Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,187 results · page 49 of 64
Sep 19, 2022Form Builder CP: Does not sanitise and escape some of its form settingsCVE-2022-2567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Form Builder CP
- Fixed in
- 1.2.32
- What to do
- Update Form Builder CP to 1.2.32 or newer.
Sep 16, 2022Login No Captcha reCAPTCHA: Doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screenCVE-2022-2913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.
- Product
- Login No Captcha reCAPTCHA
- Fixed in
- 1.7
- What to do
- Update Login No Captcha reCAPTCHA to 1.7 or newer.
Sep 16, 2022WP Server Health Stats: Does not escape some of its settingsCVE-2022-2887 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Server Health Stats
- Fixed in
- 1.7.0
- What to do
- Update WP Server Health Stats to 1.7.0 or newer.
Sep 16, 2022Affiliates Manager: Does not sanitise and escape some of its settingsCVE-2022-2799 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Affiliates Manager
- Fixed in
- 2.9.14
- What to do
- Update Affiliates Manager to 2.9.14 or newer.
Sep 16, 2022WP STAGING: Does not sanitise and escape some of its settingsCVE-2022-2737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP STAGING
- Fixed in
- 2.9.18
- What to do
- Update WP STAGING to 2.9.18 or newer.
Sep 16, 2022WP Taxonomy Import: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2669 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Taxonomy Import
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP Taxonomy Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2022Classified Listing Pro: Does not escape a generated URL before outputting it back in an attribute in an admin pageCVE-2022-2655 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Classified Listing Pro
- Fixed in
- 2.0.20
- What to do
- Update Classified Listing Pro to 2.0.20 or newer.
Sep 16, 2022Autoptimize: Does not sanitise and escape some of its settingsCVE-2022-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Autoptimize
- Fixed in
- 3.1.1
- What to do
- Update Autoptimize to 3.1.1 or newer.
Sep 16, 2022WBW Currency Switcher for WooCommerce: Does not sanitise and escape some of its settingsCVE-2022-2575 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WBW Currency Switcher for WooCommerce
- Fixed in
- 1.6.6
- What to do
- Update WBW Currency Switcher for WooCommerce to 1.6.6 or newer.
Sep 16, 2022Post SMTP Mailer/Email Log: Does not escape some of its settings before outputting them in the admins dashboardCVE-2022-2351 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.4
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.4 or newer.
Sep 16, 2022Mobile Events Manager: Does not properly escape the Enquiry source fieldCVE-2022-1194 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
- Product
- Mobile Events Manager
- Fixed in
- 1.4.8
- What to do
- Update Mobile Events Manager to 1.4.8 or newer.
Sep 9, 2022Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress.CVE-2022-37411 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza's Captcha Code plugin <= 2.7 at WordPress.
- Affected
- up to 2.7
- What to do
- Affects up to 2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 5, 2022Fast Flow: Does not sanitise and escape some of its Widget settingsCVE-2022-2775 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fast Flow
- Fixed in
- 1.2.13
- What to do
- Update Fast Flow to 1.2.13 or newer.
Sep 5, 2022Simple Payment Donations & Subscriptions: Does not sanitise and escape user input given in its formsCVE-2022-2565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
- Product
- Simple Payment Donations & Subscriptions
- Fixed in
- 4.2.1
- What to do
- Update Simple Payment Donations & Subscriptions to 4.2.1 or newer.
Sep 5, 2022WP Database Backup: Does not escape some of its settingsCVE-2022-2271 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Database Backup
- Fixed in
- 5.9
- What to do
- Update WP Database Backup to 5.9 or newer.
Aug 29, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape some parameters before outputting them back in an admin dashboardCVE-2022-2599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some parameters before outputting them back in an admin dashboard, leading to Reflected Cross-Site Scripting
- Product
- Anti-Malware Security and Brute-Force Firewall
- Fixed in
- 4.21.83
- What to do
- Update Anti-Malware Security and Brute-Force Firewall to 4.21.83 or newer.
Aug 29, 2022WP Hide & Security Enhancer: Does not escape a parameter before outputting it back in an attribute of a backend pageCVE-2022-2538 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an attribute of a backend page, leading to a Reflected Cross-Site Scripting
- Product
- WP Hide & Security Enhancer
- Fixed in
- 1.8
- What to do
- Update WP Hide & Security Enhancer to 1.8 or newer.
Aug 29, 2022WooCommerce PDF Invoices & Packing Slips: Does not sanitise and escape some parameters before outputting them back in an attributes of an admin pageCVE-2022-2537 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting.
- Product
- WooCommerce PDF Invoices & Packing Slips
- Fixed in
- 3.0.1
- What to do
- Update WooCommerce PDF Invoices & Packing Slips to 3.0.1 or newer.
Aug 29, 2022Simply Schedule Appointments: Does not sanitise and escape some of its settingsCVE-2022-2374 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simply Schedule Appointments
- Fixed in
- 1.5.7.7
- What to do
- Update Simply Schedule Appointments to 1.5.7.7 or newer.
Aug 22, 2022Better Search Replace: Does not properly sanitise and escape table data before inserting it into a SQL queryCVE-2022-2593 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL query, which could allow high privilege users to perform SQL Injection attacks
- Product
- Better Search Replace
- Fixed in
- 1.4.1
- What to do
- Update Better Search Replace to 1.4.1 or newer.
Aug 22, 2022Feed Them Social: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2532 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Feed Them Social
- Fixed in
- 3.0.1
- What to do
- Update Feed Them Social to 3.0.1 or newer.
Aug 22, 2022WP phpMyAdmin: Does not escape some of its settingsCVE-2022-2407 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP phpMyAdmin
- Fixed in
- 5.2.0.4
- What to do
- Update WP phpMyAdmin to 5.2.0.4 or newer.
Aug 22, 2022Feed Them Social: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2383 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Feed Them Social
- Fixed in
- 3.0.1
- What to do
- Update Feed Them Social to 3.0.1 or newer.
Aug 22, 2022WP Social Chat: Does not sanitise and escape some of its settingsCVE-2022-2361 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks.
- Product
- WP Social Chat
- Fixed in
- 6.0.5
- What to do
- Update WP Social Chat to 6.0.5 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the order and orderby parameters before using them in a SQL statementCVE-2022-25811 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Rezgo Online Booking: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2022-1932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file
- Product
- Rezgo Online Booking
- Fixed in
- 4.1.8
- What to do
- Update Rezgo Online Booking to 4.1.8 or newer.
Aug 22, 2022Coming Soon - Under Construction: Does not sanitize and escape some of its settingsCVE-2022-1322 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Coming Soon - Under Construction
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Coming Soon - Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the tk0 parameter from the tp_translation AJAX actionCVE-2021-24911 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated usersCVE-2021-24910 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 15, 2022Digital Publications by Supsystic: Does not sanitise and escape its settingsCVE-2022-2384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Digital Publications by Supsystic
- Fixed in
- 1.7.4
- What to do
- Update Digital Publications by Supsystic to 1.7.4 or newer.
Aug 15, 2022Easy Student Results: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2378 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Easy Student Results
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Easy Student Results to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 15, 2022Duplicate Page and Post: Does not sanitise and escape its settingsCVE-2022-2152 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Duplicate Page and Post
- Fixed in
- 2.8
- What to do
- Update Duplicate Page and Post to 2.8 or newer.
Aug 15, 2022Contact Form DB: Does not sanitise and escape some parameters before outputting them back in attributesCVE-2022-2116 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Contact Form DB
- Fixed in
- 1.8.0
- What to do
- Update Contact Form DB to 1.8.0 or newer.
Aug 8, 2022WPDating: Does not properly escape user input before concatenating it to certain SQL queriesCVE-2022-2460 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users
- Product
- WPDating
- Fixed in
- 7.4.0
- What to do
- Update WPDating to 7.4.0 or newer.
Aug 8, 2022Thinkific Uploader: Does not sanitise and escape its settingsCVE-2022-2426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.
- Product
- Thinkific Uploader
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Thinkific Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022WP DS Blog Map: Does not sanitise and escape some of its settingsCVE-2022-2425 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP DS Blog Map
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update WP DS Blog Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Google Maps Anywhere: Does not sanitise and escape any of its settingsCVE-2022-2424 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Google Maps Anywhere
- Affected
- up to 1.2.6.3
- What to do
- Affects up to 1.2.6.3. Update Google Maps Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022DW Promobar: Does not sanitise and escape some of its settingsCVE-2022-2423 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DW Promobar
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update DW Promobar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Better Tag Cloud: Does not sanitise and escape some of its settingsCVE-2022-2412 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Better Tag Cloud
- Affected
- up to 0.99.5
- What to do
- Affects up to 0.99.5. Update Better Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Auto More Tag: Does not sanitise and escape some of its settingsCVE-2022-2411 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Auto More Tag
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Auto More Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022mTouch Quiz: Does not sanitise and escape some of its settingsCVE-2022-2410 · WordPress plugins & themes · reported by WPScanMedium 4.8
The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- mTouch Quiz
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update mTouch Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Rough Chart: Does not properly escape chart data labelCVE-2022-2409 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Rough Chart
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Rough Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022WordPress Comments Fields: Does not escape Field Error MessageCVE-2022-2398 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WordPress Comments Fields
- Fixed in
- 4.1
- What to do
- Update WordPress Comments Fields to 4.1 or newer.
Aug 8, 2022weForms: Does not sanitise and escape its settingsCVE-2022-2395 · WordPress plugins & themes · reported by WPScanMedium 4.8
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- weForms
- Fixed in
- 1.6.14
- What to do
- Update weForms to 1.6.14 or newer.
Aug 8, 2022Crowdsignal Dashboard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2386 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Crowdsignal Dashboard
- Fixed in
- 3.0.8
- What to do
- Update Crowdsignal Dashboard to 3.0.8 or newer.
Aug 8, 2022YaySMTP: Does not sanitise and escape some of its settingsCVE-2022-2372 · WordPress plugins & themes · reported by WPScanMedium 4.8
The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- YaySMTP
- Fixed in
- 2.2.2
- What to do
- Update YaySMTP to 2.2.2 or newer.
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
- Product
- Website File Changes Monitor
- Fixed in
- 1.8.3
- What to do
- Update Website File Changes Monitor to 1.8.3 or newer.
Aug 1, 2022YaySMTP: Does not have capability check before displaying the Mailer Credentials in JS code for the settingsCVE-2022-2370 · WordPress plugins & themes · reported by WPScanMedium 6.5
The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 1, 2022YaySMTP: Does not have capability check in an AJAX actionCVE-2022-2369 · WordPress plugins & themes · reported by WPScanMedium 4.3
The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 1, 2022Flexi Quote Rotator: Does not sanitise and escape its settingsCVE-2022-2328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flexi Quote Rotator
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Flexi Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.