Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,154 results · page 31 of 44
Jan 2, 2023White Label CMS: Unserializes user input provided via the settingsCVE-2022-4302 · WordPress plugins & themes · reported by WPScanHigh 7.2
The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- White Label CMS
- Fixed in
- 2.5
- What to do
- Update White Label CMS to 2.5 or newer.
Jan 2, 2023WP AutoComplete Search: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated usersCVE-2022-4297 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- WP AutoComplete Search
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP AutoComplete Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated usersCVE-2022-4237 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.6
- What to do
- Update Welcart e-Commerce to 2.8.6 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated usersCVE-2022-4236 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a fileCVE-2022-4140 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Jan 2, 2023The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site ScripCVE-2022-4114 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks.
- Fixed in
- 1.2.33
- What to do
- Update the plugin to 1.2.33 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Jan 2, 2023Wholesale Market for WooCommerce: Does not validate user input against path traversal attacksCVE-2022-4109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite)
- Product
- Wholesale Market for WooCommerce
- Fixed in
- 2.0.0
- What to do
- Update Wholesale Market for WooCommerce to 2.0.0 or newer.
Jan 2, 2023Joy Of Text Lite: Does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated usersCVE-2022-4099 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection
- Product
- Joy Of Text Lite
- Fixed in
- 2.3.1
- What to do
- Update Joy Of Text Lite to 2.3.1 or newer.
Jan 2, 2023Cryptocurrency Widgets Pack: Does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4059 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Cryptocurrency Widgets Pack
- Fixed in
- 2.0
- What to do
- Update Cryptocurrency Widgets Pack to 2.0 or newer.
Jan 2, 2023WP User: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4049 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- Product
- WP User
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WP User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Build App Online: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-3241 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Build App Online
- Fixed in
- 1.0.19
- What to do
- Update Build App Online to 1.0.19 or newer.
Dec 26, 2022Bulk Delete Users by Email: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4267 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Bulk Delete Users by Email
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bulk Delete Users by Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Bulk Delete Users by Email: Does not have CSRF checkCVE-2022-4266 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete non admin users by knowing their email via a CSRF attack
- Product
- Bulk Delete Users by Email
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bulk Delete Users by Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Workreap: Does not verify that an addon service belongs to the user issuing the requestCVE-2022-4239 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreap_addons_service_remove action, allowing any user to delete any post by knowing or guessing the id.
- Product
- Workreap
- Fixed in
- 2.6.4
- What to do
- Update Workreap to 2.6.4 or newer.
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-loginCVE-2022-4158 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backendCVE-2022-4156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4155 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery Pro: Does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
- Product
- Contest Gallery Pro
- Fixed in
- 19.1.5
- What to do
- Update Contest Gallery Pro to 19.1.5 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Stop Spammers Security | Block Spam Users, Comments, Forms: Passes base64 encoded user input to the unserialize() PHP functionCVE-2022-4120 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2022.6
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2022.6 or newer.
Dec 26, 2022IWS: Does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4117 · WordPress plugins & themes · reported by WPScanCritical 9.8
The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.
- Product
- IWS
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update IWS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Return Refund and Exchange For WooCommerce: Does not validate attachment files to be uploaded via an AJAX action available to unauthenticated usersCVE-2022-4047 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE
- Product
- Return Refund and Exchange For WooCommerce
- Fixed in
- 4.0.9
- What to do
- Update Return Refund and Exchange For WooCommerce to 4.0.9 or newer.
Dec 19, 2022Wholesale Market for WooCommerce: Does not validate user input used to generate system pathCVE-2022-4108 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)
- Product
- Wholesale Market for WooCommerce
- Fixed in
- 1.0.8
- What to do
- Update Wholesale Market for WooCommerce to 1.0.8 or newer.
Dec 19, 2022Directorist: Does not prevent users with low privileges (like subscribers) from accessing sensitive system informationCVE-2022-3961 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information.
- Product
- Directorist
- Fixed in
- 7.4.4
- What to do
- Update Directorist to 7.4.4 or newer.
Dec 15, 2022WP User: Stored Cross-Site ScriptingCVE-2022-4519 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- WP User
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WP User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 15, 2022Transposh WordPress Translation: Unauthorized setting changes by unauthenticated usersCVE-2022-2536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.9.6
- What to do
- Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Dec 12, 2022Listingo: Does not validate files to be uploaded via an AJAX action available to unauthenticated usersCVE-2022-3921 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
- Product
- Listingo
- Fixed in
- 3.2.7
- What to do
- Update Listingo to 3.2.7 or newer.
Dec 12, 2022User Registration: Does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-3912 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.
- Product
- User Registration
- Fixed in
- 2.2.4.1
- What to do
- Update User Registration to 2.2.4.1 or newer.
Dec 12, 2022Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3880 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
- Fixed in
- 4.20
- What to do
- Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to 4.20 or newer.
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3849 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3848 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list: Does not validate dataCVE-2022-3603 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.
- Product
- Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list
- Fixed in
- 2.0.69
- What to do
- Update Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list to 2.0.69 or newer.
Nov 28, 2022Awesome Support: Does not ensure that the exported tickets archive to be downloaded belongs to the user making the requestCVE-2022-3511 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
- Product
- Awesome Support
- Fixed in
- 6.1.2
- What to do
- Update Awesome Support to 6.1.2 or newer.
Nov 28, 2022Checkout Field Editor (Checkout Manager) for WooCommerce: Unserializes user input provided via the settingsCVE-2022-3490 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Checkout Field Editor (Checkout Manager) for WooCommerce
- Fixed in
- 1.8.0
- What to do
- Update Checkout Field Editor (Checkout Manager) for WooCommerce to 1.8.0 or newer.
Nov 28, 2022Find and Replace All: Does not sanitize and escape some parameters from its setting page before outputting them back to the userCVE-2022-2311 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 28, 2022Download: Does not properly validate a user has the required privileges to access a backup's nonce identifierCVE-2021-25059 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.
- Product
- Download
- Fixed in
- 2.0.0
- What to do
- Update Download to 2.0.0 or newer.
Nov 21, 2022WP User Frontend: Uses a user supplied argument called urhidden in its registration formCVE-2021-24649 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin
- Product
- WP User Frontend
- Fixed in
- 3.5.29
- What to do
- Update WP User Frontend to 3.5.29 or newer.
Nov 7, 2022Import and export users and customers: Does not properly escape dataCVE-2022-3558 · WordPress plugins & themes · reported by WPScanHigh 8
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
- Product
- Import and export users and customers
- Fixed in
- 1.20.5
- What to do
- Update Import and export users and customers to 1.20.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 7, 2022WooCommerce Dropshipping: Does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated usersCVE-2022-3481 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
- Product
- WooCommerce Dropshipping
- Fixed in
- 4.4
- What to do
- Update WooCommerce Dropshipping to 4.4 or newer.
Oct 31, 2022Automatic User Roles Switcher: Does not have authorisation and proper CSRF checksCVE-2022-3419 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator
- Product
- Automatic User Roles Switcher
- Fixed in
- 1.1.2
- What to do
- Update Automatic User Roles Switcher to 1.1.2 or newer.
Oct 31, 2022LearnPress: Unserialises user input in a REST API endpoint available to unauthenticated usersCVE-2022-3360 · WordPress plugins & themes · reported by WPScanHigh 8.1
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution (RCE). To successfully exploit this vulnerability attackers must have knowledge of the site secrets, allowing them to generate a valid hash via the wp_hash() function.
- Product
- LearnPress
- Fixed in
- 4.1.7.2
- What to do
- Update LearnPress to 4.1.7.2 or newer.
Oct 31, 2022WordPress Classifieds: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users andCVE-2022-3254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection
- Product
- WordPress Classifieds
- Fixed in
- 4.3
- What to do
- Update WordPress Classifieds to 4.3 or newer.
Oct 31, 2022WP Total Hacks: Does not prevent low privilege users from modifying the plugin's settingsCVE-2022-3096 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other users, like administrators, due to the lack of sanitisation and escaping as well.
- Product
- WP Total Hacks
- Affected
- up to 4.7.2
- What to do
- Affects up to 4.7.2. Update WP Total Hacks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2022WP All Export Pro: Does not limit some functionality during exports only to users with the Administrator roleCVE-2022-3394 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
- Product
- WP All Export Pro
- Fixed in
- 1.7.9
- What to do
- Update WP All Export Pro to 1.7.9 or newer.
Oct 21, 2022Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder: Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email)CVE-2022-38104 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.
- Product
- Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 10, 2022Disable User Login: Does not have authorisation and CSRF checksCVE-2022-2350 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will.
- Product
- Disable User Login
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Disable User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2022Frontend File Manager: Allows any authenticated usersCVE-2022-3125 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE
- Product
- Frontend File Manager
- Fixed in
- 21.3
- What to do
- Update Frontend File Manager to 21.3 or newer.
Oct 3, 2022Frontend File Manager: Allows any unauthenticated user to rename uploaded files from usersCVE-2022-3124 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server
- Product
- Frontend File Manager
- Fixed in
- 21.3
- What to do
- Update Frontend File Manager to 21.3 or newer.
Sep 26, 2022CM Download Manager: Allows high privilege users suchCVE-2022-3076 · WordPress plugins & themes · reported by WPScanHigh 7.2
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
- Product
- CM Download Manager
- Fixed in
- 2.8.6
- What to do
- Update CM Download Manager to 2.8.6 or newer.
Sep 19, 2022NEX-Forms: Does not properly sanitise and escape user input before using it in SQL statementsCVE-2022-3142 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Product
- NEX-Forms
- Fixed in
- 7.9.7
- What to do
- Update NEX-Forms to 7.9.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.commedium.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.