Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,187 results · page 52 of 64
Jun 8, 2022Note Press: Does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboardCVE-2022-1688 · WordPress plugins & themes · reported by WPScanLow 2.7
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections
- Product
- Note Press
- Affected
- up to 0.1.10
- What to do
- Affects up to 0.1.10. Update Note Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Logo Slider: Does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin pageCVE-2022-1687 · WordPress plugins & themes · reported by WPScanLow 2.7
The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection
- Product
- Logo Slider
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Logo Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Five Minute Webshop: Does not sanitise and escape the id parameter before using it in a SQL statementCVE-2022-1686 · WordPress plugins & themes · reported by WPScanLow 2.7
The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection
- Product
- Five Minute Webshop
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Cube Slider: Does not sanitise and escape the idslider parameter before using it in various SQL queriesCVE-2022-1684 · WordPress plugins & themes · reported by WPScanLow 2.7
The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin
- Product
- Cube Slider
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Cube Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022amtyThumb: Does not sanitise and escape a parameter before using it in a SQL statement via its shortcodeCVE-2022-1683 · WordPress plugins & themes · reported by WPScanHigh 8.8
The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user (and not just Author+ like the original advisory mention) due to the fact that they can execute shortcodes via an AJAX action
- Product
- amtyThumb
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update amtyThumb to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022WooCommerce Green Wallet Gateway: Does not escape the error_envision query parameter before outputting it to the pageCVE-2022-1673 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability.
- Product
- WooCommerce Green Wallet Gateway
- Fixed in
- 1.0.2
- What to do
- Update WooCommerce Green Wallet Gateway to 1.0.2 or newer.
Jun 8, 2022FormCraft: Does not sanitise and escape Field LabelsCVE-2022-1647 · WordPress plugins & themes · reported by WPScanMedium 4.8
The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- FormCraft
- Fixed in
- 1.2.6
- What to do
- Update FormCraft to 1.2.6 or newer.
Jun 8, 2022The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form CVE-2022-1597 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks
- Product
- WPQA Builder
- Fixed in
- 5.4
- What to do
- Update WPQA Builder to 5.4 or newer.
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
Jun 8, 2022Video Slider: Does not sanitize or escape some of its video settingsCVE-2022-1541 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Video Slider
- Fixed in
- 1.4.8
- What to do
- Update Video Slider to 1.4.8 or newer.
Jun 8, 2022WP Born Babies: Does not sanitise and escape some of its fieldsCVE-2022-1506 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- WP Born Babies
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Born Babies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2022FiboSearch: Does not sanitise and escape some of its settingsCVE-2022-1469 · WordPress plugins & themes · reported by WPScanMedium 4.8
The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- FiboSearch
- Fixed in
- 1.17.0
- What to do
- Update FiboSearch to 1.17.0 or newer.
Jun 8, 2022Photo Gallery by 10Web: Does not properly validate and escape some of its settingsCVE-2022-1394 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.4
- What to do
- Update Photo Gallery by 10Web to 1.6.4 or newer.
Jun 8, 2022Ask me: Does not properly sanitise and escape several of the fields in the Edit Profile pageCVE-2022-1241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues
- Product
- Ask me
- Fixed in
- 6.8.2
- What to do
- Update Ask me to 6.8.2 or newer.
Jun 8, 2022WP Fundraising Donation and Crowdfunding Platform: Does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST routeCVE-2022-0788 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users
- Product
- WP Fundraising Donation and Crowdfunding Platform
- Fixed in
- 1.5.0
- What to do
- Update WP Fundraising Donation and Crowdfunding Platform to 1.5.0 or newer.
May 30, 2022Simple Real Estate Pack: Does not sanitise and escape some of its settingsCVE-2022-1646 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Simple Real Estate Pack
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Simple Real Estate Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Amazon Link: Does not sanitise and escape some of its settingsCVE-2022-1645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Amazon Link WordPress plugin through 3.2.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Amazon Link
- Affected
- up to 3.2.10
- What to do
- Affects up to 3.2.10. Update Amazon Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Call&Book Mobile Bar: Does not sanitize and escape some of its settingsCVE-2022-1644 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Call&Book Mobile Bar
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Call&Book Mobile Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Birthdays Widget: Does not sanitise and escape some of its fieldsCVE-2022-1643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Birthdays Widget
- Affected
- up to 1.7.18
- What to do
- Affects up to 1.7.18. Update Birthdays Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022External Links in New Window / New Tab: Does not properly escape URLs it concatenates to onclick event handlersCVE-2022-1582 · WordPress plugins & themes · reported by WPScanMedium 6.1
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
- Product
- External Links in New Window / New Tab
- Fixed in
- 1.43
- What to do
- Update External Links in New Window / New Tab to 1.43 or newer.
May 30, 2022Team Members: Does not escape some of its Team settingsCVE-2022-1568 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Team Members
- Fixed in
- 5.1.1
- What to do
- Update Team Members to 5.1.1 or newer.
May 30, 2022Quotes llama: Does not sanitise and escape QuotesCVE-2022-1566 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file
- Product
- Quotes llama
- Fixed in
- 1.0.0
- What to do
- Update Quotes llama to 1.0.0 or newer.
May 30, 2022Form Maker by 10Web: Does not sanitize and escape the Custom Text settingsCVE-2022-1564 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Form Maker by 10Web
- Fixed in
- 1.14.12
- What to do
- Update Form Maker by 10Web to 1.14.12 or newer.
May 30, 2022StaffList: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-1556 · WordPress plugins & themes · reported by WPScanCritical 9.8
The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection
- Product
- StaffList
- Fixed in
- 3.1.5
- What to do
- Update StaffList to 3.1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2022HPB Dashboard: Does not sanitise and escape some of its settingsCVE-2022-1542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- HPB Dashboard
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update HPB Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022VikBooking Hotel Booking Engine & PMS: Does not escape the current URL before putting it back in a JavaScript contextCVE-2022-1528 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.9
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.9 or newer.
May 30, 2022WP 2FA: Does not sanitise and escape a parameter before outputting it back in an admin pageCVE-2022-1527 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- WP 2FA
- Fixed in
- 2.2.1
- What to do
- Update WP 2FA to 2.2.1 or newer.
May 30, 2022Poll Maker: Does not sanitise and escape some settingsCVE-2022-1456 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfiltered_html is disallowed
- Product
- Poll Maker
- Fixed in
- 4.0.2
- What to do
- Update Poll Maker to 4.0.2 or newer.
May 30, 2022Easy FAQ with Expanding Text: Does not sanitise and escape its settingsCVE-2022-1395 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Easy FAQ with Expanding Text
- Affected
- up to 3.2.8.3.1
- What to do
- Affects up to 3.2.8.3.1. Update Easy FAQ with Expanding Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022No Future Posts: Does not escape its settingsCVE-2022-1387 · WordPress plugins & themes · reported by WPScanMedium 4.8
The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- No Future Posts
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update No Future Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Slideshow: Does not sanitize and escape some of its default slideshow settingsCVE-2022-1299 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Slideshow
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022IMDB info box: Does not sanitize and escape some of its settingsCVE-2022-1294 · WordPress plugins & themes · reported by WPScanMedium 4.8
The IMDB info box WordPress plugin through 2.0 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- IMDB info box
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update IMDB info box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022BannerMan: Does not sanitize or escape its settingsCVE-2022-1275 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed (such as in multisite)
- Product
- BannerMan
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update BannerMan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Smush: Does not sanitise and escape a configuration parameter before outputting it back in an admin pageCVE-2022-1009 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
- Product
- Smush
- Fixed in
- 3.9.9
- What to do
- Update Smush to 3.9.9 or newer.
May 30, 2022User Meta: Does not sanitise and escape the Form NameCVE-2022-0376 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- User Meta
- Fixed in
- 2.4.3
- What to do
- Update User Meta to 2.4.3 or newer.
May 23, 2022Curtain: Does not sanitise and escape some of its settingsCVE-2022-1558 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Curtain
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Curtain to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 23, 2022Check & Log Email: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1547 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Check & Log Email
- Fixed in
- 1.0.6
- What to do
- Update Check & Log Email to 1.0.6 or newer.
May 23, 2022Sliderby10Web: Does not properly sanitize and escape some of its settingsCVE-2022-1320 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Sliderby10Web
- Fixed in
- 1.2.52
- What to do
- Update Sliderby10Web to 1.2.52 or newer.
May 23, 2022Tabs: Does not sanitise and escape Tab descriptionsCVE-2022-1298 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Tabs
- Fixed in
- 2.2.8
- What to do
- Update Tabs to 2.2.8 or newer.
May 23, 2022Donate Extra: Does not sanitise and escape a parameter before outputting it back in the responseCVE-2022-1268 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Donate Extra WordPress plugin through 2.02 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected cross-Site Scripting
- Product
- Donate Extra
- Affected
- up to 2.02
- What to do
- Affects up to 2.02. Update Donate Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Gwyn's Imagemap Selector: Does not sanitise and escape some parameters before outputting them back in attributesCVE-2022-1221 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting.
- Product
- Gwyn's Imagemap Selector
- Affected
- up to 0.3.3
- What to do
- Affects up to 0.3.3. Update Gwyn's Imagemap Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Domain Replace: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1218 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Domain Replace
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update Domain Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Turn off all comments: Does not sanitise and escape the rows parameter before outputting it back in an admin pageCVE-2022-1192 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Turn off all comments
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Turn off all comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022WP Meta SEO: Does not sanitise or escape the breadcrumb separator before outputting it to the pageCVE-2022-1093 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed.
- Product
- WP Meta SEO
- Fixed in
- 4.4.7
- What to do
- Update WP Meta SEO to 4.4.7 or newer.
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
- Product
- Nirweb support
- Fixed in
- 2.8.2
- What to do
- Update Nirweb support to 2.8.2 or newer.
May 16, 2022Clipr: Does not sanitise and escape its API Key settings before outputting it in an attributeCVE-2022-1559 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
- Product
- Clipr
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Clipr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022ScrollReveal.js Effects: Does not sanitise and escape its settingsCVE-2022-1512 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- ScrollReveal.js Effects
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update ScrollReveal.js Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX actionCVE-2022-1465 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.
- Product
- WPC Smart Wishlist for WooCommerce
- Fixed in
- 2.9.9
- What to do
- Update WPC Smart Wishlist for WooCommerce to 2.9.9 or newer.
May 16, 2022Call Now Button: Does not escape a parameter before outputting it back in an attribute of a hidden inputCVE-2022-1455 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled
- Product
- Call Now Button
- Fixed in
- 1.1.2
- What to do
- Update Call Now Button to 1.1.2 or newer.
May 16, 2022WPCargo Track & Trace: Does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the pageCVE-2022-1436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.