Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,187 results · page 45 of 64
Jan 16, 2023Page scroll to id: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4449 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Page scroll to id
- Fixed in
- 1.7.6
- What to do
- Update Page scroll to id to 1.7.6 or newer.
Jan 16, 2023Fontsy: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4447 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Fontsy
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update Fontsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Custom Post Types and Custom Fields creator: Does not sanitize and escape some of its settingsCVE-2022-4442 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Custom Post Types and Custom Fields creator
- Fixed in
- 2.3.3
- What to do
- Update Custom Post Types and Custom Fields creator to 2.3.3 or newer.
Jan 16, 2023WOOCS: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4431 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WOOCS
- Fixed in
- 1.3.9.4
- What to do
- Update WOOCS to 1.3.9.4 or newer.
Jan 16, 2023WP Attachments: Does not sanitise and escape some of its settingsCVE-2022-4330 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Attachments
- Fixed in
- 5.0.6
- What to do
- Update WP Attachments to 5.0.6 or newer.
Jan 16, 2023WordPress Events Calendar: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin).
- Product
- WordPress Events Calendar
- Fixed in
- 1.4.5
- What to do
- Update WordPress Events Calendar to 1.4.5 or newer.
Jan 16, 2023Metricool: Does not sanitise and escape some of its settingsCVE-2022-4299 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Metricool
- Fixed in
- 1.18
- What to do
- Update Metricool to 1.18 or newer.
Jan 16, 2023Show All Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4295 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
- Product
- Show All Comments
- Fixed in
- 7.0.1
- What to do
- Update Show All Comments to 7.0.1 or newer.
Jan 16, 2023Link Library: Does not sanitise and escape some of its settingsCVE-2022-4199 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Link Library
- Fixed in
- 7.4.1
- What to do
- Update Link Library to 7.4.1 or newer.
Jan 16, 2023MonsterInsights: Does not sanitize or escape page titles in the top posts/pages sectionCVE-2022-3904 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
- Product
- MonsterInsights
- Fixed in
- 8.9.1
- What to do
- Update MonsterInsights to 8.9.1 or newer.
Jan 16, 2023WP Spell Check: Does not escape ignored wordsCVE-2022-2658 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Spell Check
- Fixed in
- 9.13
- What to do
- Update WP Spell Check to 9.13 or newer.
Jan 9, 2023Jetpack CRM: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4497 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins
- Product
- Jetpack CRM
- Fixed in
- 5.5
- What to do
- Update Jetpack CRM to 5.5 or newer.
Jan 9, 2023WP-Table Reloaded: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4491 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.
- Product
- WP-Table Reloaded
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update WP-Table Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Table of Contents Plus: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4479 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Table of Contents Plus
- Fixed in
- 2212
- What to do
- Update Table of Contents Plus to 2212 or newer.
Jan 9, 2023WP Recipe Maker: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4468 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- WP Recipe Maker
- Fixed in
- 8.6.1
- What to do
- Update WP Recipe Maker to 8.6.1 or newer.
Jan 9, 2023iPages Flipbook For: Does not sanitise and escape some of its settingsCVE-2022-4394 · WordPress plugins & themes · reported by WPScanMedium 5.4
The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- iPages Flipbook For
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update iPages Flipbook For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023ImageLinks Interactive Image Builder for: Does not sanitise and escape some of its settingsCVE-2022-4393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- ImageLinks Interactive Image Builder for
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update ImageLinks Interactive Image Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contriCVE-2022-4392 · WordPress plugins & themes · reported by WPScanMedium 5.4
The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- iPanorama 360 WordPress Virtual Tour Builder
- Affected
- up to 1.6.29
- What to do
- Affects up to 1.6.29. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Vision Interactive For: Does not sanitise and escape some of its settingsCVE-2022-4391 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Vision Interactive For
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Vision Interactive For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Bg Bible References: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2022-4374 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- Bg Bible References
- Affected
- up to 3.8.14
- What to do
- Affects up to 3.8.14. Update Bg Bible References to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023WP CSV: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2022-4368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot have CSRF checks in place as well, leading to a Reflected Cross-Site Scripting.
- Product
- WP CSV
- Affected
- up to 1.8.0.0
- What to do
- Affects up to 1.8.0.0. Update WP CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Post Status Notifier Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin.
- Product
- Post Status Notifier Lite
- Fixed in
- 1.10.1
- What to do
- Update Post Status Notifier Lite to 1.10.1 or newer.
Jan 9, 2023Slimstat Analytics: Does not sanitise and escape the URICVE-2022-4310 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logs
- Product
- Slimstat Analytics
- Fixed in
- 4.9.3
- What to do
- Update Slimstat Analytics to 4.9.3 or newer.
Jan 9, 2023Sunshine Photo Cart: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4301 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- Sunshine Photo Cart
- Fixed in
- 2.9.15
- What to do
- Update Sunshine Photo Cart to 2.9.15 or newer.
Jan 9, 2023Multi Step Form: Does not sanitise and escape some of its form fieldsCVE-2022-4196 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Multi Step Form
- Fixed in
- 1.7.8
- What to do
- Update Multi Step Form to 1.7.8 or newer.
Jan 9, 2023404 to Start: Does not sanitise and escape some of its settingsCVE-2022-3855 · WordPress plugins & themes · reported by WPScanMedium 4.8
The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- 404 to Start
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update 404 to Start to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Popup Maker: Does not validate and escape one of its shortcode attributesCVE-2022-4381 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Popup Maker
- Fixed in
- 1.16.9
- What to do
- Update Popup Maker to 1.16.9 or newer.
Jan 2, 2023Quote-O-Matic: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4373 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- Quote-O-Matic
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Quote-O-Matic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4371 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023multimedial images: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4370 · WordPress plugins & themes · reported by WPScanHigh 7.2
The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- multimedial images
- Affected
- up to 1.0b
- What to do
- Affects up to 1.0b. Update multimedial images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP-Lister Lite for Amazon: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4369 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin.
- Product
- WP-Lister Lite for Amazon
- Fixed in
- 2.4.4
- What to do
- Update WP-Lister Lite for Amazon to 2.4.4 or newer.
Jan 2, 2023Popup Maker: Does not validate and escape one of its shortcode attributesCVE-2022-4362 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Popup Maker
- Fixed in
- 1.16.9
- What to do
- Update Popup Maker to 1.16.9 or newer.
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4360 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4359 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4358 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4357 · WordPress plugins & themes · reported by WPScanCritical 9.8
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4356 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4355 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4351 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Product list Widget for Woocommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4329 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).
- Product
- Product list Widget for Woocommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Product list Widget for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023WP AutoComplete Search: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated usersCVE-2022-4297 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- WP AutoComplete Search
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP AutoComplete Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jan 2, 2023WP-Ban: Does not sanitise and escape some of its settingsCVE-2022-4260 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP-Ban
- Fixed in
- 1.69.1
- What to do
- Update WP-Ban to 1.69.1 or newer.
Jan 2, 2023All-in-One Addons for Elementor: Does not sanitise and escape some of its settingsCVE-2022-4256 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- All-in-One Addons for Elementor
- Fixed in
- 2.4.4
- What to do
- Update All-in-One Addons for Elementor to 2.4.4 or newer.
Jan 2, 2023Login with Cognito: Does not sanitise and escape some of its settingsCVE-2022-4200 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login with Cognito
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Login with Cognito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023WP Social Sharing: Does not sanitise and escape some of its settingsCVE-2022-4198 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Social Sharing
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WP Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurity.gentoo.orgwpscan.com
Jan 2, 2023WordPress Filter Gallery: Does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the pageCVE-2022-4142 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled.
- Product
- WordPress Filter Gallery
- Fixed in
- 0.1.6
- What to do
- Update WordPress Filter Gallery to 0.1.6 or newer.
Jan 2, 2023Image Optimizer, Resizer and CDN: Does not sanitise and escape some of its settingsCVE-2022-4119 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Optimizer, Resizer and CDN
- Fixed in
- 6.8.1
- What to do
- Update Image Optimizer, Resizer and CDN to 6.8.1 or newer.
Jan 2, 2023The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site ScripCVE-2022-4114 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks.
- Fixed in
- 1.2.33
- What to do
- Update the plugin to 1.2.33 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.