Vulnerability database

4,892 results · page 46 of 98

• Jul 25, 2022Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.CVE-2022-36375 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress.

  Affected

  up to 3.6.0

  What to do

  Affects up to 3.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.complugins.trac.wordpress.org

• Jul 25, 2022Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress.CVE-2022-33969 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress.

  Affected

  up to 2.6.0

  What to do

  Affects up to 2.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.complugins.trac.wordpress.org

• Jul 25, 2022Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.CVE-2022-33965 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.

  Affected

  up to 5.7

  What to do

  Affects up to 5.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 22, 2022Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.CVE-2022-34853 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 22, 2022Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.CVE-2022-34839 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress.

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 22, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.CVE-2022-34650 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 22, 2022Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.CVE-2022-33960 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 22, 2022Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.CVE-2022-33901 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.

  Affected

  up to 4.13.1

  What to do

  Affects up to 4.13.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 22, 2022Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.CVE-2022-33191 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.

  Affected

  up to 3.0.1

  What to do

  Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 22, 2022Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugiCVE-2022-30998 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin <= 1.1 at WordPress.

  Affected

  up to 1.1

  What to do

  Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 22, 2022Sygnoos Popup Builder plugin <= 4.1.11 at: Cross-Site Request Forgery (CSRF)CVE-2022-29495 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin settings.

  Product

  Sygnoos Popup Builder plugin <= 4.1.11 at

  Affected

  up to 4.1.11

  What to do

  Affects up to 4.1.11. Update Sygnoos Popup Builder plugin <= 4.1.11 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 22, 2022Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.CVE-2022-27235 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress.

  Affected

  up to 2.2.3

  What to do

  Affects up to 2.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 21, 2022Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.CVE-2022-34487 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress.

  Affected

  up to 3.0.2

  What to do

  Affects up to 3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 21, 2022Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.CVE-2022-33198 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.

  Affected

  up to 2.0.2

  What to do

  Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 21, 2022Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-31475 · WordPress plugins & themes · reported by PatchstackMedium 5.5

  Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

  Affected

  up to 2.20.2

  What to do

  Affects up to 2.20.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 21, 2022Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress.CVE-2022-30536 · WordPress plugins & themes · reported by PatchstackLow 3.4

  Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress.

  Affected

  up to 6.0.7

  What to do

  Affects up to 6.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 21, 2022Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-28700 · WordPress plugins & themes · reported by PatchstackCritical 9.1

  Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

  Affected

  up to 2.20.2

  What to do

  Affects up to 2.20.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 21, 2022JoomUnited WP Meta SEO plugin <= 4.4.8 at: Cross-Site Request Forgery (CSRF)CVE-2022-30337 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the social settings.

  Product

  JoomUnited WP Meta SEO plugin <= 4.4.8 at

  Affected

  up to 4.4.8

  What to do

  Affects up to 4.4.8. Update JoomUnited WP Meta SEO plugin <= 4.4.8 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 21, 2022Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.CVE-2022-32289 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.

  Affected

  up to 4.1.0

  What to do

  Affects up to 4.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 20, 2022Quick Restaurant Reservations (WordPress plugin): Cross-site Scripting (XSS)CVE-2022-29923 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Cross-site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations (WordPress plugin) allows Reflected XSS.This issue affects Quick Restaurant Reservations (WordPress plugin): from n/a through 1.4.1.

  Product

  Quick Restaurant Reservations (WordPress plugin)

  Affected

  up to 1.4.1

  What to do

  Affects up to 1.4.1. Update Quick Restaurant Reservations (WordPress plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jul 20, 2022WordPlus Better Messages plugin <= 1.9.9.148 at: Cross-Site Request Forgery (CSRF)CVE-2022-29454 · WordPress plugins & themes · reported by PatchstackLow 3.1

  Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated.

  Product

  WordPlus Better Messages plugin <= 1.9.9.148 at

  Affected

  up to 1.9.9.148

  What to do

  Affects up to 1.9.9.148. Update WordPlus Better Messages plugin <= 1.9.9.148 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 20, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress.CVE-2021-36849 · WordPress plugins & themes · reported by PatchstackLow 3.4

  Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress.

  Affected

  up to 3.8.1

  What to do

  Affects up to 3.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jul 18, 2022The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly cCVE-2022-2224 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly check for the existence of a nonce in the function gifeed_duplicate_feed. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.

  Affected

  up to 1.0.0.27

  What to do

  Affects up to 1.0.0.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jul 18, 2022The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the CVE-2022-2223 · WordPress plugins & themes · reported by WordfenceMedium 5.4

  The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the existence of a nonce in the function ewic_duplicate_slider. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.

  Affected

  up to 1.1.121

  What to do

  Affects up to 1.1.121. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jul 18, 2022plugin Wbcom Designs – BuddyPress Group Reviews: Unauthorized settings changes and review modificationCVE-2022-2108 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.

  Product

  plugin Wbcom Designs – BuddyPress Group Reviews

  Affected

  up to 2.8.3

  What to do

  Affects up to 2.8.3. Update plugin Wbcom Designs – BuddyPress Group Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 18, 2022The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, anCVE-2022-1565 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.

  Affected

  up to 3.6.7

  What to do

  Affects up to 3.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jul 17, 2022The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titlesCVE-2022-2099 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles

  Product

  WooCommerce

  Fixed in

  6.6.0

  What to do

  Update WooCommerce to 6.6.0 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jul 17, 2022Discount Rules for WooCommerce: Does not escape a parameter before outputting it back in an attribute of the plugin's discount rule pageCVE-2022-2090 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting

  Product

  Discount Rules for WooCommerce

  Fixed in

  2.4.2

  What to do

  Update Discount Rules for WooCommerce to 2.4.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jul 11, 2022Free Booking Plugin for Hotels, Restaurant and Car Rental: Suffers from insufficient input validationCVE-2022-1952 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.

  Product

  Free Booking Plugin for Hotels, Restaurant and Car Rental

  Fixed in

  1.1.16

  What to do

  Update Free Booking Plugin for Hotels, Restaurant and Car Rental to 1.1.16 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jul 11, 2022core plugin for kitestudio: Does not sanitise and escape some parameters before outputting them back in a response of an AJAX actionCVE-2022-1951 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting.

  Product

  core plugin for kitestudio

  Fixed in

  2.3.1

  What to do

  Update core plugin for kitestudio to 2.3.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jul 7, 2022In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application.CVE-2015-1785 · WordPress plugins & themes · reported by Red HatMedium 6.5

  In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.

  Fixed in

  2.0.77.3

  What to do

  Update the plugin to 2.0.77.3 or newer.

  Full record and what to do →NVD recordblog.nettitude.comwpscan.com

• Jul 7, 2022In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application.CVE-2015-1784 · WordPress plugins & themes · reported by Red HatHigh 8.8

  In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.

  Fixed in

  2.0.77.3

  What to do

  Update the plugin to 2.0.77.3 or newer.

  Full record and what to do →NVD recordblog.nettitude.comwpscan.com

• Jul 6, 2022custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.CVE-2015-3173 · WordPress plugins & themes · reported by Red HatHigh 7.2

  custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.

  Fixed in

  0.9.8.6

  What to do

  Update the plugin to 0.9.8.6 or newer.

  Full record and what to do →NVD recordblog.nettitude.comgithub.com

• Jun 30, 2022There is an object injection vulnerability in swfupload plugin for wordpress.CVE-2013-4144 · WordPress plugins & themes · reported by Red HatCritical 9.8

  There is an object injection vulnerability in swfupload plugin for wordpress.

  Affected

  3.5.2 to 3.5.2

  What to do

  Affects 3.5.2 to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.comopenwall.com

• Jun 29, 2022A vulnerability classified as problematic has been found in Easy Table Plugin 1.6.CVE-2017-20108 · WordPress plugins & themes · reported by VulDBLow 3.5

  A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "><script>alert(1)</script> leads to basic cross site scripting. It is possible to initiate the attack remotely.

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordseclists.orgvuldb.com

• Jun 27, 2022The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to maliCVE-2022-1028 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)

  Product

  WordPress Security Firewall, Malware Scanner, Secure Login and Backup

  Fixed in

  4.2.1

  What to do

  Update WordPress Security Firewall, Malware Scanner, Secure Login and Backup to 4.2.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jun 24, 2022In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WorCVE-2013-1916 · WordPress plugins & themes · reported by Red HatHigh 8.8

  In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.

  Affected

  0.9.4 to 0.9.4

  What to do

  Affects 0.9.4 to 0.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Jun 16, 2022Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36827 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".

  Product

  Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at

  Affected

  up to 3.6.9

  What to do

  Affects up to 3.6.9. Update Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jun 15, 2022Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Xakuro's XO Slider plugin <= 3.3.2 at WordPress.CVE-2022-32280 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Xakuro's XO Slider plugin <= 3.3.2 at WordPress.

  Affected

  up to 3.3.2

  What to do

  Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin <= 4.1 at WordPress.CVE-2022-29452 · WordPress plugins & themes · reported by PatchstackLow 3.4

  Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin <= 4.1 at WordPress.

  Affected

  up to 4.1

  What to do

  Affects up to 4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Photo Gallery by Supsystic plugin <= 1.15.5 at: Cross-Site Request Forgery (CSRF)CVE-2021-36891 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic plugin <= 1.15.5 at WordPress allows changing the plugin settings.

  Product

  Photo Gallery by Supsystic plugin <= 1.15.5 at

  Affected

  up to 1.15.5

  What to do

  Affects up to 1.15.5. Update Photo Gallery by Supsystic plugin <= 1.15.5 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.CVE-2022-29450 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.

  Affected

  up to 2.4.4

  What to do

  Affects up to 2.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.compatchstack.com

• Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPressCVE-2022-29443 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Nicdark's Hotel Booking plugin <= 3.0 at WordPress.

  Affected

  up to 3.0

  What to do

  Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key update.CVE-2022-29453 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in API KEY for Google Maps plugin <= 1.2.1 at WordPress leading to Google Maps API key update.

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Private Messages For WordPress plugin <= 2.1.10 at: Cross-Site Request Forgery (CSRF)CVE-2022-29441 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Private Messages For WordPress plugin <= 2.1.10 at WordPress allows attackers to send messages.

  Product

  Private Messages For WordPress plugin <= 2.1.10 at

  Affected

  up to 2.1.10

  What to do

  Affects up to 2.1.10. Update Private Messages For WordPress plugin <= 2.1.10 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress.CVE-2022-29440 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress.

  Affected

  up to 3.3.4

  What to do

  Affects up to 3.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Image Slider by NextCode plugin <= 1.1.2 at: Cross-Site Request Forgery (CSRF)CVE-2022-29439 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting slides.

  Product

  Image Slider by NextCode plugin <= 1.1.2 at

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Image Slider by NextCode plugin <= 1.1.2 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress.CVE-2022-29438 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress.

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress.CVE-2022-29437 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress.

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team Manager plugin <= 1CVE-2022-29406 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team Manager plugin <= 1.6.9 at WordPress.

  Affected

  up to 1.6.9

  What to do

  Affects up to 1.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.