Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

2,399 results · page 38 of 48

Jun 27, 2023Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite: Cross-Site Request ForgeryCVE-2023-3411 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajax_store_save() function. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 22, 2023Flask-AppBuilder is an application development framework, built on top of Flask.CVE-2023-34110 · Other software · dpgaspar · reported by GitHubLow 2.7
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.
Product
Flask-AppBuilder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions.CVE-2023-23795 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions.
Affected
up to 1.9.9.0
What to do
Affects up to 1.9.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2023Responsive Tabs For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0368 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.1
What to do
Affects up to 1.1. Update Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2023The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordCVE-2023-2362 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPress plugin before 5.2.2, Popup Box WordPress plugin before 2.2.2, Side Menu Lite WordPress plugin before 4.0.2, Sticky Buttons WordPress plugin before 3.1.1, Wow Skype Buttons WordPress plugin before 4.0.2, WP Coder WordPress plugin before 2.5.6 do not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Fixed in
5.0.2
What to do
Update the plugin to 5.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 9, 2023Brizy Page Builder: IP Address SpoofingCVE-2023-2897 · WordPress plugins & themes · reported by WordfenceLow 3.7
The Brizy Page Builder plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.4.18. This is due to an implicit trust of user-supplied IP addresses in an 'X-Forwarded-For' HTTP header for the purpose of validating allowed IP addresses against a Maintenance Mode whitelist. Supplying a whitelisted IP address within the 'X-Forwarded-For' header allows maintenance mode to be bypassed and may result in the disclosure of potentially sensitive information or allow access to restricted functionality.
Product
Brizy Page Builder
Affected
up to 2.4.18
What to do
Affects up to 2.4.18. Update Brizy Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Metform Elementor Contact Form Builder: Unauthorized permalink structure updateCVE-2023-1843 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing capability check on the permalink_setup function in versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to change the permalink structure.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: CSV injectionCVE-2023-0721 · WordPress plugins & themes · reported by WordfenceHigh 8.3
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to CSV injection in versions up to, and including, 3.3.0. This allows unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissionsCVE-2023-0710 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database. Additionally this requires successful payment, increasing the complexity.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissionsCVE-2023-0709 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissionsCVE-2023-0708 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissionsCVE-2023-0695 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a specific link. Note that getting the JavaScript to execute still requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0694 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0693 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0692 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_status' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the payment status of arbitrary form submissions.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0691 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, specifically the submitter's last name.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Information DisclosureCVE-2023-0688 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_thankyou' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about form submissions, including payment status, and transaction ID.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 6, 2023Flo Forms – Easy Drag & Drop Form Builder: Stored Cross-Site ScriptingCVE-2021-4367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using the flo_import_forms_options AJAX action in versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping along with missing capability checks. This makes it possible for authenticated attackers, like subscribers, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flo Forms – Easy Drag & Drop Form Builder
Affected
up to 1.0.35
What to do
Affects up to 1.0.35. Update Flo Forms – Easy Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023Page Builder: KingComposer: Stored Cross-Site ScriptingCVE-2020-36709 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Page Builder: KingComposer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via via shortcode in versions before 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder: KingComposer
Fixed in
2.9.4
What to do
Update Page Builder: KingComposer to 2.9.4 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpsocket.com
Jun 6, 2023Elementor Website Builder: Stored Cross-Site ScriptingCVE-2020-36703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and including 2.9.7 This makes it possible for authenticated attackers with the upload_files capability to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the stored web scripts.
Product
Elementor Website Builder
Affected
up to 2.9.7
What to do
Affects up to 2.9.7. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Page Builder: KingComposer: Arbitrary File UploadsCVE-2020-36701 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'process_bulk_action' function in the 'kingcomposer/includes/kc.extensions.php' file. This makes it possible for authenticated users with author level permissions and above to upload arbitrary files onto the server which can be used to execute code on the server.
Product
Page Builder: KingComposer
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Page Builder: KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Page Builder: KingComposer: Authorization bypassCVE-2020-36700 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress options, delete arbitrary files/folders, and inject arbitrary content.
Product
Page Builder: KingComposer
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Page Builder: KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Funnel Builder: Authorization bypassCVE-2019-25151 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service.
Product
Funnel Builder
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Funnel Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php.CVE-2023-29632 · Other software · Joommasters · reported by MITRECritical 9.8
PrestaShop jmspagebuilder 3.x is vulnerable to SQL Injection via ajax_jmspagebuilder.php.
Product
Jmspagebuilder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record friends-of-presta.github.io friends-of-presta.github.io
Jun 5, 2023Pricing Table Builder: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0900 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.
Product
Pricing Table Builder
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update Pricing Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 3, 2023Contact Form Builder by vcita: Cross-Site Request ForgeryCVE-2023-2301 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.3. This is due to missing nonce validation on the ls_parse_vcita_callback function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. While the Cross-Site Scripting issue was patched in version 4.10.1, the plugin is still technically vulnerable to Cross-Site Request Forgery since a capability check but no nonce check was added in 4.10.2.
Product
Contact Form Builder by vcita
Affected
up to 4.10.3
What to do
Affects up to 4.10.3. Update Contact Form Builder by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 3, 2023Contact Form Builder by vcita: Stored Cross-Site ScriptingCVE-2023-2300 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact Form Builder by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with the edit_posts capability, such as contributors and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact Form Builder by vcita
Affected
up to 4.9.1
What to do
Affects up to 4.9.1. Update Contact Form Builder by vcita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.jonh.eu plugins.trac.wordpress.org
Jun 2, 2023Page Builder by AZEXO: Cross-Site Request ForgeryCVE-2023-3055 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_save' function. This makes it possible for unauthenticated attackers to update the post content and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Page Builder by AZEXO
Affected
up to 1.27.133
What to do
Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 2, 2023Page Builder by AZEXO: Unauthorized modification of dataCVE-2023-3053 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to, and including, 1.27.133. This makes it possible for authenticated attackers to create a post with any post type and post status.
Product
Page Builder by AZEXO
Affected
up to 1.27.133
What to do
Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2023Page Builder by AZEXO: Cross-Site Request ForgeryCVE-2023-3052 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.27.133. This is due to missing or incorrect nonce validation on the 'azh_add_post', 'azh_duplicate_post', 'azh_update_post' and 'azh_remove_post' functions. This makes it possible for unauthenticated attackers to create, modify, and delete a post via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Page Builder by AZEXO
Affected
up to 1.27.133
What to do
Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 2, 2023Page Builder by AZEXO: Stored Cross-Site ScriptingCVE-2023-3051 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Page Builder by AZEXO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'azh_post' shortcode in versions up to, and including, 1.27.133 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder by AZEXO
Affected
up to 1.27.133
What to do
Affects up to 1.27.133. Update Page Builder by AZEXO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 30, 2023Login rebuilder: Does not sanitise and escape some of its settingsCVE-2023-2223 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Login rebuilder
Fixed in
2.8.1
What to do
Update Login rebuilder to 2.8.1 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 30, 2023Elementor Website Builder: Does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statementCVE-2023-0329 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
Product
Elementor Website Builder
Fixed in
3.12.2
What to do
Update Elementor Website Builder to 3.12.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions.CVE-2023-33212 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions.
Fixed in
3.0.7
What to do
Update the plugin to 3.0.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.CVE-2022-38356 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.
Affected
up to 1.3.4
What to do
Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 24, 2023Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 beforCVE-2023-33938 · Other software · Liferay · reported by security@liferay.comMedium 4.8
Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.
Product
Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record liferay.dev liferay.dev
May 10, 2023Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may allow an authenticated user to potentiallCVE-2022-43474 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may allow an authenticated user to potentially enable escalation of privilege via local access.
Product
DSP Builder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
May 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.CVE-2022-45846 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.
Fixed in
5.6.9
What to do
Update the plugin to 5.6.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2023Mega Addons For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0268 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Mega Addons For WPBakery Page Builder
Fixed in
4.3.0
What to do
Update Mega Addons For WPBakery Page Builder to 4.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Ultimate Carousel For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0267 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Ultimate Carousel For WPBakery Page Builder
Affected
up to 2.6
What to do
Affects up to 2.6. Update Ultimate Carousel For WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2023Profile Builder – User Profile & User Registration Forms: Unauthorized password resetsCVE-2023-2297 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
Product
Profile Builder – User Profile & User Registration Forms
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Apr 26, 2023Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.CVE-2023-2307 · Other software · builderio · reported by security@huntr.devMedium 4.7
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
Product
builderio/qwik
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Apr 18, 2023 A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted filCVE-2022-34755 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.3
A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a valid user. Affected Products: Easergy Builder Installer (1.7.23 and prior)
Product
Easergy Builder Installer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Apr 17, 2023Pricing Tables For WPBakery Page Builder (formerly Visual Composer): Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2023-1274 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
Product
Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
Fixed in
3.0
What to do
Update Pricing Tables For WPBakery Page Builder (formerly Visual Composer) to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023Pricing Tables For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0367 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
Fixed in
3.0
What to do
Update Pricing Tables For WPBakery Page Builder (formerly Visual Composer) to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2023Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for CVE-2023-30531 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasing the potential for attackers to observe and capture it.
Product
Jenkins Consul KV Builder Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Apr 12, 2023Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controllerCVE-2023-30530 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Product
Jenkins Consul KV Builder Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Apr 12, 2023A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corresCVE-2023-30521 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
Product
Jenkins Assembla merge request builder Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Apr 10, 2023Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials.CVE-2023-29005 · Other software · dpgaspar · reported by GitHubHigh 7.5
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
Product
Flask-AppBuilder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record flask-limiter.readthedocs.io github.com
Apr 3, 2023Image Over Image For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0399 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Image Over Image For WPBakery Page Builder
Fixed in
3.0
What to do
Update Image Over Image For WPBakery Page Builder to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.