Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,187 results · page 46 of 64
Jan 2, 2023Joy Of Text Lite: Does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated usersCVE-2022-4099 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection
- Product
- Joy Of Text Lite
- Fixed in
- 2.3.1
- What to do
- Update Joy Of Text Lite to 2.3.1 or newer.
Jan 2, 2023Cryptocurrency Widgets Pack: Does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4059 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Cryptocurrency Widgets Pack
- Fixed in
- 2.0
- What to do
- Update Cryptocurrency Widgets Pack to 2.0 or newer.
Jan 2, 2023WP User: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4049 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- Product
- WP User
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WP User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Team Members: Does not sanitize and escapes some of its settingsCVE-2022-3936 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a multisite setup).
- Product
- Team Members
- Fixed in
- 5.2.1
- What to do
- Update Team Members to 5.2.1 or newer.
Jan 2, 2023Visual Email Designer for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3860 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author.
- Product
- Visual Email Designer for WooCommerce
- Fixed in
- 1.7.2
- What to do
- Update Visual Email Designer for WooCommerce to 1.7.2 or newer.
Jan 2, 2023Build App Online: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-3241 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Build App Online
- Fixed in
- 1.0.19
- What to do
- Update Build App Online to 1.0.19 or newer.
Dec 28, 2022Broken Link Checker: Does not sanitise and escape some of its settingsCVE-2022-3922 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Broken Link Checker
- Fixed in
- 1.11.20
- What to do
- Update Broken Link Checker to 1.11.20 or newer.
Dec 26, 2022Plugin Logic: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2022-4268 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Plugin Logic
- Fixed in
- 1.0.8
- What to do
- Update Plugin Logic to 1.0.8 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Bulk Delete Users by Email: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4267 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Bulk Delete Users by Email
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bulk Delete Users by Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022ImageInject: Does not sanitise and escape some of its settingsCVE-2022-4243 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- ImageInject
- Affected
- up to 1.17
- What to do
- Affects up to 1.17. Update ImageInject to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2022-4242 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Google Review Slider
- Fixed in
- 11.6
- What to do
- Update WP Google Review Slider to 11.6 or newer.
Dec 26, 2022Simple Basic Contact Form: Does not sanitise and escape some of its settingsCVE-2022-4226 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Basic Contact Form
- Fixed in
- 20221201
- What to do
- Update Simple Basic Contact Form to 20221201 or newer.
Dec 26, 2022Sliderby10Web: Does not sanitise and escape some of its settingsCVE-2022-4197 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Sliderby10Web
- Fixed in
- 1.2.53
- What to do
- Update Sliderby10Web to 1.2.53 or newer.
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activateCVE-2022-4166 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activate.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4165 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_multiple_files_for_post POST parameter before concatenating it to an SQL query in 0_change-galleryCVE-2022-4164 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_files_for_post POST parameter before concatenating it to an SQL query in 0_change-gallery.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_deactivate and cg_activate POST parameters before concatenating it to an SQL query in 2_deactivateCVE-2022-4163 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_deactivate and cg_activate POST parameters before concatenating it to an SQL query in 2_deactivate.php and 4_activate.php, respectively. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_row POST parameter before concatenating it to an SQL query in 3_row-orderCVE-2022-4162 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_row POST parameter before concatenating it to an SQL query in 3_row-order.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_copy_start POST parameter before concatenating it to an SQL query in copy-gallery-imagesCVE-2022-4161 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start POST parameter before concatenating it to an SQL query in copy-gallery-images.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_copy_id POST parameter before concatenating it to an SQL query in cg-copy-commentsCVE-2022-4160 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST parameter before concatenating it to an SQL query in cg-copy-comments.php and cg-copy-rating.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_id POST parameter before concatenating it to an SQL query in 0_change-galleryCVE-2022-4159 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_id POST parameter before concatenating it to an SQL query in 0_change-gallery.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-loginCVE-2022-4158 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-allCVE-2022-4157 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-all.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backendCVE-2022-4156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4155 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery Pro: Does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
- Product
- Contest Gallery Pro
- Fixed in
- 19.1.5
- What to do
- Update Contest Gallery Pro to 19.1.5 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the upload[] POST parameter before concatenating it to an SQL query in get-data-create-upload-v10CVE-2022-4153 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload[] POST parameter before concatenating it to an SQL query in get-data-create-upload-v10.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro: Do not escape the option_id POST parameter before concatenating it to an SQL query in edit-optionsCVE-2022-4152 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro WordPress plugin before 19.1.5 do not escape the option_id POST parameter before concatenating it to an SQL query in edit-options.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro
- Fixed in
- 19.1.5
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro to 19.1.5 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-dataCVE-2022-4151 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-data.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4150 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
- Product
- Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
- Fixed in
- 19.1.5.1
- What to do
- Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022IWS: Does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4117 · WordPress plugins & themes · reported by WPScanCritical 9.8
The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.
- Product
- IWS
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update IWS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Eventify™: Does not sanitise and escape some of its settingsCVE-2022-4110 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Eventify™
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Eventify™ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Paytium: Mollie payment forms & donations: Does not sanitise and escape some of its settingsCVE-2022-4042 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paytium: Mollie payment forms & donations
- Fixed in
- 4.3.7
- What to do
- Update Paytium: Mollie payment forms & donations to 4.3.7 or newer.
Dec 26, 2022Login for Google Apps: Does not sanitise and escape some of its settingsCVE-2022-3840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login for Google Apps WordPress plugin before 3.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login for Google Apps
- Fixed in
- 3.4.5
- What to do
- Update Login for Google Apps to 3.4.5 or newer.
Dec 26, 2022Kwayy HTML Sitemap: Does not sanitise and escape some of its settingsCVE-2022-3835 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Kwayy HTML Sitemap
- Fixed in
- 4.0
- What to do
- Update Kwayy HTML Sitemap to 4.0 or newer.
Dec 19, 2022Quizlord: Does not sanitise and escape some of its settingsCVE-2022-4112 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Quizlord
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Quizlord to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2022Photo Gallery by 10Web: Does not validate and escape some parameters before outputting them back in in JS code later on in another pageCVE-2022-4058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.8.3
- What to do
- Update Photo Gallery by 10Web to 1.8.3 or newer.
Dec 19, 2022JoomSport: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4050 · WordPress plugins & themes · reported by WPScanCritical 9.8
The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
- Product
- JoomSport
- Fixed in
- 5.2.8
- What to do
- Update JoomSport to 5.2.8 or newer.
Dec 19, 2022Responsive Lightbox2: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3987 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Lightbox2
- Fixed in
- 1.0.4
- What to do
- Update Responsive Lightbox2 to 1.0.4 or newer.
Dec 19, 2022WP Stripe Checkout: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3986 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WP Stripe Checkout
- Fixed in
- 1.2.2.21
- What to do
- Update WP Stripe Checkout to 1.2.2.21 or newer.
Dec 19, 2022Videojs HTML5 Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3985 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Videojs HTML5 Player
- Fixed in
- 1.1.9
- What to do
- Update Videojs HTML5 Player to 1.1.9 or newer.
Dec 19, 2022Flowplayer Video Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3984 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Flowplayer Video Player
- Fixed in
- 1.0.5
- What to do
- Update Flowplayer Video Player to 1.0.5 or newer.
Dec 19, 2022Checkout for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3983 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Checkout for PayPal
- Fixed in
- 1.0.14
- What to do
- Update Checkout for PayPal to 1.0.14 or newer.
Dec 19, 2022Easy Video Player: Does not sanitize and escapes some parametersCVE-2022-3937 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Easy Video Player
- Fixed in
- 1.2.2.3
- What to do
- Update Easy Video Player to 1.2.2.3 or newer.
Dec 19, 2022External Media: Does not sanitise and escape some of its settingsCVE-2022-3832 · WordPress plugins & themes · reported by WPScanMedium 4.8
The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- External Media
- Fixed in
- 1.0.36
- What to do
- Update External Media to 1.0.36 or newer.
Dec 12, 2022Image Hover Effects: Does not sanitise and escape some of its settingsCVE-2022-4010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Hover Effects
- Fixed in
- 5.5
- What to do
- Update Image Hover Effects to 5.5 or newer.
Dec 12, 2022Donation Button: Does not sanitize and escapes some parametersCVE-2022-4005 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Donation Button
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Donation Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2022WooCommerce Shipping: Does not sanitise and escape some of its settingsCVE-2022-4000 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WooCommerce Shipping
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update WooCommerce Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2022Icegram Express: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3981 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber
- Product
- Icegram Express
- Fixed in
- 5.5.1
- What to do
- Update Icegram Express to 5.5.1 or newer.
Dec 12, 2022Welcart e-Commerce: Does not sanitise and escape some parametersCVE-2022-3935 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.4
- What to do
- Update Welcart e-Commerce to 2.8.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.