Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

578new WordPress flaws this week

391,397entries in the database

2,840 results · page 53 of 57

May 16, 2023OTP Login Woocommerce & Gravity Forms: Authentication bypassCVE-2023-2706 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
Product
OTP Login Woocommerce & Gravity Forms
Fixed in
2.3
What to do
Update OTP Login Woocommerce & Gravity Forms to 2.3 or newer.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
May 15, 2023WooCommerce Order Status Change Notifier: Does not have authorisation and CSRFCVE-2023-2179 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
Product
WooCommerce Order Status Change Notifier
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update WooCommerce Order Status Change Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some of its setting fieldsCVE-2023-1839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Product
Product Addons & Fields for WooCommerce
Fixed in
32.0.6
What to do
Update Product Addons & Fields for WooCommerce to 32.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Japanized For WooCommerce: Does not escape generated URLs before outputting them in attributesCVE-2023-0948 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
Product
Japanized For WooCommerce
Fixed in
2.5.8
What to do
Update Japanized For WooCommerce to 2.5.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Product Slider For WooCommerce Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0537 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Product Slider For WooCommerce Lite
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Product Slider For WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Cloud Manager: Does not sanitise and escape the query param ricerca before outputting it in an admin panelCVE-2023-0421 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.
Product
Cloud Manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update Cloud Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4118 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users
Product
Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 12, 2023An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated usCVE-2023-28121 · WordPress plugins & themes · reported by support@hackerone.comCritical 9.8
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record developer.woocommerce.com rcesecurity.com
Apr 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.CVE-2022-46793 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.
Fixed in
12.4.5
What to do
Update the plugin to 12.4.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 3, 2023Shopping Cart & eCommerce Store: Does not validate HTTP requestsCVE-2023-1124 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.
Product
Shopping Cart & eCommerce Store
Fixed in
5.4.3
What to do
Update Shopping Cart & eCommerce Store to 5.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Free WooCommerce Theme 99fy Extension: Does not have CSRF checkCVE-2023-0503 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Product
Free WooCommerce Theme 99fy Extension
Fixed in
1.2.8
What to do
Update Free WooCommerce Theme 99fy Extension to 1.2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 23, 2023MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6: Auth. (admin+) Stored Cross-site Scripting (XSS)CVE-2023-28422 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.
Product
MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6
Fixed in
3.8.7
What to do
Update MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6 to 3.8.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023WooCommerce Multiple Customer Addresses & Shipping: Does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the requestCVE-2023-0865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.
Product
WooCommerce Multiple Customer Addresses & Shipping
Fixed in
21.7
What to do
Update WooCommerce Multiple Customer Addresses & Shipping to 21.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 17, 2023eCommerce Product Catalog: Stored Cross-Site ScriptingCVE-2023-1470 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
eCommerce Product Catalog
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <= 2.4CVE-2022-47154 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <= 2.4.49 versions.
Affected
up to 2.4.49
What to do
Affects up to 2.4.49. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2023Widgets for WooCommerce Products on Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4661 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Widgets for WooCommerce Products on Elementor
Fixed in
1.0.8
What to do
Update Widgets for WooCommerce Products on Elementor to 1.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Product GTIN (EAN, UPC, ISBN) for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0068 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Product GTIN (EAN, UPC, ISBN) for WooCommerce
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Product GTIN (EAN, UPC, ISBN) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023WooCommerce Checkout Field Manager: Does not validate files to be uploadedCVE-2022-4328 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
Product
WooCommerce Checkout Field Manager
Fixed in
18.0
What to do
Update WooCommerce Checkout Field Manager to 18.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.CVE-2022-47148 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.
Fixed in
3.2.6
What to do
Update the plugin to 3.2.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification.CVE-2022-46806 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification.
Fixed in
1.1.11
What to do
Update the plugin to 1.1.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactivatCVE-2022-46805 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactivation of plugin rulesets.
Fixed in
2.3.2
What to do
Update the plugin to 2.3.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leadsCVE-2022-46797 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leads to plugin settings change.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.CVE-2022-45068 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.
Fixed in
6.4.0
What to do
Update the plugin to 6.4.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change.CVE-2022-40198 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change.
Affected
up to 1.3.24
What to do
Affects up to 1.3.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.CVE-2023-23865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.
Fixed in
1.4.11
What to do
Update the plugin to 1.4.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 21, 2023Japanized For WooCommerce: Reflected Cross-Site ScriptingCVE-2023-0942 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Japanized For WooCommerce
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Japanized For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 21, 2023GS Products Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0492 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
GS Products Slider for WooCommerce
Fixed in
1.5.9
What to do
Update GS Products Slider for WooCommerce to 1.5.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Product Slider and Carousel with Category for WooCommerce: Does not validate and escape one of its shortcode attributesCVE-2022-4791 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
Product Slider and Carousel with Category for WooCommerce
Fixed in
2.8
What to do
Update Product Slider and Carousel with Category for WooCommerce to 2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.CVE-2023-24377 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart plugin <= 6.11.3 versions.
Affected
up to 6.11.3
What to do
Affects up to 6.11.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 13, 2023GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training: Does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary postsCVE-2023-0405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.
Product
GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training
Fixed in
1.4.38
What to do
Update GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training to 1.4.38 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Product Slider for WooCommerce by PickPlugins: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0166 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Product Slider for WooCommerce by PickPlugins
Fixed in
1.13.42
What to do
Update Product Slider for WooCommerce by PickPlugins to 1.13.42 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Customer Reviews for WooCommerce: Does not validate one of its shortcode attributeCVE-2023-0080 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
Product
Customer Reviews for WooCommerce
Fixed in
5.16.0
What to do
Update Customer Reviews for WooCommerce to 5.16.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Judge.me Product Reviews for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0061 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Judge.me Product Reviews for WooCommerce
Fixed in
1.3.21
What to do
Update Judge.me Product Reviews for WooCommerce to 1.3.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Event Manager and Tickets Selling Plugin for WooCommerce: Does not validate and escape some of its post meta before outputting them back in a page/postCVE-2023-0144 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Event Manager and Tickets Selling Plugin for WooCommerce
Fixed in
3.8.0
What to do
Update Event Manager and Tickets Selling Plugin for WooCommerce to 3.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023EAN for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0062 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
EAN for WooCommerce
Fixed in
4.4.3
What to do
Update EAN for WooCommerce to 4.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 2, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions.CVE-2022-46815 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions.
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 2, 2023Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions.CVE-2022-36401 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions.
Fixed in
1.4.0
What to do
Update the plugin to 1.4.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 30, 2023Membership For WooCommerce: Does not validate uploaded filesCVE-2022-4395 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE.
Product
Membership For WooCommerce
Fixed in
2.1.7
What to do
Update Membership For WooCommerce to 2.1.7 or newer.
Full record and what to do →NVD record wpscan.com packetstormsecurity.com
Jan 23, 2023Product Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4629 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Product Slider for WooCommerce
Fixed in
2.6.4
What to do
Update Product Slider for WooCommerce to 2.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress pCVE-2022-4017 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places, allowing attackers to make logged in users perform unwanted actions via CSRF attacks
Fixed in
6.0.1
What to do
Update the plugin to 6.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Welcart e-Commerce: Does not validate and escapes one of its shortcode attributesCVE-2022-4655 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
Product
Welcart e-Commerce
Fixed in
2.8.9
What to do
Update Welcart e-Commerce to 2.8.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Conditional Payment Methods for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4547 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin.
Product
Conditional Payment Methods for WooCommerce
Affected
up to 1.0
What to do
Affects up to 1.0. Update Conditional Payment Methods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jan 9, 2023Mautic Integration for WooCommerce: Does not have proper CSRF checkCVE-2022-4426 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.
Product
Mautic Integration for WooCommerce
Fixed in
1.0.3
What to do
Update Mautic Integration for WooCommerce to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 9, 2023ActiveCampaign for WooCommerce: Does not have authorisation checkCVE-2022-3923 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs.
Product
ActiveCampaign for WooCommerce
Fixed in
1.9.8
What to do
Update ActiveCampaign for WooCommerce to 1.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Product list Widget for Woocommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4329 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).
Product
Product list Widget for Woocommerce
Affected
up to 1.0
What to do
Affects up to 1.0. Update Product list Widget for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated usersCVE-2022-4237 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
Product
Welcart e-Commerce
Fixed in
2.8.6
What to do
Update Welcart e-Commerce to 2.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated usersCVE-2022-4236 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
Product
Welcart e-Commerce
Fixed in
2.8.5
What to do
Update Welcart e-Commerce to 2.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a fileCVE-2022-4140 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
Product
Welcart e-Commerce
Fixed in
2.8.5
What to do
Update Welcart e-Commerce to 2.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Wholesale Market for WooCommerce: Does not validate user input against path traversal attacksCVE-2022-4109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite)
Product
Wholesale Market for WooCommerce
Fixed in
2.0.0
What to do
Update Wholesale Market for WooCommerce to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Visual Email Designer for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3860 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author.
Product
Visual Email Designer for WooCommerce
Fixed in
1.7.2
What to do
Update Visual Email Designer for WooCommerce to 1.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.