Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,981 results · page 34 of 60
Jan 16, 2023Real Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4648 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Real Testimonials
- Fixed in
- 2.6.0
- What to do
- Update Real Testimonials to 2.6.0 or newer.
Jan 16, 2023Video Conferencing with Zoom: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4578 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Video Conferencing with Zoom
- Fixed in
- 4.0.10
- What to do
- Update Video Conferencing with Zoom to 4.0.10 or newer.
Jan 16, 2023Seriously Simple Podcasting: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Seriously Simple Podcasting
- Fixed in
- 2.19.1
- What to do
- Update Seriously Simple Podcasting to 2.19.1 or newer.
Jan 16, 2023MashShare: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- MashShare
- Fixed in
- 3.8.7
- What to do
- Update MashShare to 3.8.7 or newer.
Jan 16, 2023ConvertKit: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4508 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- ConvertKit
- Fixed in
- 2.0.5
- What to do
- Update ConvertKit to 2.0.5 or newer.
Jan 16, 2023Real Cookie Banner: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4507 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Real Cookie Banner
- Fixed in
- 3.4.10
- What to do
- Update Real Cookie Banner to 3.4.10 or newer.
Jan 16, 2023Easy Accordion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4487 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Accordion
- Fixed in
- 2.2.0
- What to do
- Update Easy Accordion to 2.2.0 or newer.
Jan 16, 2023Meteor Slides: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4486 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Meteor Slides
- Fixed in
- 1.5.7
- What to do
- Update Meteor Slides to 1.5.7 or newer.
Jan 16, 2023Social Share, Social Login and Social Comments: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4484 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.44
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.44 or newer.
Jan 16, 2023Insert Pages: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4483 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Insert Pages
- Fixed in
- 3.7.5
- What to do
- Update Insert Pages to 3.7.5 or newer.
Jan 16, 2023Carousel, Slider, Gallery by WP Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4482 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Carousel, Slider, Gallery by WP Carousel
- Fixed in
- 2.5.3
- What to do
- Update Carousel, Slider, Gallery by WP Carousel to 2.5.3 or newer.
Jan 16, 2023Mesmerize Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4481 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Mesmerize Companion
- Fixed in
- 1.6.135
- What to do
- Update Mesmerize Companion to 1.6.135 or newer.
Jan 16, 2023Click to Chat: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4480 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Click to Chat
- Fixed in
- 3.18.1
- What to do
- Update Click to Chat to 3.18.1 or newer.
Jan 16, 2023Font Awesome: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4478 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Font Awesome
- Fixed in
- 4.3.2
- What to do
- Update Font Awesome to 4.3.2 or newer.
Jan 16, 2023Smash Balloon Social Post Feed: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 4.1.6
- What to do
- Update Smash Balloon Social Post Feed to 4.1.6 or newer.
Jan 16, 2023Download Manager: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4476 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Download Manager
- Fixed in
- 3.2.62
- What to do
- Update Download Manager to 3.2.62 or newer.
Jan 16, 2023Simple Membership: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4469 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Simple Membership
- Fixed in
- 4.2.2
- What to do
- Update Simple Membership to 4.2.2 or newer.
Jan 16, 2023WP Video Lightbox: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4465 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- WP Video Lightbox
- Fixed in
- 1.9.7
- What to do
- Update WP Video Lightbox to 1.9.7 or newer.
Jan 16, 2023Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, whiCVE-2022-4464 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.
- Fixed in
- 1.2.1
- What to do
- Update the plugin to 1.2.1 or newer.
Jan 16, 2023Sidebar Widgets by CodeLights: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4460 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- Sidebar Widgets by CodeLights
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 20233D FlipBook: Does not validate or escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4453 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators.
- Product
- 3D FlipBook
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4451 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Sharing
- Fixed in
- 3.3.45
- What to do
- Update Social Sharing to 3.3.45 or newer.
Jan 16, 2023Page scroll to id: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4449 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Page scroll to id
- Fixed in
- 1.7.6
- What to do
- Update Page scroll to id to 1.7.6 or newer.
Jan 16, 2023WOOCS: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4431 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WOOCS
- Fixed in
- 1.3.9.4
- What to do
- Update WOOCS to 1.3.9.4 or newer.
Jan 16, 2023WordPress Events Calendar: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin).
- Product
- WordPress Events Calendar
- Fixed in
- 1.4.5
- What to do
- Update WordPress Events Calendar to 1.4.5 or newer.
Jan 16, 2023Show All Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4295 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
- Product
- Show All Comments
- Fixed in
- 7.0.1
- What to do
- Update Show All Comments to 7.0.1 or newer.
Jan 16, 2023User Post Gallery: Does not limit what callback functions can be called by usersCVE-2022-4060 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.
- Product
- User Post Gallery
- Affected
- up to 2.19
- What to do
- Affects up to 2.19. Update User Post Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Jetpack CRM: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4497 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins
- Product
- Jetpack CRM
- Fixed in
- 5.5
- What to do
- Update Jetpack CRM to 5.5 or newer.
Jan 9, 2023WP-Table Reloaded: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4491 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.
- Product
- WP-Table Reloaded
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update WP-Table Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Table of Contents Plus: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4479 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Table of Contents Plus
- Fixed in
- 2212
- What to do
- Update Table of Contents Plus to 2212 or newer.
Jan 9, 2023WP Recipe Maker: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4468 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- WP Recipe Maker
- Fixed in
- 8.6.1
- What to do
- Update WP Recipe Maker to 8.6.1 or newer.
Jan 9, 2023Bg Bible References: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2022-4374 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- Bg Bible References
- Affected
- up to 3.8.14
- What to do
- Affects up to 3.8.14. Update Bg Bible References to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023WP CSV: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2022-4368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot have CSRF checks in place as well, leading to a Reflected Cross-Site Scripting.
- Product
- WP CSV
- Affected
- up to 1.8.0.0
- What to do
- Affects up to 1.8.0.0. Update WP CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Post Status Notifier Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin.
- Product
- Post Status Notifier Lite
- Fixed in
- 1.10.1
- What to do
- Update Post Status Notifier Lite to 1.10.1 or newer.
Jan 9, 2023Sunshine Photo Cart: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4301 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- Sunshine Photo Cart
- Fixed in
- 2.9.15
- What to do
- Update Sunshine Photo Cart to 2.9.15 or newer.
Jan 2, 2023WP-Lister Lite for Amazon: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4369 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin.
- Product
- WP-Lister Lite for Amazon
- Fixed in
- 2.4.4
- What to do
- Update WP-Lister Lite for Amazon to 2.4.4 or newer.
Jan 2, 2023Product list Widget for Woocommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4329 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).
- Product
- Product list Widget for Woocommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Product list Widget for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Wholesale Market for WooCommerce: Does not validate user input against path traversal attacksCVE-2022-4109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite)
- Product
- Wholesale Market for WooCommerce
- Fixed in
- 2.0.0
- What to do
- Update Wholesale Market for WooCommerce to 2.0.0 or newer.
Jan 2, 2023Cryptocurrency Widgets Pack: Does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4059 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Cryptocurrency Widgets Pack
- Fixed in
- 2.0
- What to do
- Update Cryptocurrency Widgets Pack to 2.0 or newer.
Dec 26, 2022Bulk Delete Users by Email: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4267 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Bulk Delete Users by Email
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bulk Delete Users by Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backendCVE-2022-4156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 19, 2022Photo Gallery by 10Web: Does not validate and escape some parameters before outputting them back in in JS code later on in another pageCVE-2022-4058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.8.3
- What to do
- Update Photo Gallery by 10Web to 1.8.3 or newer.
Dec 19, 2022Responsive Lightbox2: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3987 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Lightbox2
- Fixed in
- 1.0.4
- What to do
- Update Responsive Lightbox2 to 1.0.4 or newer.
Dec 19, 2022WP Stripe Checkout: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3986 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WP Stripe Checkout
- Fixed in
- 1.2.2.21
- What to do
- Update WP Stripe Checkout to 1.2.2.21 or newer.
Dec 19, 2022Videojs HTML5 Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3985 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Videojs HTML5 Player
- Fixed in
- 1.1.9
- What to do
- Update Videojs HTML5 Player to 1.1.9 or newer.
Dec 19, 2022Flowplayer Video Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3984 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Flowplayer Video Player
- Fixed in
- 1.0.5
- What to do
- Update Flowplayer Video Player to 1.0.5 or newer.
Dec 19, 2022Checkout for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3983 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Checkout for PayPal
- Fixed in
- 1.0.14
- What to do
- Update Checkout for PayPal to 1.0.14 or newer.
Dec 14, 2022WordPress is affected by an unauthenticated blind SSRF in the pingback feature.CVE-2022-3590 · WordPress plugins & themes · reported by WPScanMedium 5.9
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordblog.sonarsource.comwpscan.com
Dec 12, 2022All-In-One Security (AIOS): Is susceptible to IP Spoofing attacksCVE-2022-4097 · WordPress plugins & themes · reported by WPScanMedium 5.3
The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.0.8
- What to do
- Update All-In-One Security (AIOS) to 5.0.8 or newer.
Dec 12, 2022FlatPM: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2022-3934 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- FlatPM
- Fixed in
- 3.0.13
- What to do
- Update FlatPM to 3.0.13 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.