Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,184 results · page 39 of 64
Apr 24, 2023Easy Forms for Mailchimp: Does not sanitise and escape some parameters before outputting them back in the responseCVE-2023-1324 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.8 does not sanitise and escape some parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.8
- What to do
- Update Easy Forms for Mailchimp to 6.8.8 or newer.
Apr 24, 2023WP FEvents Book: Does not sanitise and escape some parametersCVE-2023-1126 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP FEvents Book WordPress plugin through 0.46 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Cross-Site Scripting attacks
- Product
- WP FEvents Book
- Affected
- up to 0.46
- What to do
- Affects up to 0.46. Update WP FEvents Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Steveas WP Live Chat Shoutbox
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Steveas WP Live Chat Shoutbox: Does not sanitise and escape a parameter before outputting it back in the ShoutboxCVE-2023-0899 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins.
- Product
- Steveas WP Live Chat Shoutbox
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Steveas WP Live Chat Shoutbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023MS-Reviews: Does not sanitise and escape reviewsCVE-2023-0424 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks
- Product
- MS-Reviews
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update MS-Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Video Central for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0418 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video Central for
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Video Central for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Random Text: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2023-0388 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers.
- Product
- Random Text
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update Random Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Weaver Xtreme Theme Support: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0276 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Weaver Xtreme Theme Support
- Fixed in
- 6.2.7
- What to do
- Update Weaver Xtreme Theme Support to 6.2.7 or newer.
Apr 17, 2023The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2023-1473 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 3.29.1
- What to do
- Update the plugin to 3.29.1 or newer.
Apr 17, 2023WP VR: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-1413 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP VR
- Fixed in
- 8.2.9
- What to do
- Update WP VR to 8.2.9 or newer.
Apr 17, 2023W4 Post List: Does not escape some URLs before outputting them in attributesCVE-2023-1373 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W4 Post List WordPress plugin before 2.4.6 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
- Product
- W4 Post List
- Fixed in
- 2.4.6
- What to do
- Update W4 Post List to 2.4.6 or newer.
Apr 17, 2023Easy Forms for Mailchimp: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1325 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.7
- What to do
- Update Easy Forms for Mailchimp to 6.8.7 or newer.
Apr 17, 2023Gallery by BestWebSoft: Does not properly escape values used in SQL queriesCVE-2023-0765 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable.
- Product
- Gallery by BestWebSoft
- Fixed in
- 4.7.0
- What to do
- Update Gallery by BestWebSoft to 4.7.0 or newer.
Apr 17, 2023W4 Post List: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0374 · WordPress plugins & themes · reported by WPScanMedium 5.4
The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- W4 Post List
- Fixed in
- 2.4.6
- What to do
- Update W4 Post List to 2.4.6 or newer.
Apr 17, 2023Pricing Tables For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0367 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
- Fixed in
- 3.0
- What to do
- Update Pricing Tables For WPBakery Page Builder (formerly Visual Composer) to 3.0 or newer.
Apr 17, 2023WC Fields Factory: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0277 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WC Fields Factory WordPress plugin through 4.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WC Fields Factory
- Affected
- up to 4.1.5
- What to do
- Affects up to 4.1.5. Update WC Fields Factory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Apr 10, 2023WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Fixed in
- 2.7.9.4
- What to do
- Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to 2.7.9.4 or newer.
Apr 10, 2023Simple Giveaways: Does not sanitise and escape some of its Giveaways optionsCVE-2023-1122 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Giveaways
- Fixed in
- 2.45.1
- What to do
- Update Simple Giveaways to 2.45.1 or newer.
Apr 10, 2023Simple Giveaways: Does not sanitise and escape some of its settingsCVE-2023-1121 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Giveaways
- Fixed in
- 2.45.1
- What to do
- Update Simple Giveaways to 2.45.1 or newer.
Apr 10, 2023Simple Giveaways: Does not sanitise and escape some of its settingsCVE-2023-1120 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Giveaways
- Fixed in
- 2.45.1
- What to do
- Update Simple Giveaways to 2.45.1 or newer.
Apr 10, 2023stylish-cost-calculator-premium: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0983 · WordPress plugins & themes · reported by WPScanMedium 6.1
The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form.
- Product
- stylish-cost-calculator-premium
- Fixed in
- 7.9.0
- What to do
- Update stylish-cost-calculator-premium to 7.9.0 or newer.
Apr 10, 2023Time Sheets: Does not sanitise and escape some of its settingsCVE-2023-0893 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Time Sheets
- Fixed in
- 1.29.3
- What to do
- Update Time Sheets to 1.29.3 or newer.
Apr 10, 2023Klaviyo: Does not sanitize and escape some of its settingsCVE-2023-0874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Klaviyo
- Fixed in
- 3.0.10
- What to do
- Update Klaviyo to 3.0.10 or newer.
Apr 10, 2023Auto Rename Media On Upload: Does not sanitise and escape some of its settingsCVE-2023-0605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Auto Rename Media On Upload
- Fixed in
- 1.1.0
- What to do
- Update Auto Rename Media On Upload to 1.1.0 or newer.
Apr 10, 2023Contact Form: Does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field typeCVE-2023-0546 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.
- Product
- Contact Form
- Fixed in
- 4.3.25
- What to do
- Update Contact Form to 4.3.25 or newer.
Apr 10, 2023WordPress Amazon S3: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0423 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WordPress Amazon S3
- Fixed in
- 1.6
- What to do
- Update WordPress Amazon S3 to 1.6 or newer.
Apr 10, 2023Scheduled Announcements Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0363 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Scheduled Announcements Widget
- Fixed in
- 1.0
- What to do
- Update Scheduled Announcements Widget to 1.0 or newer.
Apr 10, 2023All-In-One Security (AIOS): Does not escape the content of log files before outputting it to the plugin admin pageCVE-2023-0157 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.5
- What to do
- Update All-In-One Security (AIOS) to 5.1.5 or newer.
Apr 10, 2023WP Tiles: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4827 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Tiles WordPress plugin through 1.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Tiles
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Tiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2023Solidres: Does not sanitise and escape numerous parameter before outputting them back in pagesCVE-2023-1377 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Solidres
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2023User Role by BestWebSoft: Does not protect against CSRF in requests to update role capabilitiesCVE-2023-0820 · WordPress plugins & themes · reported by WPScanHigh 8.8
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
- Product
- User Role by BestWebSoft
- Fixed in
- 1.6.7
- What to do
- Update User Role by BestWebSoft to 1.6.7 or newer.
Apr 3, 2023Image Over Image For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0399 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Image Over Image For WPBakery Page Builder
- Fixed in
- 3.0
- What to do
- Update Image Over Image For WPBakery Page Builder to 3.0 or newer.
Mar 27, 2023Modern Events Calendar Lite: Does not sanitise and escape some of its settingsCVE-2023-1400 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.5.2
- What to do
- Update Modern Events Calendar Lite to 6.5.2 or newer.
Mar 27, 2023Complianz WordPress plugin before 6.4.2, Complianz Premium: Do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1069 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Complianz WordPress plugin before 6.4.2, Complianz Premium
- Fixed in
- 6.4.2
- What to do
- Update Complianz WordPress plugin before 6.4.2, Complianz Premium to 6.4.2 or newer.
Mar 27, 2023Simple File List: Does not sanitise and escape some of its settingsCVE-2023-1025 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple File List
- Fixed in
- 6.0.10
- What to do
- Update Simple File List to 6.0.10 or newer.
Mar 27, 2023WP Statistics: Does not escape a parameterCVE-2023-0955 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
- Product
- WP Statistics
- Fixed in
- 14.0
- What to do
- Update WP Statistics to 14.0 or newer.
Mar 27, 2023Cookie Notice & Compliance for GDPR / CCPA: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0823 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Cookie Notice & Compliance for GDPR / CCPA
- Fixed in
- 2.4.7
- What to do
- Update Cookie Notice & Compliance for GDPR / CCPA to 2.4.7 or newer.
Mar 27, 2023Smart Slider 3: Does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0660 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Smart Slider 3
- Fixed in
- 3.5.1.14
- What to do
- Update Smart Slider 3 to 3.5.1.14 or newer.
Mar 27, 2023WP Image Carousel: Does not sanitise and escape some parametersCVE-2023-0589 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- WP Image Carousel
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Image Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023Schedulicity: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0491 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Schedulicity
- Affected
- up to 2.21
- What to do
- Affects up to 2.21. Update Schedulicity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023menu shortcode: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0395 · WordPress plugins & themes · reported by WPScanMedium 5.4
The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- menu shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update menu shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023NEX-Forms: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0272 · WordPress plugins & themes · reported by WPScanMedium 5.4
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- NEX-Forms
- Fixed in
- 8.3.3
- What to do
- Update NEX-Forms to 8.3.3 or newer.
Mar 20, 2023VK All in One Expansion Unit: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2023-0937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- VK All in One Expansion Unit
- Fixed in
- 9.87.1.0
- What to do
- Update VK All in One Expansion Unit to 9.87.1.0 or newer.
Mar 20, 2023WP Meta SEO: Does not properly sanitize and escape inputs into SQL queriesCVE-2023-0875 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.
- Product
- WP Meta SEO
- Fixed in
- 4.5.3
- What to do
- Update WP Meta SEO to 4.5.3 or newer.
Mar 20, 2023WPB Advanced FAQ: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0370 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WPB Advanced FAQ
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WPB Advanced FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023GoToWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0369 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GoToWP
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update GoToWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023React Webcam: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0365 · WordPress plugins & themes · reported by WPScanMedium 5.4
The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- React Webcam
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update React Webcam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023real.Kit: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- real.Kit
- Fixed in
- 5.1.1
- What to do
- Update real.Kit to 5.1.1 or newer.
Mar 20, 2023Custom Content Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Custom Content Shortcode
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023Responsive Clients Logo Gallery Plugin for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0175 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Clients Logo Gallery Plugin for
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Responsive Clients Logo Gallery Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.