Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

2,154 results · page 32 of 44

Sep 19, 2022BadgeOS: Does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated usersCVE-2022-2958 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections
Product
BadgeOS
Fixed in
3.7.1.3
What to do
Update BadgeOS to 3.7.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
Product
Zephyr Project Manager
Fixed in
3.2.5
What to do
Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Sep 19, 2022Ketchup Restaurant Reservations: Does not sanitise and escape some of the reservation user inputsCVE-2022-2753 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made
Product
Ketchup Restaurant Reservations
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Ketchup Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 19, 2022Site Offline Or Coming Soon Or Maintenance Mode: Prevents users from accessing a website but does not do so if the URL contained certain keywordsCVE-2022-1580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
Product
Site Offline Or Coming Soon Or Maintenance Mode
Fixed in
1.5.3
What to do
Update Site Offline Or Coming Soon Or Maintenance Mode to 1.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 9, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress.CVE-2022-37403 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nikhil Vaghela's Add User Role plugin <= 0.0.1 at WordPress.
Affected
up to 0.0.1
What to do
Affects up to 0.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 6, 2022WP Users Exporter: CSV InjectionCVE-2022-3026 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profile information like First Names that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Product
WP Users Exporter
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update WP Users Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 6, 2022The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0.CVE-2022-2941 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected
up to 2.88.0
What to do
Affects up to 2.88.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Sep 6, 2022WP-UserOnline: Stored Cross-Site ScriptingCVE-2022-2473 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in versions up to, and including, 2.87.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative capabilities and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The only affects multi-site installations and installations where unfiltered_html is disabled.
Product
WP-UserOnline
Affected
up to 2.87.6
What to do
Affects up to 2.87.6. Update WP-UserOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 6, 2022Transposh WordPress Translation: Sensitive information disclosure to unauthenticated usersCVE-2022-2462 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.
Product
Transposh WordPress Translation
Affected
up to 1.0.9.6
What to do
Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Sep 6, 2022Transposh WordPress Translation: Unauthorized setting changes by unauthenticated usersCVE-2022-2461 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.
Product
Transposh WordPress Translation
Affected
up to 1.0.9.6
What to do
Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com plugins.trac.wordpress.org
Sep 5, 2022Simple Payment Donations & Subscriptions: Does not sanitise and escape user input given in its formsCVE-2022-2565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
Product
Simple Payment Donations & Subscriptions
Fixed in
4.2.1
What to do
Update Simple Payment Donations & Subscriptions to 4.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 5, 2022The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticatedCVE-2022-2376 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
Product
Directorist
Fixed in
7.3.1
What to do
Update Directorist to 7.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022Mailchimp for WooCommerce: Has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LANCVE-2022-2556 · WordPress plugins & themes · reported by WPScanLow 2.7
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
Product
Mailchimp for WooCommerce
Fixed in
2.7.2
What to do
Update Mailchimp for WooCommerce to 2.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 29, 2022Mailchimp for WooCommerce: Has an AJAX action that allows any logged in users (suchCVE-2022-2267 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
Product
Mailchimp for WooCommerce
Fixed in
2.7.1
What to do
Update Mailchimp for WooCommerce to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
Product
Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro
Fixed in
5.12.3
What to do
Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.
Full record and what to do →NVD record wpscan.com pritect.net
Aug 22, 2022Lana Downloads Manager: Is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higherCVE-2022-2392 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher.
Product
Lana Downloads Manager
Fixed in
1.8.0
What to do
Update Lana Downloads Manager to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Simple Banner: Does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2022-0446 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Simple Banner
Fixed in
2.12.0
What to do
Update Simple Banner to 2.12.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated usersCVE-2021-24910 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Product
Transposh WordPress Translation
Fixed in
1.0.8
What to do
Update Transposh WordPress Translation to 1.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 15, 2022SearchWP Live Ajax Search: Does not ensure that users making a live search are limited to published posts onlyCVE-2022-2535 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink
Product
SearchWP Live Ajax Search
Fixed in
1.6.2
What to do
Update SearchWP Live Ajax Search to 1.6.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 15, 2022VR Calendar: Lets any user execute arbitrary PHP functions on the siteCVE-2022-2314 · WordPress plugins & themes · reported by WPScanCritical 9.8
The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.
Product
VR Calendar
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update VR Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022WPDating: Does not properly escape user input before concatenating it to certain SQL queriesCVE-2022-2460 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users
Product
WPDating
Fixed in
7.4.0
What to do
Update WPDating to 7.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript iCVE-2022-2391 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.
Fixed in
7.2.3
What to do
Update the plugin to 7.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022Easy Username Updater: Does not implement CSRF checksCVE-2022-2355 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin
Product
Easy Username Updater
Fixed in
1.0.5
What to do
Update Easy Username Updater to 1.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
Product
Website File Changes Monitor
Fixed in
1.8.3
What to do
Update Website File Changes Monitor to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPCVE-2022-36343 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 1, 2022Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.CVE-2022-34154 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 1, 2022Simple Membership: Allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameterCVE-2022-2317 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.
Product
Simple Membership
Fixed in
4.1.3
What to do
Update Simple Membership to 4.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022CAPTCHA 4WP: Lets user input reach a sensitive require_once call in one of its admin-side templatesCVE-2022-2184 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.
Product
CAPTCHA 4WP
Fixed in
7.1.0
What to do
Update CAPTCHA 4WP to 7.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Youzify: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1950 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
Product
Youzify
Fixed in
1.2.0
What to do
Update Youzify to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Copyright Proof: Does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-1906 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
Product
Copyright Proof
Affected
up to 4.16
What to do
Affects up to 4.16. Update Copyright Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 29, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress.CVE-2022-36378 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress.
Affected
up to 3.0
What to do
Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 28, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.CVE-2022-35882 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 27, 2022Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress.CVE-2022-33943 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 25, 2022Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.CVE-2022-36375 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
Jul 25, 2022SP Project & Document Manager: Uses an easily guessable path to store user filesCVE-2022-1551 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.
Product
SP Project & Document Manager
Fixed in
4.58
What to do
Update SP Project & Document Manager to 4.58 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 22, 2022Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.CVE-2022-34853 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 22, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.CVE-2022-34650 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 22, 2022Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.CVE-2022-33960 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 22, 2022Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.CVE-2022-33191 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 22, 2022Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugiCVE-2022-30998 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin <= 1.1 at WordPress.
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 17, 2022CDI: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1933 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
Product
CDI
Fixed in
5.1.9
What to do
Update CDI to 5.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022WP User Manager: Does not ensure that the user ID to reset the password of is related to the reset key givenCVE-2021-24655 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account.
Product
WP User Manager
Fixed in
2.6.3
What to do
Update WP User Manager to 2.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022Awin Data Feed: Does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
Product
Awin Data Feed
Fixed in
1.8
What to do
Update Awin Data Feed to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022Pricing Deals for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1057 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
Product
Pricing Deals for WooCommerce
Affected
up to 2.0.2.02
What to do
Affects up to 2.0.2.02. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2022Gallery: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1946 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Product
Gallery
Fixed in
2.0.0
What to do
Update Gallery to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Import Export All WordPress Images, Users & Post Types: Does not fully validate the file to be imported via an URL before making an HTTP request to itCVE-2022-1977 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
Product
Import Export All WordPress Images, Users & Post Types
Fixed in
6.5.3
What to do
Update Import Export All WordPress Images, Users & Post Types to 6.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Pricing Tables: Does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated)CVE-2022-1904 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflected Cross-Site Scripting
Product
Pricing Tables
Fixed in
3.2.1
What to do
Update Pricing Tables to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022ARMember: Is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated usersCVE-2022-1903 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
Product
ARMember
Fixed in
3.4.8
What to do
Update ARMember to 3.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022New User Approve: Does not have CSRF check in placeCVE-2022-1625 · WordPress plugins & themes · reported by WPScanMedium 4.3
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.
Product
New User Approve
Fixed in
2.4
What to do
Update New User Approve to 2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Login using WordPress Users ( WP as SAML IDP ): Does not sanitise and escape some of its settingsCVE-2022-1010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Login using WordPress Users ( WP as SAML IDP )
Fixed in
1.13.4
What to do
Update Login using WordPress Users ( WP as SAML IDP ) to 1.13.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.