Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

294 results · page 5 of 6

Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions.CVE-2023-31077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions.
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Simple CSV/XLS Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-42882 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.
Product
Simple CSV/XLS Exporter
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Simple CSV/XLS Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Export Users Data CSV: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-41616 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.
Product
Export Users Data CSV
Affected
up to 2.1
What to do
Affects up to 2.1. Update Export Users Data CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WP CSV Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-38702 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.
Product
WP CSV Exporter
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP CSV Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Export Users Data Distinct: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46804 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export Users Data Distinct: from n/a through 1.3.
Product
Export Users Data Distinct
Affected
up to 1.3
What to do
Affects up to 1.3. Update Export Users Data Distinct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
Product
WordPress Comments Import & Export
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46802 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
Product
Product Reviews Import Export for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Product Reviews Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023Pressference Exporter: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-45046 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressference Pressference Exporter allows SQL Injection.This issue affects Pressference Exporter: from n/a through 1.0.3.
Product
Pressference Exporter
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Pressference Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023WooCommerce Dynamic Pricing and Discounts: Unauthenticated settings exportCVE-2021-4353 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it possible for unauthenticated attackers to export the plugin's settings.
Product
WooCommerce Dynamic Pricing and Discounts
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jul 17, 2023Export and Import Users and Customers: Unauthorized modification of dataCVE-2023-3459 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.
Product
Export and Import Users and Customers
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Export and Import Users and Customers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 10, 2023Export All URLs: Does not sanitise and escape a parameter before outputting them back in the pageCVE-2023-3118 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Export All URLs
Fixed in
4.6
What to do
Update Export All URLs to 4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 1, 2023Import / Export Customizer Settings: Cross-Site Request ForgeryCVE-2020-36737 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the astra_admin_errors() function. This makes it possible for unauthenticated attackers to display an import status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Import / Export Customizer Settings
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Import / Export Customizer Settings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 6, 2023Ultimate GDPR & CCPA: Unauthenticated settings import and exportCVE-2021-4348 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks such as redirecting visitors to malicious sites.
Product
Ultimate GDPR & CCPA
Affected
up to 2.4
What to do
Affects up to 2.4. Update Ultimate GDPR & CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
May 30, 2023Autoptimize: Does not sanitise and escape the settings imported from a previous exportCVE-2023-2113 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
Product
Autoptimize
Fixed in
3.1.7
What to do
Update Autoptimize to 3.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Customizer Export/Import: Unserializes user input provided via the settingsCVE-2023-1347 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Product
Customizer Export/Import
Fixed in
0.9.6
What to do
Update Customizer Export/Import to 0.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 23, 2023The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValue' and 'selectedColCVE-2023-26325 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The 'rx_export_review' action in the ReviewX WordPress Plugin, is affected by an authenticated SQL injection vulnerability in the 'filterValue' and 'selectedColumns' parameters.
Product
ReviewX
Fixed in
1.6.4
What to do
Update ReviewX to 1.6.4 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Jan 2, 2023Autoptimize: Uses an easily guessable path to store plugin's exported settings and logsCVE-2022-4057 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
Product
Autoptimize
Fixed in
3.1.0
What to do
Update Autoptimize to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-allCVE-2022-4157 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-all.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-dataCVE-2022-4151 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-data.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 12, 2022WP CSV Exporter: Does not properly escape the fieldsCVE-2022-3605 · WordPress plugins & themes · reported by WPScanHigh 7.8
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability.
Product
WP CSV Exporter
Fixed in
1.3.7
What to do
Update WP CSV Exporter to 1.3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022WP CSV Exporter: Does not properly sanitise and escape some parameters before using them in a SQL statementCVE-2022-3249 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high privilege users such as admin to perform SQL injection attacks
Product
WP CSV Exporter
Fixed in
1.3.7
What to do
Update WP CSV Exporter to 1.3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list: Does not validate dataCVE-2022-3603 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.
Product
Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list
Fixed in
2.0.69
What to do
Update Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list to 2.0.69 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Awesome Support: Does not ensure that the exported tickets archive to be downloaded belongs to the user making the requestCVE-2022-3511 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
Product
Awesome Support
Fixed in
6.1.2
What to do
Update Awesome Support to 6.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.CVE-2022-40128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 7, 2022Import and export users and customers: Does not properly escape dataCVE-2022-3558 · WordPress plugins & themes · reported by WPScanHigh 8
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
Product
Import and export users and customers
Fixed in
1.20.5
What to do
Update Import and export users and customers to 1.20.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 31, 2022Customizer Export/Import: Unserializes the content of an imported fileCVE-2022-3380 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lead to PHP object injection issues when an admin imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Product
Customizer Export/Import
Fixed in
0.9.5
What to do
Update Customizer Export/Import to 0.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2022WP All Export Pro: Uses the contents of the cc_sql POST parameter directlyCVE-2022-3395 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been given permission to run exports to execute arbitrary SQL statements, leading to a SQL Injection vulnerability. By default only users with the Administrator role can perform exports, but this can be delegated to lower privileged users as well.
Product
WP All Export Pro
Fixed in
1.7.9
What to do
Update WP All Export Pro to 1.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2022WP All Export Pro: Does not limit some functionality during exports only to users with the Administrator roleCVE-2022-3394 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
Product
WP All Export Pro
Fixed in
1.7.9
What to do
Update WP All Export Pro to 1.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 17, 2022Helpful: Puts the exported logs and feedbacks in a publicly accessible location and guessable namesCVE-2022-2834 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin's settings
Product
Helpful
Fixed in
4.5.26
What to do
Update Helpful to 4.5.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.CVE-2022-38061 · WordPress plugins & themes · reported by PatchstackMedium 6.2
Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 9, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.CVE-2022-38068 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 9, 2022Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPressCVE-2022-35275 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPress.
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 6, 2022WP Users Exporter: CSV InjectionCVE-2022-3026 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into profile information like First Names that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Product
WP Users Exporter
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update WP Users Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 29, 2022Export All URLs: Does not validate the path of the file to be removed on the systemCVE-2022-2638 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server
Product
Export All URLs
Fixed in
4.4
What to do
Update Export All URLs to 4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022Exports and Reports: Does not sanitize and validate dataCVE-2022-1539 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.
Product
Exports and Reports
Fixed in
0.9.2
What to do
Update Exports and Reports to 0.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 21, 2022Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-31475 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
Affected
up to 2.20.2
What to do
Affects up to 2.20.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 21, 2022Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-28700 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
Affected
up to 2.20.2
What to do
Affects up to 2.20.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 27, 2022Import Export All WordPress Images, Users & Post Types: Does not fully validate the file to be imported via an URL before making an HTTP request to itCVE-2022-1977 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
Product
Import Export All WordPress Images, Users & Post Types
Fixed in
6.5.3
What to do
Update Import Export All WordPress Images, Users & Post Types to 6.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 15, 2022Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin <= 4.1 at WordPress.CVE-2022-29452 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (editor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Export All URLs plugin <= 4.1 at WordPress.
Affected
up to 4.1
What to do
Affects up to 4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jun 13, 2022Export any WordPress data to XML/CSV: Does not sanitize the cpt POST parameterCVE-2022-1800 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.
Product
Export any WordPress data to XML/CSV
Fixed in
1.3.5
What to do
Update Export any WordPress data to XML/CSV to 1.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Import and export users and customers: Does not sanitise and escaped imported CSV dataCVE-2022-1255 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
Product
Import and export users and customers
Fixed in
1.19.2.1
What to do
Update Import and export users and customers to 1.19.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022myCred: Does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX actionCVE-2022-1092 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog
Product
myCred
Fixed in
2.4.3.1
What to do
Update myCred to 2.4.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022myCred: Does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX actionCVE-2022-0363 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
Product
myCred
Fixed in
2.4.3.1
What to do
Update myCred to 2.4.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2022Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115CVE-2022-27849 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <= 20220115
Affected
up to 20220115
What to do
Affects up to 20220115. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 12, 2022Visual Form Builder: Is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV fileCVE-2022-0142 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
Product
Visual Form Builder
Fixed in
3.0.8
What to do
Update Visual Form Builder to 3.0.8 or newer.
Full record and what to do →NVD record wpscan.com fortiguard.com
Apr 12, 2022Visual Form Builder: Does not perform access control on entry form exportCVE-2022-0140 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
Product
Visual Form Builder
Fixed in
3.0.6
What to do
Update Visual Form Builder to 3.0.6 or newer.
Full record and what to do →NVD record wpscan.com fortiguard.com
Apr 11, 2022Export All URLs: Does not have CSRF in placeCVE-2022-0914 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
Product
Export All URLs
Fixed in
4.3
What to do
Update Export All URLs to 4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Export All URLs: Does not sanitise and escape the CSV filename before outputting it back in the pageCVE-2022-0892 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Export All URLs
Fixed in
4.2
What to do
Update Export All URLs to 4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022settings of the iQ Block Country: Can be exported or imported using its backup functionalityCVE-2022-0246 · WordPress plugins & themes · reported by WPScanMedium 4.9
The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
Product
settings of the iQ Block Country
Fixed in
1.2.13
What to do
Update settings of the iQ Block Country to 1.2.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 4, 2022Booking Package: Requires a token for exporting the ical representation of it's booking calendarCVE-2022-0709 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
Product
Booking Package
Fixed in
1.5.29
What to do
Update Booking Package to 1.5.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.