Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

409 results · page 5 of 9

Nov 6, 2023User Registration: Does not sanitize and escape some of its settingsCVE-2023-5228 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
User Registration
Fixed in
3.0.4.2
What to do
Update User Registration to 3.0.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023Login Screen Manager: Does not sanitize and escape some of its settingsCVE-2023-5243 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Login Screen Manager
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update Login Screen Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023E2Pdf: Does not sanitize and escape some of its settingsCVE-2023-5229 · WordPress plugins & themes · reported by WPScanMedium 4.8
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
E2Pdf
Fixed in
1.20.20
What to do
Update E2Pdf to 1.20.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023Fattura24: Does not sanitize or escape the 'id' parameter before outputting it back in the pageCVE-2023-5211 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.
Product
Fattura24
Fixed in
6.2.8
What to do
Update Fattura24 to 6.2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023Popup box: Does not sanitize and escape some Popup fieldsCVE-2023-4390 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
Popup box
Fixed in
3.7.2
What to do
Update Popup box to 3.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023PowerPress Podcasting plugin by Blubrry: Does not sanitize and escape the media url field in postsCVE-2023-4820 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.0.12
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.0.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023User Avatar: Does not properly sanitize and escape certain of its shortcodes attributesCVE-2023-4798 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.
Product
User Avatar
Fixed in
1.2.2
What to do
Update User Avatar to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023ActivityPub: Does not sanitize and escape some data from post contentCVE-2023-3746 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks
Product
ActivityPub
Fixed in
1.0.0
What to do
Update ActivityPub to 1.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Booking Calendar: Does not sanitize and escape some of its booking from dataCVE-2023-4620 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators
Product
Booking Calendar
Fixed in
9.7.3.1
What to do
Update Booking Calendar to 9.7.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023DoLogin Security: Does not properly sanitize IP addresses coming from the X-Forwarded-For headerCVE-2023-4549 · WordPress plugins & themes · reported by WPScanMedium 6.1
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
Product
DoLogin Security
Fixed in
3.7
What to do
Update DoLogin Security to 3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023Front Editor: Does not sanitize and escape some of its form settingsCVE-2023-1982 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Front Editor
Affected
up to 4.0.4
What to do
Affects up to 4.0.4. Update Front Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 7, 2023Bubble Menu: Does not sanitize and escape some of its settingsCVE-2023-3650 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bubble Menu WordPress plugin before 3.0.5 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Product
Bubble Menu
Fixed in
3.0.5
What to do
Update Bubble Menu to 3.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 7, 2023Quiz And Survey Master: Does not properly sanitize and escape question titlesCVE-2023-3575 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Quiz And Survey Master
Fixed in
8.1.11
What to do
Update Quiz And Survey Master to 8.1.11 or newer.
Full record and what to do →NVD record wpscan.com onvio.nl
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not properly sanitize and escape a parameter before using it in an SQL statementCVE-2023-2843 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Product
MultiParcels Shipping For WooCommerce
Fixed in
1.14.15
What to do
Update MultiParcels Shipping For WooCommerce to 1.14.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023Enable SVG, WebP & ICO Upload: Does not sanitize SVG file contentsCVE-2023-2143 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.
Product
Enable SVG, WebP & ICO Upload
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Enable SVG, WebP & ICO Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023PrePost SEO: Does not properly sanitize some of its settingsCVE-2023-2029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
PrePost SEO
Affected
up to 3.0
What to do
Affects up to 3.0. Update PrePost SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jul 10, 2023Call Now Accessibility Button: Does not properly sanitize some of its settingsCVE-2023-2028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Call Now Accessibility Button
Fixed in
1.1
What to do
Update Call Now Accessibility Button to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023Image Protector: Does not properly sanitize some of its settingsCVE-2023-2026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Image Protector
Affected
up to 1.1
What to do
Affects up to 1.1. Update Image Protector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023AI Engine: Does not sanitize and escape some of its settingsCVE-2023-2580 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Product
AI Engine
Fixed in
1.6.83
What to do
Update AI Engine to 1.6.83 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023Custom 404 Pro: Does not properly sanitize database inputsCVE-2023-2032 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.
Product
Custom 404 Pro
Fixed in
3.8.1
What to do
Update Custom 404 Pro to 3.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023USM-Premium: Does not sanitize and escape some of its settingsCVE-2023-1166 · WordPress plugins & themes · reported by WPScanMedium 4.8
The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Product
USM-Premium
Fixed in
16.3
What to do
Update USM-Premium to 16.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023Catalyst Connect Zoho CRM Client Portal: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2023-0588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
Product
Catalyst Connect Zoho CRM Client Portal
Fixed in
2.1.0
What to do
Update Catalyst Connect Zoho CRM Client Portal to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023AI ChatBot: Does not sanitize and escape its settingsCVE-2023-2742 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
AI ChatBot
Fixed in
4.5.5
What to do
Update AI ChatBot to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023Custom Base Terms: Does not sanitize and escape some of its settingsCVE-2023-2600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Custom Base Terms
Fixed in
1.0.3
What to do
Update Custom Base Terms to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2023Add to Feedly: Does not sanitize and escape its settingsCVE-2023-2470 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Add to Feedly
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update Add to Feedly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2023Otter: Does not sanitize some user-controlled file paths before performing file operations on themCVE-2023-2288 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
Product
Otter
Fixed in
2.2.6
What to do
Update Otter to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some URL parametersCVE-2023-2256 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.
Product
Product Addons & Fields for WooCommerce
Fixed in
32.0.7
What to do
Update Product Addons & Fields for WooCommerce to 32.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2023Image Optimizer by 10web: Does not sanitize the dir parameterCVE-2023-2117 · WordPress plugins & themes · reported by WPScanLow 2.7
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.
Product
Image Optimizer by 10web
Fixed in
1.0.27
What to do
Update Image Optimizer by 10web to 1.0.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2023Elementor Website Builder: Does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statementCVE-2023-0329 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
Product
Elementor Website Builder
Fixed in
3.12.2
What to do
Update Elementor Website Builder to 3.12.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
May 15, 2023Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform SCVE-2023-2009 · WordPress plugins & themes · reported by WPScanMedium 4.8
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Pretty Url
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some of its setting fieldsCVE-2023-1839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Product
Product Addons & Fields for WooCommerce
Fixed in
32.0.6
What to do
Update Product Addons & Fields for WooCommerce to 32.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023RapidExpCart: Does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the pageCVE-2023-0520 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection means an attacker can trick a logged in admin to perform the attack by submitting a hidden form.
Product
RapidExpCart
Affected
up to 1.0
What to do
Affects up to 1.0. Update RapidExpCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2023Limit Login Attempts: Does not sanitize and escape usernamesCVE-2023-1861 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
Product
Limit Login Attempts
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023Random Text: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2023-0388 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers.
Product
Random Text
Affected
up to 0.3.0
What to do
Affects up to 0.3.0. Update Random Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Klaviyo: Does not sanitize and escape some of its settingsCVE-2023-0874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Klaviyo WordPress plugin before 3.0.10 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Klaviyo
Fixed in
3.0.10
What to do
Update Klaviyo to 3.0.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Contact Form: Does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field typeCVE-2023-0546 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to the form or admins previewing or editing the form.
Product
Contact Form
Fixed in
4.3.25
What to do
Update Contact Form to 4.3.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Article Directory: Does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panelCVE-2023-0422 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.
Product
Article Directory
Affected
up to 1.3
What to do
Affects up to 1.3. Update Article Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023WP Dark Mode: Does not properly sanitize the style parameter in shortcodes before using it to load a PHP templateCVE-2023-0467 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.
Product
WP Dark Mode
Fixed in
4.0.8
What to do
Update WP Dark Mode to 4.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WP Meta SEO: Does not properly sanitize and escape inputs into SQL queriesCVE-2023-0875 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.
Product
WP Meta SEO
Fixed in
4.5.3
What to do
Update WP Meta SEO to 4.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Namaste! LMS: Does not sanitize and escape some of its settingsCVE-2023-0844 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Namaste! LMS
Fixed in
2.6
What to do
Update Namaste! LMS to 2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023FluentSMTP: Does not sanitize or escape email contentCVE-2023-0219 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.
Product
FluentSMTP
Fixed in
2.2.3
What to do
Update FluentSMTP to 2.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Resume Builder: Does not sanitize and escape some parameters related to ResumeCVE-2023-0078 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users
Product
Resume Builder
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Resume Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2023Namaste! LMS: Does not sanitize and escape some of its settingsCVE-2023-0548 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Namaste! LMS
Fixed in
2.5.9.4
What to do
Update Namaste! LMS to 2.5.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2023Arigato Autoresponder and Newsletter: Does not sanitize and escape some of its settingsCVE-2023-0543 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Arigato Autoresponder and Newsletter
Fixed in
2.1.7.2
What to do
Update Arigato Autoresponder and Newsletter to 2.1.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Spectra: Does not sanitize user inputCVE-2020-36656 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks.
Product
Spectra
Fixed in
1.15.0
What to do
Update Spectra to 1.15.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023YourChannel: Does not sanitize and escape some parametersCVE-2023-0282 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
Product
YourChannel
Fixed in
1.2.2
What to do
Update YourChannel to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023SiteGround Security: Does not properly sanitize user input before using it in an SQL queryCVE-2023-0234 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
Product
SiteGround Security
Fixed in
1.3.1
What to do
Update SiteGround Security to 1.3.1 or newer.
Full record and what to do →NVD record github.com wpscan.com
Feb 6, 2023Hide My WP: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Product
Hide My WP
Fixed in
6.2.9
What to do
Update Hide My WP to 6.2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023Panda Pods Repeater Field: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.
Product
Panda Pods Repeater Field
Fixed in
1.5.4
What to do
Update Panda Pods Repeater Field to 1.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 26, 2023The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vuCVE-2023-0448 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.1
The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.
Fixed in
4.3
What to do
Update the plugin to 4.3 or newer.
Full record and what to do →NVD record tenable.com tenable.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.