce Multiple Customer Addresses & Shipping
- Fixed in
- 21.7
- What to do
- Update WooCommerce Multiple Customer Addresses & Shipping to 21.7 or newer.
Mar 16, 2023Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User SubmissiCVE-2022-38971 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5 versions.
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 15, 2023Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8 vCVE-2023-25968 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8 versions.
- Fixed in
- 1.1.9
- What to do
- Update the plugin to 1.1.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023Auto Featured Image (Auto Post Thumbnail): Includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary filesCVE-2023-0477 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.16 includes an AJAX endpoint that allows any user with at least Author privileges to upload arbitrary files, such as PHP files. This is caused by incorrect file extension validation.
- Product
- Auto Featured Image (Auto Post Thumbnail)
- Fixed in
- 3.9.16
- What to do
- Update Auto Featured Image (Auto Post Thumbnail) to 3.9.16 or newer.
Mar 13, 202310Web Map Builder for Google Maps: Does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated usersCVE-2023-0037 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- 10Web Map Builder for Google Maps
- Fixed in
- 1.0.73
- What to do
- Update 10Web Map Builder for Google Maps to 1.0.73 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Mar 6, 2023A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress.CVE-2015-10093 · WordPress plugins & themes · reported by VulDBLow 2.6
A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is e7059727274d2767c240c55c02c163eaa4ba6c62. It is recommended to upgrade the affected component. The identifier VDB-222325 was assigned to this vulnerability.
- What to do
- Update the plugin to the newest version.
Feb 27, 2023Correos Oficial: Does not have an authorization check user input validationCVE-2023-0331 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.
- Product
- Correos Oficial
- Affected
- up to 1.2.0.2
- What to do
- Affects up to 1.2.0.2. Update Correos Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Custom Add User: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0043 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Custom Add User
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Custom Add User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023User Activity: Checks headers suchCVE-2022-4550 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing
- Product
- User Activity
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update User Activity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023ShopLentor: Unserializes user input from cookies in order to track viewed products and user dataCVE-2023-0232 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection.
- Product
- ShopLentor
- Fixed in
- 2.5.4
- What to do
- Update ShopLentor to 2.5.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2023Spectra: Does not sanitize user inputCVE-2020-36656 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks.
- Product
- Spectra
- Fixed in
- 1.15.0
- What to do
- Update Spectra to 1.15.0 or newer.
Feb 13, 2023Profile Builder – User Profile & User Registration Forms: Sensitive information disclosureCVE-2023-0814 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Feb 13, 2023GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training: Does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary postsCVE-2023-0405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.
- Product
- GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training
- Fixed in
- 1.4.38
- What to do
- Update GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training to 1.4.38 or newer.
Feb 13, 2023Simple URLs: Does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated usersCVE-2023-0098 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
- Product
- Simple URLs
- Fixed in
- 115
- What to do
- Update Simple URLs to 115 or newer.
Feb 13, 2023FL3R FeelBox: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4445 · WordPress plugins & themes · reported by WPScanCritical 9.8
The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- FL3R FeelBox
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update FL3R FeelBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023WP FullCalendar: Does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the requestCVE-2022-3891 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.
- Product
- WP FullCalendar
- Fixed in
- 1.5
- What to do
- Update WP FullCalendar to 1.5 or newer.
Feb 8, 2023Yellow Yard Searchbar: Does not escape some URL parameters before outputting them back to the userCVE-2022-2094 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross-Site Scripting
- Product
- Yellow Yard Searchbar
- Fixed in
- 2.8.2
- What to do
- Update Yellow Yard Searchbar to 2.8.2 or newer.
Feb 6, 2023Tutor LMS: Does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributesCVE-2023-0236 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Tutor LMS
- Fixed in
- 2.0.10
- What to do
- Update Tutor LMS to 2.0.10 or newer.
Feb 6, 2023SiteGround Security: Does not properly sanitize user input before using it in an SQL queryCVE-2023-0234 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
- Product
- SiteGround Security
- Fixed in
- 1.3.1
- What to do
- Update SiteGround Security to 1.3.1 or newer.
Feb 6, 2023Hide My WP: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Hide My WP
- Fixed in
- 6.2.9
- What to do
- Update Hide My WP to 6.2.9 or newer.
Feb 6, 2023HUSKY: Unserializes user input provided via the settingsCVE-2022-4489 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- HUSKY
- Fixed in
- 1.3.2
- What to do
- Update HUSKY to 1.3.2 or newer.
Feb 6, 2023Stream: Does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionalityCVE-2022-4384 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionality, which may enable them to leak sensitive information.
- Product
- Stream
- Fixed in
- 3.9.2
- What to do
- Update Stream to 3.9.2 or newer.
Jan 30, 2023Custom User Profile Fields for User Registration: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4831 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Custom User Profile Fields for User Registration
- Fixed in
- 1.8.1
- What to do
- Update Custom User Profile Fields for User Registration to 1.8.1 or newer.
Jan 30, 2023Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as conCVE-2022-4787 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Fixed in
- 2.0.8
- What to do
- Update the plugin to 2.0.8 or newer.
Jan 30, 2023Revive Old Posts: Unserializes user input provided via the settingsCVE-2022-4680 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- Revive Old Posts
- Fixed in
- 9.0.11
- What to do
- Update Revive Old Posts to 9.0.11 or newer.
Jan 23, 2023User Verification: Was affected by an Auth Bypass security vulnerabilityCVE-2022-4693 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the user’s username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website.
- Product
- User Verification
- Fixed in
- 1.0.94
- What to do
- Update User Verification to 1.0.94 or newer.
Jan 23, 2023CBX Petition for: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4383 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- CBX Petition for
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update CBX Petition for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023Analyticator: Unserializes user input provided via the settingsCVE-2022-4323 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Analyticator
- Fixed in
- 6.5.6
- What to do
- Update Analyticator to 6.5.6 or newer.
Jan 23, 2023Login as User or Customer: Lacks authorization checks to ensure that users are allowed to log inCVE-2022-4305 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
- Product
- Login as User or Customer
- Fixed in
- 3.3
- What to do
- Update Login as User or Customer to 3.3 or newer.
Jan 23, 2023Analyticator: Unserializes user input provided via the settingsCVE-2022-3425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- Analyticator
- Fixed in
- 6.5.6
- What to do
- Update Analyticator to 6.5.6 or newer.
Jan 16, 2023Fontsy: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4447 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Fontsy
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update Fontsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Images Optimize and Upload CF7: Does not validate the file to be deleted via an AJAX action available to unauthenticated usersCVE-2022-4101 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.
- Product
- Images Optimize and Upload CF7
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Images Optimize and Upload CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023User Post Gallery: Does not limit what callback functions can be called by usersCVE-2022-4060 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.
- Product
- User Post Gallery
- Affected
- up to 2.19
- What to do
- Affects up to 2.19. Update User Post Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 12, 2023Simple Membership WP user Import: SQL InjectionCVE-2023-0254 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Simple Membership WP user Import
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Simple Membership WP user Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 9, 2023The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contriCVE-2022-4392 · WordPress plugins & themes · reported by WPScanMedium 5.4
The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- iPanorama 360 WordPress Virtual Tour Builder
- Affected
- up to 1.6.29
- What to do
- Affects up to 1.6.29. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023WP Custom Admin Interface: Unserialize user input provided via the settingsCVE-2022-4043 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- WP Custom Admin Interface
- Fixed in
- 7.29
- What to do
- Update WP Custom Admin Interface to 7.29 or newer.
Jan 9, 2023WPQA Builder: (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tries to validate that a user already follows another in the wpqa_following_you_ajax actionCVE-2022-3343 · WordPress plugins & themes · reported by WPScanLow 3.5
The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tries to validate that a user already follows another in the wpqa_following_you_ajax action, allowing a user to inflate their score on the site by having another user send repeated follow actions to them.
- Product
- WPQA Builder
- Fixed in
- 5.9.3
- What to do
- Update WPQA Builder to 5.9.3 or newer.
Jan 2, 2023WP Cerber Security, Anti-spam & Malware Scan: Does not properly block access to the REST API users endpointCVE-2022-4417 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 9.3.3
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 9.3.3 or newer.
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4357 · WordPress plugins & themes · reported by WPScanCritical 9.8
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.