Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,865 results · page 51 of 118
May 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions.CVE-2023-23705 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions.
- Fixed in
- 4.4.9
- What to do
- Update the plugin to 4.4.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 23, 2023miniOrange WordPress Social Login and Register: Cross-Site Request Forgery (CSRF)CVE-2023-23706 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
- Product
- miniOrange WordPress Social Login and Register
- Fixed in
- 7.6.0
- What to do
- Update miniOrange WordPress Social Login and Register to 7.6.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2023WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter.CVE-2023-2745 · WordPress plugins & themes · reported by WordfenceMedium 5.4
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcore.trac.wordpress.orgwordpress.org
May 15, 2023Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform SCVE-2023-2009 · WordPress plugins & themes · reported by WPScanMedium 4.8
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pretty Url
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerabiliCVE-2023-1207 · WordPress plugins & themes · reported by WPScanHigh 7.2
This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerability.
- Fixed in
- 1.18.8
- What to do
- Update the plugin to 1.18.8 or newer.
May 15, 2023Push Notifications for WordPress by PushAssist: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-0644 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Push Notifications for WordPress by PushAssist
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Push Notifications for WordPress by PushAssist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.CVE-2022-45846 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.
- Fixed in
- 5.6.9
- What to do
- Update the plugin to 5.6.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 10, 2023Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76: Cross-site scriptingCVE-2023-27918 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.
- Product
- Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76
- Fixed in
- 1.0.76
- What to do
- Update Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 to 1.0.76 or newer.
May 8, 2023The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password.CVE-2023-1979 · WordPress plugins & themes · reported by cve-coordination@google.comMedium 4.9
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68
- What to do
- Update the plugin to the newest version.
May 4, 2023A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress.CVE-2017-20183 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function print_media_new_panel of the file external-media-without-import.php. The manipulation of the argument url/error/width/height/mime-type leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The patch is identified as 9d2ecd159a6e2e3f710b4f1c28e2714f66502746. It is recommended to upgrade the affected component. VDB-227950 is the identifier assigned to this vulnerability.
- Product
- External Media without Import
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update External Media without Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2023The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow useCVE-2023-1196 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
- Fixed in
- 6.1.0
- What to do
- Update the plugin to 6.1.0 or newer.
May 2, 2023SEOPress: Unserializes user input provided via the settingsCVE-2023-1669 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- SEOPress
- Fixed in
- 6.5.0.3
- What to do
- Update SEOPress to 6.5.0.3 or newer.
May 1, 2023A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress.CVE-2014-125100 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2023A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress.CVE-2013-10026 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress. This issue affects some unknown processing of the file index.php. The manipulation of the argument sml_name/sml_email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.1 is able to address this issue. The identifier of the patch is 484970ef8285cae51d2de3bd4e4684d33c956c28. It is recommended to upgrade the affected component. The identifier VDB-227765 was assigned to this vulnerability.
- Product
- Mail Subscribe List
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update Mail Subscribe List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 30, 2023A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress.CVE-2015-10105 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function valid_js_identifier of the file ip_blacklist_cloud.php of the component CSV File Import. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. Upgrading to version 3.43 is able to address this issue. The identifier of the patch is 6e6fe8c6fda7cbc252eef083105e08d759c07312. It is recommended to upgrade the affected component. The identifier VDB-227757 was assigned to this vulnerability.
- Product
- IP Blacklist Cloud
- Affected
- up to 3.42
- What to do
- Affects up to 3.42. Update IP Blacklist Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 30, 2023A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress.CVE-2015-10104 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2023miniOrange WordPress Social Login and Register: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23710 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
- Product
- miniOrange WordPress Social Login and Register
- Fixed in
- 7.6.0
- What to do
- Update miniOrange WordPress Social Login and Register to 7.6.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2023Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro: Does not sanitise and escape a parameter before outputting it back in a response of an AJAX actionCVE-2023-1420 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro
- Fixed in
- 4.11.1
- What to do
- Update Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro to 4.11.1 or newer.
Apr 24, 2023A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress.CVE-2012-10014 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function backend_localization_admin_settings/backend_localization_save_setting/backend_localization_login_form/localize_backend of the file backend_localization.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 36f457ee16dd114e510fd91a3ea9fbb3c1f87184. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227232.
- Fixed in
- 2.0.1
- What to do
- Update the plugin to 2.0.1 or newer.
Apr 24, 2023A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress.CVE-2012-10013 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the file backend_localization.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is named 43dc96defd7944da12ff116476a6890acd7dd24b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227231.
- Product
- Kau-Boy Backend Localization
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Kau-Boy Backend Localization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.CVE-2022-45074 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 20, 2023Form block is a wordpress plugin designed to make form creation easier.CVE-2023-30616 · WordPress plugins & themes · reported by GitHubMedium 6.5
Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery due to a missing nonce check. There is potential for a Cross Site Request Forgery for all form blocks, since it allows to send requests to the forms from any website without a user noticing. Users are advised to upgrade to version 1.0.2. There are no known workarounds for this vulnerability.
- Fixed in
- 1.0.2
- What to do
- Update the plugin to 1.0.2 or newer.
Apr 20, 2023A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical.CVE-2014-125099 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.
- Product
- I Recommend This
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update I Recommend This to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 19, 2023TaxoPress: Stored Cross-Site ScriptingCVE-2023-2170 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TaxoPress
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update TaxoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 19, 2023TaxoPress: Stored Cross-Site ScriptingCVE-2023-2169 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TaxoPress
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update TaxoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 19, 2023TaxoPress: Stored Cross-Site ScriptingCVE-2023-2168 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- TaxoPress
- Affected
- up to 3.6.4
- What to do
- Affects up to 3.6.4. Update TaxoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2023A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress.CVE-2015-10102 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to open redirect. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 2aaecd4e0c7c6c1dc4e6a593163d5f7aa0fa5d5b. It is recommended to upgrade the affected component. VDB-226118 is the identifier assigned to this vulnerability.
- Affected
- 1.7 to 1.7
- What to do
- Affects 1.7 to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2023The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2023-1473 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 3.29.1
- What to do
- Update the plugin to 3.29.1 or newer.
Apr 17, 2023- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege usersCVE-2023-1427 · WordPress plugins & themes · reported by WPScanMedium 4.9
- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.
- Fixed in
- 1.8.15
- What to do
- Update the plugin to 1.8.15 or newer.
Apr 17, 2023Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard: And Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5CVE-2023-1282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
- Product
- Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard
- Fixed in
- 2.11.1
- What to do
- Update Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard to 2.11.1 or newer.
Apr 17, 2023Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updCVE-2023-0889 · WordPress plugins & themes · reported by WPScanMedium 6.5
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
- Fixed in
- 2.0.1
- What to do
- Update the plugin to 2.0.1 or newer.
Apr 15, 2023A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress.CVE-2015-10101 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
- Product
- Google Analytics Top Content Widget
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Google Analytics Top Content Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 12, 2023An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated usCVE-2023-28121 · WordPress plugins & themes · reported by support@hackerone.comCritical 9.8
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddeveloper.woocommerce.comrcesecurity.com
Apr 10, 2023A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress.CVE-2015-10100 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.
- Product
- Dynamic Widgets
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update Dynamic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 10, 2023WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Fixed in
- 2.7.9.4
- What to do
- Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to 2.7.9.4 or newer.
Apr 10, 2023WordPress Amazon S3: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0423 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WordPress Amazon S3
- Fixed in
- 1.6
- What to do
- Update WordPress Amazon S3 to 1.6 or newer.
Apr 10, 2023A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress.CVE-2015-10099 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.
- Product
- CP Appointment Calendar
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update CP Appointment Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2023A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress.CVE-2014-125096 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file class.options.php of the component Options Page. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.13 is able to address this issue. The identifier of the patch is fdf1f9e5a1ec738900f962e69c6fa4ec6055ed8d. It is recommended to upgrade the affected component. The identifier VDB-225349 was assigned to this vulnerability.
- Fixed in
- 1.5.13
- What to do
- Update the plugin to 1.5.13 or newer.
Apr 9, 2023A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress.CVE-2012-10011 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the function hd_add_media/hd_update_media of the file functions.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 34d66b9f3231a0e2dc0e536a6fe615d736e863f7. It is recommended to upgrade the affected component. VDB-225350 is the identifier assigned to this vulnerability.
- Product
- HD FLV PLayer
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update HD FLV PLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2023A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic.CVE-2014-125095 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
- Affected
- 1.3.4 to 1.3.4
- What to do
- Affects 1.3.4 to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic.CVE-2013-10025 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this issue is the function exitpageadmin of the file exitpage.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.59 is able to address this issue. The patch is identified as d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. VDB-225266 is the identifier assigned to this vulnerability.
- Affected
- 1.55 to 1.55
- What to do
- Affects 1.55 to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic.CVE-2013-10024 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the file exitpage.php. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.59 is able to address this issue. The identifier of the patch is d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. The identifier VDB-225265 was assigned to this vulnerability.
- Affected
- 1.55 to 1.55
- What to do
- Affects 1.55 to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress.CVE-2015-10098 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue is the function print_module_list/show_warnings_section_notice/status_text/ui_get_action_links. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10.6 is able to address this issue. The name of the patch is f30638869e281461b87548e40b517738b4350e47. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225152.
- Product
- Broken Link Checker
- Affected
- up to 1.10.5
- What to do
- Affects up to 1.10.5. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress.CVE-2013-10023 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerability is the function edcal_filter_where of the file edcal.php. The manipulation of the argument edcal_startDate/edcal_endDate leads to sql injection. The attack can be launched remotely. Upgrading to version 2.7 is able to address this issue. The patch is named a9277f13781187daee760b4dfd052b1b68e101cc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-225151.
- Product
- Editorial Calendar
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 5, 2023A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress.CVE-2013-10022 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
- Affected
- 3.51 to 3.51
- What to do
- Affects 3.51 to 3.51. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 30, 2023Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.CVE-2023-23677 · WordPress plugins & themes · reported by PatchstackLow 3.8
Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.
- Fixed in
- 0.4.6
- What to do
- Update the plugin to 0.4.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2023The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPreCVE-2023-1092 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
- Fixed in
- 6.24.2
- What to do
- Update the plugin to 6.24.2 or newer.
Mar 27, 2023Complianz WordPress plugin before 6.4.2, Complianz Premium: Do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1069 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Complianz WordPress plugin before 6.4.2, Complianz Premium
- Fixed in
- 6.4.2
- What to do
- Update Complianz WordPress plugin before 6.4.2, Complianz Premium to 6.4.2 or newer.
Mar 27, 2023The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through CVE-2020-36666 · WordPress plugins & themes · reported by WPScanHigh 8.8
The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
- Product
- directory-pro
- Fixed in
- 1.9.5
- What to do
- Update directory-pro to 1.9.5 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Mar 27, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.CVE-2022-30705 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.
- Fixed in
- 2.35.1.3.0
- What to do
- Update the plugin to 2.35.1.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.