Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,184 results · page 34 of 64
Nov 27, 2023WordPress Backup & Migration: Does not sanitise and escape some parametersCVE-2023-5738 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
- Product
- WordPress Backup & Migration
- Fixed in
- 1.4.4
- What to do
- Update WordPress Backup & Migration to 1.4.4 or newer.
Nov 27, 2023WassUp Real Time Analytics: Does not escape IP address provided via some headers before outputting them back in an admin pageCVE-2023-5653 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins
- Product
- WassUp Real Time Analytics
- Affected
- up to 1.9.4.5
- What to do
- Affects up to 1.9.4.5. Update WassUp Real Time Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2023Martins Free & Easy SEO BackLink Link Building Network: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Martins Free & Easy SEO BackLink Link Building Network
- Fixed in
- 1.2.30
- What to do
- Update Martins Free & Easy SEO BackLink Link Building Network to 1.2.30 or newer.
Nov 27, 2023WP-UserOnline: Does not sanitise and escape the X-Forwarded-For header before outputting its content on the pageCVE-2023-5560 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- WP-UserOnline
- Fixed in
- 2.88.3
- What to do
- Update WP-UserOnline to 2.88.3 or newer.
Nov 27, 2023The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSSCVE-2023-5325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS
- Product
- Woocommerce Vietnam Checkout
- Fixed in
- 2.0.6
- What to do
- Update Woocommerce Vietnam Checkout to 2.0.6 or newer.
Nov 27, 2023WordPress Online Booking and Scheduling: Does not sanitise and escape some of its settingsCVE-2023-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Online Booking and Scheduling
- Fixed in
- 22.5
- What to do
- Update WordPress Online Booking and Scheduling to 22.5 or newer.
Nov 27, 2023Mmm Simple File List: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4514 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Mmm Simple File List
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Mmm Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2023gAppointments: Does not sanitise and escape some of its settingsCVE-2023-2707 · WordPress plugins & themes · reported by WPScanMedium 4.8
The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- gAppointments
- Affected
- up to 1.9.5.1
- What to do
- Affects up to 1.9.5.1. Update gAppointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2023The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauCVE-2023-5640 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection vulnerability.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddevl00p.github.iowpscan.com
Nov 20, 2023Seraphinite Accelerator: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5609 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Seraphinite Accelerator
- Fixed in
- 2.2.29
- What to do
- Update Seraphinite Accelerator to 2.2.29 or newer.
Nov 20, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5343 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Popup box
- Fixed in
- 3.7.9
- What to do
- Update Popup box to 3.7.9 or newer.
Nov 20, 2023Bonus for Woo: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-5140 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Bonus for Woo
- Fixed in
- 5.8.3
- What to do
- Update Bonus for Woo to 5.8.3 or newer.
Nov 20, 2023PubyDoc: Does not sanitise and escape some of its settingsCVE-2023-4970 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- PubyDoc
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update PubyDoc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2023WP Post Popup: Does not sanitise and escape some of its inputsCVE-2023-4808 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Post Popup
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update WP Post Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2023Magic Embeds: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4799 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Magic Embeds
- Fixed in
- 3.1.2
- What to do
- Update Magic Embeds to 3.1.2 or newer.
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin <= 1.3.3 versions.CVE-2023-28167 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin <= 1.3.3 versions.
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 7, 2023Featured Image Caption: Stored Cross-Site ScriptingCVE-2023-5669 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, and including, 0.8.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Featured Image Caption
- Affected
- up to 0.8.10
- What to do
- Affects up to 0.8.10. Update Featured Image Caption to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2023URL Shortify: Does not sanitise and escape some of its settingsCVE-2023-5605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- URL Shortify
- Fixed in
- 1.7.9.1
- What to do
- Update URL Shortify to 1.7.9.1 or newer.
Nov 6, 2023Ninja Forms Contact Form: Does not sanitize and escape its label fieldsCVE-2023-5530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.34
- What to do
- Update Ninja Forms Contact Form to 3.6.34 or newer.
Full record and what to do →NVD recordninjaforms.comwpscan.com
Nov 6, 2023Awesome Support: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5354 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Awesome Support
- Fixed in
- 6.1.5
- What to do
- Update Awesome Support to 6.1.5 or newer.
Nov 6, 2023User Registration: Does not sanitize and escape some of its settingsCVE-2023-5228 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- User Registration
- Fixed in
- 3.0.4.2
- What to do
- Update User Registration to 3.0.4.2 or newer.
Nov 6, 2023WP Discord Invite: Does not sanitise and escape some of its settingsCVE-2023-5181 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Discord Invite
- Fixed in
- 2.5.2
- What to do
- Update WP Discord Invite to 2.5.2 or newer.
Nov 6, 2023History Log by click5: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5082 · WordPress plugins & themes · reported by WPScanHigh 7.2
The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it.
- Product
- History Log by click5
- Fixed in
- 1.0.13
- What to do
- Update History Log by click5 to 1.0.13 or newer.
Nov 6, 2023Simple Table Manager: Does not sanitise and escape some of its settingsCVE-2023-4858 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Table Manager
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Simple Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2023Responsive Pricing Table: Does not sanitise and escape some of its settingsCVE-2023-4810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Pricing Table
- Fixed in
- 5.1.8
- What to do
- Update Responsive Pricing Table to 5.1.8 or newer.
Full record and what to do →NVD recordportswigger.netwpscan.com
Nov 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.CVE-2023-46777 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions.
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 31, 2023Photos and Files Contest Gallery: Does not sanitise and escape some parametersCVE-2023-5307 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.
- Product
- Photos and Files Contest Gallery
- Fixed in
- 21.2.8.1
- What to do
- Update Photos and Files Contest Gallery to 21.2.8.1 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Oct 31, 2023Login Screen Manager: Does not sanitize and escape some of its settingsCVE-2023-5243 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login Screen Manager
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update Login Screen Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 31, 2023EventPrime: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5238 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
- Product
- EventPrime
- Fixed in
- 3.2.0
- What to do
- Update EventPrime to 3.2.0 or newer.
Oct 31, 2023Memberlite Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-5237 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Memberlite Shortcodes
- Fixed in
- 1.3.9
- What to do
- Update Memberlite Shortcodes to 1.3.9 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Oct 31, 2023E2Pdf: Does not sanitize and escape some of its settingsCVE-2023-5229 · WordPress plugins & themes · reported by WPScanMedium 4.8
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- E2Pdf
- Fixed in
- 1.20.20
- What to do
- Update E2Pdf to 1.20.20 or newer.
Oct 31, 2023Fattura24: Does not sanitize or escape the 'id' parameter before outputting it back in the pageCVE-2023-5211 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.
- Product
- Fattura24
- Fixed in
- 6.2.8
- What to do
- Update Fattura24 to 6.2.8 or newer.
Oct 31, 2023Popup box: Does not sanitize and escape some Popup fieldsCVE-2023-4390 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
- Product
- Popup box
- Fixed in
- 3.7.2
- What to do
- Update Popup box to 3.7.2 or newer.
Oct 31, 2023EventPrime: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-4250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- EventPrime
- Fixed in
- 3.2.0
- What to do
- Update EventPrime to 3.2.0 or newer.
Oct 16, 2023User Activity Log Pro: Does not properly escape recorded User-Agents in the user activity logs dashboardCVE-2023-5167 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks.
- Product
- User Activity Log Pro
- Fixed in
- 2.3.4
- What to do
- Update User Activity Log Pro to 2.3.4 or newer.
Oct 16, 2023ActivityPub: Does not escape user metadata before outputting them in mentionsCVE-2023-5057 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActivityPub WordPress plugin before 1.0.0 does not escape user metadata before outputting them in mentions, which could allow users with a role of Contributor and above to perform Stored XSS attacks
- Product
- ActivityPub
- Fixed in
- 1.0.0
- What to do
- Update ActivityPub to 1.0.0 or newer.
Oct 16, 2023Interactive Contact Form and Multi Step Form Builder: Does not sanitise and escape some parametersCVE-2023-4950 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks
- Product
- Interactive Contact Form and Multi Step Form Builder
- Fixed in
- 3.4
- What to do
- Update Interactive Contact Form and Multi Step Form Builder to 3.4 or newer.
Oct 16, 2023File Manager Pro: Does not adequately validate and escape some inputsCVE-2023-4862 · WordPress plugins & themes · reported by WPScanMedium 4.8
The File Manager Pro WordPress plugin before 1.8.1 does not adequately validate and escape some inputs, leading to XSS by high-privilege users.
- Product
- File Manager Pro
- Fixed in
- 1.8.1
- What to do
- Update File Manager Pro to 1.8.1 or newer.
Oct 16, 2023PowerPress Podcasting plugin by Blubrry: Does not sanitize and escape the media url field in postsCVE-2023-4820 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
- Product
- PowerPress Podcasting plugin by Blubrry
- Fixed in
- 11.0.12
- What to do
- Update PowerPress Podcasting plugin by Blubrry to 11.0.12 or newer.
Oct 16, 2023WordPress File Upload: Does not sanitise and escape some of its settingsCVE-2023-4811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
- Product
- WordPress File Upload
- Fixed in
- 4.23.3
- What to do
- Update WordPress File Upload to 4.23.3 or newer.
Oct 16, 2023Tutor LMS: Does not sanitise and escape some of its settingsCVE-2023-4805 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Tutor LMS
- Fixed in
- 2.3.0
- What to do
- Update Tutor LMS to 2.3.0 or newer.
Oct 16, 2023User Avatar: Does not properly sanitize and escape certain of its shortcodes attributesCVE-2023-4798 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.
- Product
- User Avatar
- Fixed in
- 1.2.2
- What to do
- Update User Avatar to 1.2.2 or newer.
Oct 16, 2023Testimonial Slider Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-4795 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Testimonial Slider Shortcode
- Fixed in
- 1.1.9
- What to do
- Update Testimonial Slider Shortcode to 1.1.9 or newer.
Oct 16, 2023Magee Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4783 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Magee Shortcodes
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Magee Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2023Simple Posts Ticker: Does not sanitise and escape some of its settingsCVE-2023-4725 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Posts Ticker
- Fixed in
- 1.1.6
- What to do
- Update Simple Posts Ticker to 1.1.6 or newer.
Oct 16, 2023WordPress Online Booking and Scheduling: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-4691 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WordPress Online Booking and Scheduling
- Fixed in
- 22.4
- What to do
- Update WordPress Online Booking and Scheduling to 22.4 or newer.
Oct 16, 2023Simple Posts Ticker: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4646 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Simple Posts Ticker
- Fixed in
- 1.1.6
- What to do
- Update Simple Posts Ticker to 1.1.6 or newer.
Oct 16, 2023EventON: Does not sanitise and escape some of its settingsCVE-2023-4388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- EventON
- Fixed in
- 2.2
- What to do
- Update EventON to 2.2 or newer.
Oct 16, 2023WP Matterport Shortcode: Does not escape the PHP_SELF server variableCVE-2023-4290 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.7
- What to do
- Update WP Matterport Shortcode to 2.1.7 or newer.
Oct 16, 2023WP Matterport Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4289 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.8
- What to do
- Update WP Matterport Shortcode to 2.1.8 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.