Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,764 results · page 53 of 116
May 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.CVE-2023-24414 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.11 versions.
- Affected
- up to 3.2.11
- What to do
- Affects up to 3.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in LJ Apps WP Airbnb Review Slider plugin <= 3.2 versions.CVE-2023-23890 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in LJ Apps WP Airbnb Review Slider plugin <= 3.2 versions.
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.CVE-2023-22689 · WordPress plugins & themes · reported by PatchstackMedium 4.6
Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.
- Affected
- up to 6.3
- What to do
- Affects up to 6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.CVE-2022-47134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Mass Delete Unused Tags plugin <= 2.0.0 versions.CVE-2023-27430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Mass Delete Unused Tags plugin <= 2.0.0 versions.
- Fixed in
- 3.0.0
- What to do
- Update the plugin to 3.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Auto Prune Posts plugin <= 1.8.0 versions.CVE-2023-27423 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Auto Prune Posts plugin <= 1.8.0 versions.
- Fixed in
- 2.0.0
- What to do
- Update the plugin to 2.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.CVE-2023-25698 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Studio Wombat Shoppable Images plugin <= 1.2.3 versions.
- Fixed in
- 1.2.4
- What to do
- Update the plugin to 1.2.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 16, 2023OTP Login Woocommerce & Gravity Forms: Authentication bypassCVE-2023-2706 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
- Product
- OTP Login Woocommerce & Gravity Forms
- Fixed in
- 2.3
- What to do
- Update OTP Login Woocommerce & Gravity Forms to 2.3 or newer.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
May 15, 2023Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform SCVE-2023-2009 · WordPress plugins & themes · reported by WPScanMedium 4.8
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pretty Url
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerabiliCVE-2023-1207 · WordPress plugins & themes · reported by WPScanHigh 7.2
This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL Injection vulnerability.
- Fixed in
- 1.18.8
- What to do
- Update the plugin to 1.18.8 or newer.
May 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.CVE-2022-45846 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.
- Fixed in
- 5.6.9
- What to do
- Update the plugin to 5.6.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 8, 2023The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password.CVE-2023-1979 · WordPress plugins & themes · reported by cve-coordination@google.comMedium 4.9
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68
- What to do
- Update the plugin to the newest version.
May 8, 2023Avirato hotels online booking engine: Does not validate and escape some of its shortcode attributes before using them in SQL statement/sCVE-2023-0768 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
- Product
- Avirato hotels online booking engine
- Affected
- up to 5.0.5
- What to do
- Affects up to 5.0.5. Update Avirato hotels online booking engine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023WP Login Box: Does not sanitise and escape some of its settingsCVE-2023-0544 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Login Box
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update WP Login Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 8, 2023Enable/Disable Auto Login when Register: Does not have CSRF check in placeCVE-2023-0522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Enable/Disable Auto Login when Register
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Enable/Disable Auto Login when Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 4, 2023A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress.CVE-2017-20183 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function print_media_new_panel of the file external-media-without-import.php. The manipulation of the argument url/error/width/height/mime-type leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The patch is identified as 9d2ecd159a6e2e3f710b4f1c28e2714f66502746. It is recommended to upgrade the affected component. VDB-227950 is the identifier assigned to this vulnerability.
- Product
- External Media without Import
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update External Media without Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions.CVE-2023-25967 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions.
- Fixed in
- 6.0.3.0
- What to do
- Update the plugin to 6.0.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.CVE-2023-23790 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.
- Fixed in
- 2.9.11
- What to do
- Update the plugin to 2.9.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.CVE-2023-22691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2023The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow useCVE-2023-1196 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
- Fixed in
- 6.1.0
- What to do
- Update the plugin to 6.1.0 or newer.
May 2, 2023Limit Login Attempts: Does not sanitize and escape usernamesCVE-2023-1861 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
- Product
- Limit Login Attempts
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2023A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress.CVE-2014-125100 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2023A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress.CVE-2013-10026 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress. This issue affects some unknown processing of the file index.php. The manipulation of the argument sml_name/sml_email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.1 is able to address this issue. The identifier of the patch is 484970ef8285cae51d2de3bd4e4684d33c956c28. It is recommended to upgrade the affected component. The identifier VDB-227765 was assigned to this vulnerability.
- Product
- Mail Subscribe List
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update Mail Subscribe List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 30, 2023A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress.CVE-2015-10105 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function valid_js_identifier of the file ip_blacklist_cloud.php of the component CSV File Import. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. Upgrading to version 3.43 is able to address this issue. The identifier of the patch is 6e6fe8c6fda7cbc252eef083105e08d759c07312. It is recommended to upgrade the affected component. The identifier VDB-227757 was assigned to this vulnerability.
- Product
- IP Blacklist Cloud
- Affected
- up to 3.42
- What to do
- Affects up to 3.42. Update IP Blacklist Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 30, 2023A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress.CVE-2015-10104 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2023miniOrange WordPress Social Login and Register: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23710 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
- Product
- miniOrange WordPress Social Login and Register
- Fixed in
- 7.6.0
- What to do
- Update miniOrange WordPress Social Login and Register to 7.6.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.CVE-2023-27619 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.CVE-2022-45837 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2023Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro: Does not sanitise and escape a parameter before outputting it back in a response of an AJAX actionCVE-2023-1420 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro
- Fixed in
- 4.11.1
- What to do
- Update Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro to 4.11.1 or newer.
Apr 24, 2023A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress.CVE-2012-10014 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in Kau-Boy Backend Localization Plugin 2.0 on WordPress. Affected is the function backend_localization_admin_settings/backend_localization_save_setting/backend_localization_login_form/localize_backend of the file backend_localization.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 36f457ee16dd114e510fd91a3ea9fbb3c1f87184. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227232.
- Fixed in
- 2.0.1
- What to do
- Update the plugin to 2.0.1 or newer.
Apr 24, 2023A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress.CVE-2012-10013 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Kau-Boy Backend Localization Plugin up to 1.6.1 on WordPress. It has been rated as problematic. This issue affects some unknown processing of the file backend_localization.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.0 is able to address this issue. The patch is named 43dc96defd7944da12ff116476a6890acd7dd24b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227231.
- Product
- Kau-Boy Backend Localization
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Kau-Boy Backend Localization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions.CVE-2023-23879 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions.
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.CVE-2023-22686 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.CVE-2022-45080 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.CVE-2022-45074 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <= 2.0.0 versions.CVE-2023-24404 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <= 2.0.0 versions.
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions.CVE-2023-22718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions.
- Fixed in
- 3.5.0
- What to do
- Update the plugin to 3.5.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 20, 2023Form block is a wordpress plugin designed to make form creation easier.CVE-2023-30616 · WordPress plugins & themes · reported by GitHubMedium 6.5
Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery due to a missing nonce check. There is potential for a Cross Site Request Forgery for all form blocks, since it allows to send requests to the forms from any website without a user noticing. Users are advised to upgrade to version 1.0.2. There are no known workarounds for this vulnerability.
- Fixed in
- 1.0.2
- What to do
- Update the plugin to 1.0.2 or newer.
Apr 20, 2023A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical.CVE-2014-125099 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.
- Product
- I Recommend This
- Affected
- up to 3.7.2
- What to do
- Affects up to 3.7.2. Update I Recommend This to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2023A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress.CVE-2015-10102 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to open redirect. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 2aaecd4e0c7c6c1dc4e6a593163d5f7aa0fa5d5b. It is recommended to upgrade the affected component. VDB-226118 is the identifier assigned to this vulnerability.
- Affected
- 1.7 to 1.7
- What to do
- Affects 1.7 to 1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 17, 2023The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2023-1473 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin 3.29.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 3.29.1
- What to do
- Update the plugin to 3.29.1 or newer.
Apr 17, 2023- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege usersCVE-2023-1427 · WordPress plugins & themes · reported by WPScanMedium 4.9
- The Photo Gallery by 10Web WordPress plugin before 1.8.15 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images anywhere in the filesystem via a path traversal vector.
- Fixed in
- 1.8.15
- What to do
- Update the plugin to 1.8.15 or newer.
Apr 17, 2023Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard: And Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5CVE-2023-1282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload PRO - Contact Form 7 with Remote Storage Integrations WordPress plugin before 5.0.6.4 do not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
- Product
- Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard
- Fixed in
- 2.11.1
- What to do
- Update Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard to 2.11.1 or newer.
Apr 17, 2023Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updCVE-2023-0889 · WordPress plugins & themes · reported by WPScanMedium 6.5
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
- Fixed in
- 2.0.1
- What to do
- Update the plugin to 2.0.1 or newer.
Apr 16, 2023Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.CVE-2023-22687 · WordPress plugins & themes · reported by PatchstackLow 3.7
Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.
- Affected
- up to 1.9.4.0
- What to do
- Affects up to 1.9.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions.CVE-2023-30474 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions.
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 15, 2023A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress.CVE-2015-10101 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Google Analytics Top Content Widget Plugin up to 1.5.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file class-tgm-plugin-activation.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.7 is able to address this issue. The identifier of the patch is 25bb1dea113716200a6f0f3135801d84a7a65540. It is recommended to upgrade the affected component. The identifier VDB-226117 was assigned to this vulnerability.
- Product
- Google Analytics Top Content Widget
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update Google Analytics Top Content Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2023ZM Ajax Login & Register: Authentication bypassCVE-2023-2027 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
- Product
- ZM Ajax Login & Register
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update ZM Ajax Login & Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 12, 2023An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated usCVE-2023-28121 · WordPress plugins & themes · reported by support@hackerone.comCritical 9.8
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recorddeveloper.woocommerce.comrcesecurity.com
Apr 10, 2023A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress.CVE-2015-10100 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.
- Product
- Dynamic Widgets
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update Dynamic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.