Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,938 results · page 30 of 39

May 30, 2022StaffList: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-1556 · WordPress plugins & themes · reported by WPScanCritical 9.8
The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection
Product
StaffList
Fixed in
3.1.5
What to do
Update StaffList to 3.1.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 30, 2022HPB Dashboard: Does not sanitise and escape some of its settingsCVE-2022-1542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
HPB Dashboard
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update HPB Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022WP 2FA: Does not sanitise and escape a parameter before outputting it back in an admin pageCVE-2022-1527 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
WP 2FA
Fixed in
2.2.1
What to do
Update WP 2FA to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022Poll Maker: Does not sanitise and escape some settingsCVE-2022-1456 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfiltered_html is disallowed
Product
Poll Maker
Fixed in
4.0.2
What to do
Update Poll Maker to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022Easy FAQ with Expanding Text: Does not sanitise and escape its settingsCVE-2022-1395 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
Product
Easy FAQ with Expanding Text
Affected
up to 3.2.8.3.1
What to do
Affects up to 3.2.8.3.1. Update Easy FAQ with Expanding Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022Smush: Does not sanitise and escape a configuration parameter before outputting it back in an admin pageCVE-2022-1009 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
Product
Smush
Fixed in
3.9.9
What to do
Update Smush to 3.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022User Meta: Does not sanitise and escape the Form NameCVE-2022-0376 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
User Meta
Fixed in
2.4.3
What to do
Update User Meta to 2.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Curtain: Does not sanitise and escape some of its settingsCVE-2022-1558 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Product
Curtain
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Curtain to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 23, 2022Check & Log Email: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1547 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Check & Log Email
Fixed in
1.0.6
What to do
Update Check & Log Email to 1.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Tabs: Does not sanitise and escape Tab descriptionsCVE-2022-1298 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Tabs
Fixed in
2.2.8
What to do
Update Tabs to 2.2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Donate Extra: Does not sanitise and escape a parameter before outputting it back in the responseCVE-2022-1268 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Donate Extra WordPress plugin through 2.02 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected cross-Site Scripting
Product
Donate Extra
Affected
up to 2.02
What to do
Affects up to 2.02. Update Donate Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Gwyn's Imagemap Selector: Does not sanitise and escape some parameters before outputting them back in attributesCVE-2022-1221 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting.
Product
Gwyn's Imagemap Selector
Affected
up to 0.3.3
What to do
Affects up to 0.3.3. Update Gwyn's Imagemap Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Domain Replace: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1218 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Domain Replace
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update Domain Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Turn off all comments: Does not sanitise and escape the rows parameter before outputting it back in an admin pageCVE-2022-1192 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
Turn off all comments
Affected
up to 1.0
What to do
Affects up to 1.0. Update Turn off all comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022WP Meta SEO: Does not sanitise or escape the breadcrumb separator before outputting it to the pageCVE-2022-1093 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed.
Product
WP Meta SEO
Fixed in
4.4.7
What to do
Update WP Meta SEO to 4.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
Product
Nirweb support
Fixed in
2.8.2
What to do
Update Nirweb support to 2.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Clipr: Does not sanitise and escape its API Key settings before outputting it in an attributeCVE-2022-1559 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
Product
Clipr
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update Clipr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 16, 2022ScrollReveal.js Effects: Does not sanitise and escape its settingsCVE-2022-1512 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
ScrollReveal.js Effects
Affected
up to 1.2
What to do
Affects up to 1.2. Update ScrollReveal.js Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 16, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX actionCVE-2022-1465 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.
Product
WPC Smart Wishlist for WooCommerce
Fixed in
2.9.9
What to do
Update WPC Smart Wishlist for WooCommerce to 2.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022WPCargo Track & Trace: Does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the pageCVE-2022-1436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.
Product
WPCargo Track & Trace
Fixed in
6.9.5
What to do
Update WPCargo Track & Trace to 6.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022BMI BMR Calculator: Does not sanitise and escape arbitrary POST data before outputting it back in the responseCVE-2022-1267 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BMI BMR Calculator WordPress plugin through 1.3 does not sanitise and escape arbitrary POST data before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Product
BMI BMR Calculator
Affected
up to 1.3
What to do
Affects up to 1.3. Update BMI BMR Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Custom TinyMCE Shortcode Button: Does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin pageCVE-2022-1217 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
Product
Custom TinyMCE Shortcode Button
Affected
up to 1.1
What to do
Affects up to 1.1. Update Custom TinyMCE Shortcode Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Advanced Image Sitemap: Does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin pageCVE-2022-1216 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
Product
Advanced Image Sitemap
Affected
up to 1.2
What to do
Affects up to 1.2. Update Advanced Image Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Visual Slide Box Builder: Does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (suchCVE-2022-1182 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections
Product
Visual Slide Box Builder
Affected
up to 3.2.9
What to do
Affects up to 3.2.9. Update Visual Slide Box Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Bulk Edit and Create User Profiles: Does not sanitise and escape the Users LoginCVE-2022-1089 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Bulk Edit and Create User Profiles
Fixed in
1.5.14
What to do
Update Bulk Edit and Create User Profiles to 1.5.14 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022th23 Social: Does not sanitise and escape some of its settingsCVE-2022-1062 · WordPress plugins & themes · reported by WPScanMedium 4.8
The th23 Social WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
th23 Social
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update th23 Social to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profilCVE-2022-1051 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any authenticated user to perform Cross-Site Scripting attacks.
Product
WPQA Builder
Fixed in
5.2
What to do
Update WPQA Builder to 5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 16, 2022Gmedia Photo Gallery: Does not sanitise and escape the Album's name before outputting it in pages/posts with a media embedCVE-2022-0873 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed
Product
Gmedia Photo Gallery
Fixed in
1.20.0
What to do
Update Gmedia Photo Gallery to 1.20.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022Vertical scroll recent post: Does not sanitise and escape a parameter before outputting it back in an attributeCVE-2022-1171 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Vertical scroll recent post
Fixed in
14.0
What to do
Update Vertical scroll recent post to 14.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022Popup Maker: Does not sanitise and escape some of its Popup settingsCVE-2022-1104 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Popup Maker
Fixed in
1.16.5
What to do
Update Popup Maker to 1.16.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022Order Listener for WooCommerce: Does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated usersCVE-2022-0948 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection
Product
Order Listener for WooCommerce
Fixed in
3.2.2
What to do
Update Order Listener for WooCommerce to 3.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
May 9, 2022IgniteUp: Does not sanitise and escape some fieldsCVE-2022-0898 · WordPress plugins & themes · reported by WPScanMedium 5.4
The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues
Product
IgniteUp
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update IgniteUp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022WP Social Buttons: Does not sanitise and escape its settingsCVE-2022-0874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WP Social Buttons
Affected
up to 2.1
What to do
Affects up to 2.1. Update WP Social Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022SEMA API: Does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX actionCVE-2022-0836 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users
Product
SEMA API
Fixed in
4.02
What to do
Update SEMA API to 4.02 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022WP Video Gallery: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCVE-2022-0826 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Product
WP Video Gallery
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update WP Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022BadgeOS: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCVE-2022-0817 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Product
BadgeOS
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update BadgeOS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 9, 2022Ubigeo de Perú para Woocommerce: Does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actionsCVE-2022-0814 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
Product
Ubigeo de Perú para Woocommerce
Fixed in
3.6.4
What to do
Update Ubigeo de Perú para Woocommerce to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Fast Flow: Does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboardCVE-2022-1269 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Fast Flow
Fixed in
1.2.12
What to do
Update Fast Flow to 1.2.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Import and export users and customers: Does not sanitise and escaped imported CSV dataCVE-2022-1255 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
Product
Import and export users and customers
Fixed in
1.19.2.1
What to do
Update Import and export users and customers to 1.19.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022LifterLMS PayPal: Does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the pageCVE-2022-1250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue
Product
LifterLMS PayPal
Fixed in
1.4.0
What to do
Update LifterLMS PayPal to 1.4.0 or newer.
Full record and what to do →NVD record make.lifterlms.com wpscan.com
May 2, 2022Visual Form Builder: Does not sanitise and escape the form's 'Email to' fieldCVE-2022-1046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Visual Form Builder
Fixed in
3.0.7
What to do
Update Visual Form Builder to 3.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Multiple Shipping Address Woocommerce: Does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated usersCVE-2022-0783 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
Product
Multiple Shipping Address Woocommerce
Fixed in
2.0
What to do
Update Multiple Shipping Address Woocommerce to 2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022AdRotate: Does not sanitise and escape Advert NamesCVE-2022-0662 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
AdRotate
Fixed in
5.8.23
What to do
Update AdRotate to 5.8.23 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Content Egg: Does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboardCVE-2022-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Content Egg
Fixed in
5.3.0
What to do
Update Content Egg to 5.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Event List: Does not sanitise and escape some of its settingsCVE-2022-0418 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks against other admin even when the unfiltered_html is disallowed
Product
Event List
Fixed in
0.8.8
What to do
Update Event List to 0.8.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Advanced Page Visit Counter: Does not sanitise and escape some input before outputting it in an admin dashboard pageCVE-2021-25086 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it
Product
Advanced Page Visit Counter
Fixed in
6.1.2
What to do
Update Advanced Page Visit Counter to 6.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Donorbox: Does not sanitise and escape its Campaign URL settings before outputting it in an attributeCVE-2022-1396 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
Product
Donorbox
Fixed in
7.1.7
What to do
Update Donorbox to 7.1.7 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Apr 25, 2022LayerSlider: Does not sanitise and escape Project's slug before outputting it back in various placeCVE-2022-1153 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
LayerSlider
Fixed in
7.1.2
What to do
Update LayerSlider to 7.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Menubar: Does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users)CVE-2022-1152 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting
Product
Menubar
Fixed in
5.8
What to do
Update Menubar to 5.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022amr users: Does not sanitise and escape some of its settingsCVE-2022-1094 · WordPress plugins & themes · reported by WPScanMedium 4.8
The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
amr users
Fixed in
4.59.4
What to do
Update amr users to 4.59.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.