Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,831 results · page 34 of 37
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.CVE-2022-47591 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 27, 2023Custom Add User: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0043 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Custom Add User
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Custom Add User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Intuitive Custom Post Order: Lacks CSRF protection in its update-menu-order ajax actionCVE-2022-4386 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack
- Product
- Intuitive Custom Post Order
- Fixed in
- 3.1.4
- What to do
- Update Intuitive Custom Post Order to 3.1.4 or newer.
Feb 21, 2023Intuitive Custom Post Order: Does not check for authorization in the update-menu-order ajax actionCVE-2022-4385 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order
- Product
- Intuitive Custom Post Order
- Fixed in
- 3.1.4
- What to do
- Update Intuitive Custom Post Order to 3.1.4 or newer.
Feb 17, 2023WP Coder – add custom html, css and js code: Time-based SQL InjectionCVE-2023-0895 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WP Coder – add custom html, css and js code
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Coder – add custom html, css and js code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 13, 2023Customer Reviews for WooCommerce: Does not validate one of its shortcode attributeCVE-2023-0080 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
- Product
- Customer Reviews for WooCommerce
- Fixed in
- 5.16.0
- What to do
- Update Customer Reviews for WooCommerce to 5.16.0 or newer.
Feb 13, 2023WP Customer Area: Does not have CSRF checksCVE-2022-4745 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example.
- Product
- WP Customer Area
- Fixed in
- 8.1.4
- What to do
- Update WP Customer Area to 8.1.4 or newer.
Feb 9, 2023ImageMagick Engine: Deserialization of untrusted inputCVE-2022-3568 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- ImageMagick Engine
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update ImageMagick Engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2023Custom User Profile Fields for User Registration: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4831 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Custom User Profile Fields for User Registration
- Fixed in
- 1.8.1
- What to do
- Update Custom User Profile Fields for User Registration to 1.8.1 or newer.
Jan 30, 2023AAWP: Can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companiesCVE-2022-4794 · WordPress plugins & themes · reported by WPScanHigh 7.5
The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
- Product
- AAWP
- Fixed in
- 3.12.3
- What to do
- Update AAWP to 3.12.3 or newer.
Jan 30, 2023Justified Gallery: Does not validate and escape one of its shortcode attributesCVE-2022-4651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Justified Gallery
- Fixed in
- 1.7.1
- What to do
- Update Justified Gallery to 1.7.1 or newer.
Jan 23, 2023Login as User or Customer: Lacks authorization checks to ensure that users are allowed to log inCVE-2022-4305 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
- Product
- Login as User or Customer
- Fixed in
- 3.3
- What to do
- Update Login as User or Customer to 3.3 or newer.
Jan 18, 2023Custom 404 Pro: Cross-Site Request ForgeryCVE-2023-0385 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrect nonce validation on the custom_404_pro_admin_init function. This makes it possible for unauthenticated attackers to delete logs, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Custom 404 Pro
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Custom 404 Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 16, 2023Custom Post Types and Custom Fields creator: Does not sanitize and escape some of its settingsCVE-2022-4442 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Custom Post Types and Custom Fields creator
- Fixed in
- 2.3.3
- What to do
- Update Custom Post Types and Custom Fields creator to 2.3.3 or newer.
Jan 9, 2023WP Custom Admin Interface: Unserialize user input provided via the settingsCVE-2022-4043 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- WP Custom Admin Interface
- Fixed in
- 7.29
- What to do
- Update WP Custom Admin Interface to 7.29 or newer.
Jan 2, 2023Custom Field Template: Unserialises the content of an imported fileCVE-2022-4324 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.
- Product
- Custom Field Template
- Fixed in
- 2.5.8
- What to do
- Update Custom Field Template to 2.5.8 or newer.
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4165 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4150 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 6, 2022External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product CVE-2022-43468 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input.
- Affected
- up to 6.0.5
- What to do
- Affects up to 6.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2022Becustom: Cross-Site Request ForgeryCVE-2022-3747 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update the plugin's settings like betheme_url_slug, replaced_theme_author, and betheme_label to name a few, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Becustom
- Affected
- up to 1.0.5.2
- What to do
- Affects up to 1.0.5.2. Update Becustom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.commuffingroup.com
Nov 28, 2022WP Admin UI Customize: Does not sanitise and escape some of its settingsCVE-2022-3824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Admin UI Customize
- Fixed in
- 1.5.13
- What to do
- Update WP Admin UI Customize to 1.5.13 or newer.
Nov 28, 2022Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list: Does not validate dataCVE-2022-3603 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.
- Product
- Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list
- Fixed in
- 2.0.69
- What to do
- Update Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list to 2.0.69 or newer.
Nov 7, 2022Import and export users and customers: Does not properly escape dataCVE-2022-3558 · WordPress plugins & themes · reported by WPScanHigh 8
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
- Product
- Import and export users and customers
- Fixed in
- 1.20.5
- What to do
- Update Import and export users and customers to 1.20.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 31, 2022Customizer Export/Import: Unserializes the content of an imported fileCVE-2022-3380 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Customizer Export/Import
- Fixed in
- 0.9.5
- What to do
- Update Customizer Export/Import to 0.9.5 or newer.
Oct 17, 2022WP Custom Cursors: Does not have CSRF check in placeCVE-2022-3151 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when deleting cursors, which could allow attackers to made a logged in admin delete arbitrary cursors via a CSRF attack.
- Product
- WP Custom Cursors
- Fixed in
- 3.0.1
- What to do
- Update WP Custom Cursors to 3.0.1 or newer.
Oct 17, 2022WP Custom Cursors: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3150 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users such as admin
- Product
- WP Custom Cursors
- Fixed in
- 3.2
- What to do
- Update WP Custom Cursors to 3.2 or newer.
Oct 17, 2022WP Custom Cursors: Does not have CSRF check in placeCVE-2022-3149 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping in some of the cursor options, it could also lead to Stored Cross-Site Scripting
- Product
- WP Custom Cursors
- Fixed in
- 3.0.1
- What to do
- Update WP Custom Cursors to 3.0.1 or newer.
Sep 23, 2022Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPressCVE-2022-40194 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.CVE-2022-38470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.CVE-2022-38134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 21, 2022Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.CVE-2022-38073 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.
- Affected
- up to 6.0.7
- What to do
- Affects up to 6.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 6, 2022Migration, Backup, Staging – WPvivid: Deserialization of untrusted inputCVE-2022-2442 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Migration, Backup, Staging – WPvivid
- Affected
- up to 0.9.74
- What to do
- Affects up to 0.9.74. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2022Broken Link Checker: Deserialization of untrusted inputCVE-2022-2438 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Broken Link Checker
- Affected
- up to 1.11.16
- What to do
- Affects up to 1.11.16. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2022Download Manager: Deserialization of untrusted inputCVE-2022-2436 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and including 3.2.49. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Download Manager
- Affected
- up to 3.2.49
- What to do
- Affects up to 3.2.49. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2022String Locator: Deserialization of untrusted inputCVE-2022-2434 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- String Locator
- Affected
- up to 2.5.0
- What to do
- Affects up to 2.5.0. Update String Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 6, 2022WordPress Infinite Scroll – Ajax Load More: Deserialization of untrusted inputCVE-2022-2433 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- WordPress Infinite Scroll – Ajax Load More
- Affected
- up to 5.5.3
- What to do
- Affects up to 5.5.3. Update WordPress Infinite Scroll – Ajax Load More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
- Product
- Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro
- Fixed in
- 5.12.3
- What to do
- Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.
Aug 15, 2022The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unaCVE-2022-2180 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE).
- Fixed in
- 1.2.7
- What to do
- Update the plugin to 1.2.7 or newer.
Jul 21, 2022Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-31475 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
- Affected
- up to 2.20.2
- What to do
- Affects up to 2.20.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 18, 2022Visualizer: Tables and Charts Manager for: Deserialization of untrusted inputCVE-2022-2444 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Visualizer: Tables and Charts Manager for
- Affected
- up to 3.7.9
- What to do
- Affects up to 3.7.9. Update Visualizer: Tables and Charts Manager for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 18, 2022Feed Them Social – for Twitter feed, Youtube and more: Deserialization of untrusted inputCVE-2022-2437 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
- Product
- Feed Them Social – for Twitter feed, Youtube and more
- Affected
- up to 2.9.8.5
- What to do
- Affects up to 2.9.8.5. Update Feed Them Social – for Twitter feed, Youtube and more to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 6, 2022custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.CVE-2015-3173 · WordPress plugins & themes · reported by Red HatHigh 7.2
custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.
- Fixed in
- 0.9.8.6
- What to do
- Update the plugin to 0.9.8.6 or newer.
Full record and what to do →NVD recordblog.nettitude.comgithub.com
Jun 27, 2022Form - Contact Form: Does not sanitize and escape Custom text fieldsCVE-2022-1326 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Form - Contact Form
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Form - Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022underConstruction: Does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting itCVE-2022-1896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.
- Product
- underConstruction
- Fixed in
- 1.21
- What to do
- Update underConstruction to 1.21 or newer.
Jun 20, 2022Custom Share Buttons with Floating Sidebar: Does not sanitise and escape some of its settingsCVE-2022-1717 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Custom Share Buttons with Floating Sidebar
- Fixed in
- 4.2
- What to do
- Update Custom Share Buttons with Floating Sidebar to 4.2 or newer.
Jun 20, 2022Print, PDF, Email by PrintFriendly: Does not sanitise and escape the Custom Button Text settingsCVE-2022-0663 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Print, PDF, Email by PrintFriendly
- Fixed in
- 5.2.3
- What to do
- Update Print, PDF, Email by PrintFriendly to 5.2.3 or newer.
Jun 13, 2022Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrCVE-2022-1654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions
- Affected
- up to 6.10.1
- What to do
- Affects up to 6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022HC Custom WP-Admin URL: Leaks the secret login URLCVE-2022-1595 · WordPress plugins & themes · reported by WPScanMedium 5.3
The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
- Product
- HC Custom WP-Admin URL
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HC Custom WP-Admin URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022HC Custom WP-Admin URL: Does not have CSRF check in placeCVE-2022-1594 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, allowing them to change the login URL
- Product
- HC Custom WP-Admin URL
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HC Custom WP-Admin URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022WP SVG Icons: Does not properly validate uploaded custom icon packsCVE-2022-0863 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
- Product
- WP SVG Icons
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update WP SVG Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.