Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,184 results · page 32 of 64
Mar 11, 2024Ultimate Posts Widget: Does not validate and escape some of its Widget options before outputting them back in attributesCVE-2024-0561 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Posts Widget
- Fixed in
- 2.3.1
- What to do
- Update Ultimate Posts Widget to 2.3.1 or newer.
Mar 11, 2024Enhanced Text Widget: Does not validate and escape some of its Widget options before outputting them back in attributesCVE-2024-0559 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Enhanced Text Widget
- Fixed in
- 1.6.6
- What to do
- Update Enhanced Text Widget to 1.6.6 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Feb 27, 2024Shariff Wrapper: Does not sanitise and escape some of its settingsCVE-2024-1106 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Shariff Wrapper
- Fixed in
- 4.6.10
- What to do
- Update Shariff Wrapper to 4.6.10 or newer.
Feb 27, 2024Persian Fonts: Does not sanitise and escape some of its settingsCVE-2023-7167 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Persian Fonts
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Persian Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2024Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2023-7115 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.1
- What to do
- Update Page Builder: Pagelayer to 1.8.1 or newer.
Feb 12, 2024Smart Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0566 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- Smart Manager
- Fixed in
- 8.28.0
- What to do
- Update Smart Manager to 8.28.0 or newer.
Feb 12, 2024MapPress Maps for: Does not sanitize and escape the map titleCVE-2024-0420 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks
- Product
- MapPress Maps for
- Fixed in
- 2.88.15
- What to do
- Update MapPress Maps for to 2.88.15 or newer.
Feb 12, 2024GigPress: Does not sanitise and escape some of its settingsCVE-2023-7233 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GigPress
- Affected
- up to 2.3.29
- What to do
- Affects up to 2.3.29. Update GigPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024Popup Box: Does not sanitise and escape some of its settingsCVE-2023-6591 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Popup Box
- Fixed in
- 20.9.0
- What to do
- Update Popup Box to 20.9.0 or newer.
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6082 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- chartjs
- Affected
- up to 2023.2
- What to do
- Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6081 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- chartjs
- Affected
- up to 2023.2
- What to do
- Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 5, 2024Getwid – Gutenberg Blocks: CAPTCHA BypassCVE-2023-6963 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to bypass the Captcha Verification of the Contact Form block by omitting 'g-recaptcha-response' from the 'data' array.
- Product
- Getwid – Gutenberg Blocks
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Getwid – Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 2, 2024Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on theCVE-2024-1047 · WordPress plugins & themes · reported by WordfenceMedium 5.3
Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.
- Affected
- up to 2.10.28
- What to do
- Affects up to 2.10.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 29, 2024EventON: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-7200 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EventON
- Fixed in
- 4.4.1
- What to do
- Update EventON to 4.4.1 or newer.
Jan 29, 2024TJ Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6530 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- TJ Shortcodes
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update TJ Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Jan 29, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the pageCVE-2023-6278 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
- Fixed in
- 2.2.25
- What to do
- Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to 2.2.25 or newer.
Jan 29, 2024Restrict Usernames Emails Characters: Does not sanitise and escape some of its settingsCVE-2023-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Restrict Usernames Emails Characters
- Fixed in
- 3.1.4
- What to do
- Update Restrict Usernames Emails Characters to 3.1.4 or newer.
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5956 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Wp-Adv-Quiz
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Wp-Adv-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5943 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Wp-Adv-Quiz
- Fixed in
- 1.0.3
- What to do
- Update Wp-Adv-Quiz to 1.0.3 or newer.
Jan 26, 2024Image Source Control Lite – Show Image Credits and Captions: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-52187 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Thomas Maier Image Source Control Lite – Show Image Credits and Captions.This issue affects Image Source Control Lite – Show Image Credits and Captions: from n/a through 2.17.0.
- Product
- Image Source Control Lite – Show Image Credits and Captions
- Affected
- up to 2.17.0
- What to do
- Affects up to 2.17.0. Update Image Source Control Lite – Show Image Credits and Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 22, 2024Meris: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-7194 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Meris
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Meris to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2024EventON-RSVP: Does not sanitise and escape some parameters before outputting it back in the pageCVE-2023-7170 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EventON-RSVP
- Fixed in
- 2.9.5
- What to do
- Update EventON-RSVP to 2.9.5 or newer.
Jan 22, 2024Product Enquiry for WooCommerce: Does not sanitise and escape some of its settingsCVE-2023-6626 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.1
- What to do
- Update Product Enquiry for WooCommerce to 3.1 or newer.
Jan 22, 2024WP Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6456 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Review Slider
- Fixed in
- 13.0
- What to do
- Update WP Review Slider to 13.0 or newer.
Jan 22, 2024SEOPress: Does not sanitise and escape some of its settingsCVE-2023-6290 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- SEOPress
- Fixed in
- 7.3
- What to do
- Update SEOPress to 7.3 or newer.
Jan 16, 2024Contact Form 7 Connector: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Connector WordPress plugin before 1.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against administrators.
- Product
- Contact Form 7 Connector
- Fixed in
- 1.2.3
- What to do
- Update Contact Form 7 Connector to 1.2.3 or newer.
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Do not properly sanitise and escape a parameter before outputting it back in pagesCVE-2024-0233 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EventON WordPress plugin before 4.5.5, EventON
- Fixed in
- 4.5.5
- What to do
- Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Jan 16, 2024Community by PeepSo: Does not sanitise and escape various parameters and generated URLs before outputting them back attributesCVE-2024-0187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Community by PeepSo
- Fixed in
- 6.3.1.2
- What to do
- Update Community by PeepSo to 6.3.1.2 or newer.
Jan 16, 2024Hubbub Lite (formerly Grow Social): Does not sanitise and escape some of its settingsCVE-2023-7154 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Hubbub Lite (formerly Grow Social)
- Fixed in
- 1.32.0
- What to do
- Update Hubbub Lite (formerly Grow Social) to 1.32.0 or newer.
Jan 16, 2024Product Enquiry for WooCommerce: Does not sanitise and escape the page parameter before outputting it back in an attributeCVE-2023-7151 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.2
- What to do
- Update Product Enquiry for WooCommerce to 3.2 or newer.
Jan 16, 2024WP Customer Area: Does not properly validates user capabilities in some of its AJAX actionsCVE-2023-6824 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.
- Product
- WP Customer Area
- Fixed in
- 8.2.1
- What to do
- Update WP Customer Area to 8.2.1 or newer.
Jan 16, 2024WP Customer Area: Does not properly validate users capabilities in some of its AJAX actionsCVE-2023-6741 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.
- Product
- WP Customer Area
- Fixed in
- 8.2.1
- What to do
- Update WP Customer Area to 8.2.1 or newer.
Jan 16, 2024Ultimate Maps by Supsystic: Does not sanitise and escape some of its settingsCVE-2023-6732 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Ultimate Maps by Supsystic
- Fixed in
- 1.2.16
- What to do
- Update Ultimate Maps by Supsystic to 1.2.16 or newer.
Jan 16, 2024ArtPlacer Widget: Does not sanitize and escape the "id" parameter before submitting the queryCVE-2023-6373 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
- Product
- ArtPlacer Widget
- Fixed in
- 2.20.7
- What to do
- Update ArtPlacer Widget to 2.20.7 or newer.
Jan 16, 2024EventON: Does not sanitise and escape some of its settingsCVE-2023-6046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfiltered_html capability is disallowed.
- Product
- EventON
- Fixed in
- 2.2
- What to do
- Update EventON to 2.2 or newer.
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Does not sanitize and escape some of its settingsCVE-2023-6005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- EventON WordPress plugin before 4.5.5, EventON
- Fixed in
- 4.5.5
- What to do
- Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Jan 16, 2024LearnPress: Does not sanitise and escape user input before outputting it back in the pageCVE-2023-5558 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- LearnPress
- Fixed in
- 4.2.5.5
- What to do
- Update LearnPress to 4.2.5.5 or newer.
Jan 16, 2024Newsletters: Does not properly escape user-controlled parametersCVE-2023-4797 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Newsletters WordPress plugin before 4.9.3 does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server.
- Product
- Newsletters
- Fixed in
- 4.9.3
- What to do
- Update Newsletters to 4.9.3 or newer.
Jan 16, 2024Staff / Employee Business Directory for Active Directory: Does not sanitize and escape data returned from the LDAP server before rendering it in the pageCVE-2023-4757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Staff / Employee Business Directory for Active Directory WordPress plugin before 1.2.3 does not sanitize and escape data returned from the LDAP server before rendering it in the page, allowing users who can control their entries in the LDAP directory to inject malicious javascript which could be used against high-privilege users such as a site admin.
- Product
- Staff / Employee Business Directory for Active Directory
- Fixed in
- 1.2.3
- What to do
- Update Staff / Employee Business Directory for Active Directory to 1.2.3 or newer.
Jan 16, 2024IURNY by INDIGITALL: Does not sanitise and escape some of its settingsCVE-2023-3647 · WordPress plugins & themes · reported by WPScanMedium 4.8
The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- IURNY by INDIGITALL
- Fixed in
- 3.2.3
- What to do
- Update IURNY by INDIGITALL to 3.2.3 or newer.
Jan 16, 2024Lana Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-3372 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Lana Shortcodes
- Fixed in
- 1.2.0
- What to do
- Update Lana Shortcodes to 1.2.0 or newer.
Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- WordPress Database Administrator
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Contact Form by WD: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2655 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Contact Form by WD
- Affected
- up to 1.13.23
- What to do
- Affects up to 1.13.23. Update Contact Form by WD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024hiWeb Migration Simple: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0769 · WordPress plugins & themes · reported by WPScanMedium 6.1
The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
- Product
- hiWeb Migration Simple
- Affected
- up to 2.0.0.1
- What to do
- Affects up to 2.0.0.1. Update hiWeb Migration Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Calculated Fields Form: Does not sanitise and escape some of its form settingsCVE-2023-0389 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Calculated Fields Form
- Fixed in
- 1.1.151
- What to do
- Update Calculated Fields Form to 1.1.151 or newer.
Jan 16, 2024Qubely: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0376 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Qubely
- Fixed in
- 1.8.5
- What to do
- Update Qubely to 1.8.5 or newer.
Jan 16, 2024GiveWP: Does not properly escape user input before it reaches SQL queriesCVE-2023-0224 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated attackers perform SQL Injection attacks
- Product
- GiveWP
- Fixed in
- 2.24.1
- What to do
- Update GiveWP to 2.24.1 or newer.
Jan 16, 2024UpQode Google Maps: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0094 · WordPress plugins & themes · reported by WPScanMedium 5.4
The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- UpQode Google Maps
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update UpQode Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Customer Reviews for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0079 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Customer Reviews for WooCommerce
- Fixed in
- 5.17.0
- What to do
- Update Customer Reviews for WooCommerce to 5.17.0 or newer.
Jan 16, 2024Seed Social: Does not sanitise and escape some of its settingsCVE-2022-3836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Seed Social
- Fixed in
- 2.0.4
- What to do
- Update Seed Social to 2.0.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.