Vulnerability database

4,892 results · page 45 of 98

• Sep 6, 2022The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0.CVE-2022-2941 · WordPress plugins & themes · reported by WordfenceMedium 5.5

  The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Affected

  up to 2.88.0

  What to do

  Affects up to 2.88.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.compacketstormsecurity.com

• Sep 6, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 at WordPress.CVE-2021-36829 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0.11 at WordPress.

  Affected

  up to 1.0.11

  What to do

  Affects up to 1.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Sep 5, 2022The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticatedCVE-2022-2376 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users

  Product

  Directorist

  Fixed in

  7.3.1

  What to do

  Update Directorist to 7.3.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Sep 1, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress.CVE-2022-36373 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress.

  Affected

  up to 2.7.3

  What to do

  Affects up to 2.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Sep 1, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Easy Org Chart plugin <= 3.1 at WordPress.CVE-2022-36355 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Easy Org Chart plugin <= 3.1 at WordPress.

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 25, 2022SEO Scout plugin <= 0.9.83 at: Cross-Site Request Forgery (CSRF)CVE-2022-36358 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in SEO Scout plugin <= 0.9.83 at WordPress allows attackers to trick users with administrative rights to unintentionally change the plugin settings.

  Product

  SEO Scout plugin <= 0.9.83 at

  Affected

  up to 0.9.83

  What to do

  Affects up to 0.9.83. Update SEO Scout plugin <= 0.9.83 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin <= 1.4 at WordPress.CVE-2022-36405 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin <= 1.4 at WordPress.

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress.CVE-2022-36394 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress.

  Affected

  up to 17.0.4

  What to do

  Affects up to 17.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress.CVE-2022-36389 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress.

  Affected

  up to 1.9.9.148

  What to do

  Affects up to 1.9.9.148. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.CVE-2022-36379 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress.CVE-2022-36347 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alpine Press Alpine PhotoTile for Pinterest plugin <= 1.3.1 at WordPress.

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pinterest Pinboard PagCVE-2022-36341 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authenticated (subscriber+) plugin settings change leading to Stored Cross-Site Scripting (XSS) vulnerability in Akash soni's AS – Create Pinterest Pinboard Pages plugin <= 1.0 at WordPress.

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress.CVE-2022-36292 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress.

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.CVE-2022-36288 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

  Affected

  up to 3.2.48

  What to do

  Affects up to 3.2.48. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.CVE-2022-36285 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Authenticated Arbitrary File Upload vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.CVE-2022-36282 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.CVE-2022-35726 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.

  Affected

  up to 1.3.4.5

  What to do

  Affects up to 1.3.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.CVE-2022-35242 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.

  Affected

  up to 3.4.1

  What to do

  Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.CVE-2022-35235 · WordPress plugins & themes · reported by PatchstackMedium 4.9

  Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.

  Affected

  up to 2.6

  What to do

  Affects up to 2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.CVE-2022-34868 · WordPress plugins & themes · reported by PatchstackHigh 8.8

  Authenticated Arbitrary Settings Update vulnerability in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.

  Affected

  up to 2.3.0

  What to do

  Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.CVE-2022-34658 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

  Affected

  up to 3.2.48

  What to do

  Affects up to 3.2.48. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.CVE-2022-34648 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress.CVE-2022-33142 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Authenticated (subscriber+) Denial Of Service (DoS) vulnerability in WordPlus WordPress Better Messages plugin <= 1.9.10.57 at WordPress.

  Affected

  up to 1.9.10.57

  What to do

  Affects up to 1.9.10.57. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 23, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPress.CVE-2022-29476 · WordPress plugins & themes · reported by PatchstackMedium 6.1

  Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in 8 Degree Themes otification Bar for WordPress plugin <= 1.1.8 at WordPress.

  Affected

  up to 1.1.8

  What to do

  Affects up to 1.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 22, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress.CVE-2022-36346 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Max Foundry MaxButtons plugin <= 9.2 at WordPress.

  Affected

  up to 9.2

  What to do

  Affects up to 9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 22, 2022Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.CVE-2022-34858 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.

  Affected

  up to 1.11.3

  What to do

  Affects up to 1.11.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordlana.codespatchstack.com

• Aug 22, 2022Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPressCVE-2022-34857 · WordPress plugins & themes · reported by PatchstackMedium 6.1

  Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress

  Affected

  up to 4.59

  What to do

  Affects up to 4.59. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 22, 2022Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.CVE-2022-34347 · WordPress plugins & themes · reported by PatchstackMedium 4.2

  Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.

  Affected

  up to 3.2.48

  What to do

  Affects up to 3.2.48. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 22, 2022Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.CVE-2022-34149 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.

  Affected

  up to 3.0.4

  What to do

  Affects up to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordlana.codespatchstack.com

• Aug 22, 2022PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.CVE-2022-33900 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  PHP Object Injection vulnerability in Easy Digital Downloads plugin <= 3.0.1 at WordPress.

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.

  Product

  Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro

  Fixed in

  5.12.3

  What to do

  Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.

  Full record and what to do →NVD recordwpscan.compritect.net

• Aug 22, 2022Duplicator: Discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the pluginCVE-2022-2551 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.

  Product

  Duplicator

  Fixed in

  1.4.7

  What to do

  Update Duplicator to 1.4.7 or newer.

  Full record and what to do →NVD recordgithub.comwpscan.com

• Aug 22, 2022WPQA Builder: Which is a companion plugin to the Hilmer and DiscyCVE-2022-2198 · WordPress plugins & themes · reported by WPScanMedium 4.3

  The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.

  Product

  WPQA Builder

  Fixed in

  5.7

  What to do

  Update WPQA Builder to 5.7 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Aug 22, 2022Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.CVE-2021-36857 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 22, 2022Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress.CVE-2021-36852 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress.

  Affected

  up to 1.10.5

  What to do

  Affects up to 1.10.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 22, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.CVE-2021-36847 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.

  Affected

  up to 4.2.21

  What to do

  Affects up to 4.2.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 8, 2022The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript iCVE-2022-2391 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.

  Fixed in

  7.2.3

  What to do

  Update the plugin to 7.2.3 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Aug 8, 2022Directorist: Allows administrators to download other plugins from the same vendor directly to the siteCVE-2022-2046 · WordPress plugins & themes · reported by WPScanMedium 4.9

  The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.

  Product

  Directorist

  Fixed in

  7.2.3

  What to do

  Update Directorist to 7.2.3 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Aug 5, 2022StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at: Authenticated IDORCVE-2022-36284 · WordPress plugins & themes · reported by PatchstackMedium 6.4

  Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) should be at least installed to get the extra input field on the user profile page.

  Product

  StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at

  Affected

  up to 4.7.0

  What to do

  Affects up to 4.7.0. Update StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddzv365zjfbd8v.cloudfront.netpatchstack.com

• Aug 5, 2022Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.CVE-2022-25649 · WordPress plugins & themes · reported by PatchstackMedium 5

  Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.

  Affected

  up to 4.7.0

  What to do

  Affects up to 4.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddzv365zjfbd8v.cloudfront.netpatchstack.com

• Aug 5, 2022Rich Reviews by Starfish plugin <= 1.9.14 at: Cross-Site Request Forgery (CSRF)CVE-2021-36861 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete reviews.

  Product

  Rich Reviews by Starfish plugin <= 1.9.14 at

  Affected

  up to 1.9.14

  What to do

  Affects up to 1.9.14. Update Rich Reviews by Starfish plugin <= 1.9.14 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 1, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPCVE-2022-36343 · WordPress plugins & themes · reported by PatchstackLow 3.4

  Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 1, 2022Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.CVE-2022-34154 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Aug 1, 2022Login with phone number: Does not sanitise and escape plugin settingsCVE-2022-0598 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

  Product

  Login with phone number

  Fixed in

  1.3.8

  What to do

  Update Login with phone number to 1.3.8 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jul 30, 2022The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature.CVE-2022-33994 · WordPress plugins & themes · reported by MITRELow 3

  The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators.

  Product

  Gutenberg

  Affected

  up to 13.7.3

  What to do

  Affects up to 13.7.3. Update Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordblog.jitendrapatro.mepatchstack.com

• Jul 29, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress.CVE-2022-36378 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress.

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 28, 2022WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnCVE-2016-0796 · WordPress plugins & themes · reported by Red HatHigh 7.5

  WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacker may leverage these issues to hide attacks directed at a target site from behind vulnerable website or to perform otherwise restricted actions and subsequently download files with the extension mp3, mp4a, wav and ogg from anywhere the web server application has read access to the system. WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files version 1.7.6 is vulnerable; prior versions may also be affected.

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordvapidlabs.comacunetix.com

• Jul 28, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.CVE-2022-35882 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.

  Affected

  up to 1.9.5

  What to do

  Affects up to 1.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 27, 2022Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress.CVE-2022-33943 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress.

  Affected

  up to 2.0.0

  What to do

  Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 27, 2022Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress.CVE-2022-33970 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Authenticated WordPress Options Change vulnerability in Biplob018 Shortcode Addons plugin <= 3.1.2 at WordPress.

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.