Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,764 results · page 54 of 116
Apr 10, 2023JetEngine: Includes uploaded files without adequately ensuring that they are not executableCVE-2023-1406 · WordPress plugins & themes · reported by WPScanHigh 8.8
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability.
- Product
- JetEngine
- Fixed in
- 3.1.3.1
- What to do
- Update JetEngine to 3.1.3.1 or newer.
Apr 10, 2023All-In-One Security (AIOS): Does not escape the content of log files before outputting it to the plugin admin pageCVE-2023-0157 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
- Product
- All-In-One Security (AIOS)
- Fixed in
- 5.1.5
- What to do
- Update All-In-One Security (AIOS) to 5.1.5 or newer.
Apr 10, 2023A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress.CVE-2015-10099 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.
- Product
- CP Appointment Calendar
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update CP Appointment Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2023A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress.CVE-2014-125096 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file class.options.php of the component Options Page. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.13 is able to address this issue. The identifier of the patch is fdf1f9e5a1ec738900f962e69c6fa4ec6055ed8d. It is recommended to upgrade the affected component. The identifier VDB-225349 was assigned to this vulnerability.
- Fixed in
- 1.5.13
- What to do
- Update the plugin to 1.5.13 or newer.
Apr 9, 2023A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress.CVE-2012-10011 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the function hd_add_media/hd_update_media of the file functions.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 34d66b9f3231a0e2dc0e536a6fe615d736e863f7. It is recommended to upgrade the affected component. VDB-225350 is the identifier assigned to this vulnerability.
- Product
- HD FLV PLayer
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update HD FLV PLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2023A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic.CVE-2014-125095 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
- Affected
- 1.3.4 to 1.3.4
- What to do
- Affects 1.3.4 to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic.CVE-2013-10025 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this issue is the function exitpageadmin of the file exitpage.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.59 is able to address this issue. The patch is identified as d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. VDB-225266 is the identifier assigned to this vulnerability.
- Affected
- 1.55 to 1.55
- What to do
- Affects 1.55 to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic.CVE-2013-10024 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the file exitpage.php. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.59 is able to address this issue. The identifier of the patch is d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. The identifier VDB-225265 was assigned to this vulnerability.
- Affected
- 1.55 to 1.55
- What to do
- Affects 1.55 to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress.CVE-2015-10098 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue is the function print_module_list/show_warnings_section_notice/status_text/ui_get_action_links. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10.6 is able to address this issue. The name of the patch is f30638869e281461b87548e40b517738b4350e47. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225152.
- Product
- Broken Link Checker
- Affected
- up to 1.10.5
- What to do
- Affects up to 1.10.5. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2023A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress.CVE-2013-10023 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerability is the function edcal_filter_where of the file edcal.php. The manipulation of the argument edcal_startDate/edcal_endDate leads to sql injection. The attack can be launched remotely. Upgrading to version 2.7 is able to address this issue. The patch is named a9277f13781187daee760b4dfd052b1b68e101cc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-225151.
- Product
- Editorial Calendar
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 7, 2023Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions.CVE-2023-25716 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 6, 2023Limit Login Attempts: Stored Cross-Site ScriptingCVE-2023-1912 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page. This only works when the plugin prioritizes use of the X-FORWARDED-FOR header, which can be configured in its settings.
- Product
- Limit Login Attempts
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgpluginvulnerabilities.com
Apr 6, 2023OceanWP Ocean Extra plugin <= 2.1.1 versions: Auth. (contributor+) Stored Cross-Site Scripting (XSS)CVE-2023-23891 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated.
- Product
- OceanWP Ocean Extra plugin <= 2.1.1 versions
- Fixed in
- 2.1.2
- What to do
- Update OceanWP Ocean Extra plugin <= 2.1.1 versions to 2.1.2 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions.CVE-2023-23801 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions.
- Fixed in
- 1.0.7
- What to do
- Update the plugin to 1.0.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.CVE-2022-46793 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.
- Fixed in
- 12.4.5
- What to do
- Update the plugin to 12.4.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 5, 2023A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress.CVE-2013-10022 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
- Affected
- 3.51 to 3.51
- What to do
- Affects 3.51 to 3.51. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versioCVE-2022-41633 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versions.
- Fixed in
- 6.0.3.0
- What to do
- Update the plugin to 6.0.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 30, 2023Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.CVE-2023-23677 · WordPress plugins & themes · reported by PatchstackLow 3.8
Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.
- Fixed in
- 0.4.6
- What to do
- Update the plugin to 0.4.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 29, 2023Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions.CVE-2023-23861 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions.
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 29, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin CVE-2022-38077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2023The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPreCVE-2023-1092 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
- Fixed in
- 6.24.2
- What to do
- Update the plugin to 6.24.2 or newer.
Mar 27, 2023WP Plugin Manager: Does not have CSRF checkCVE-2023-1088 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Plugin Manager
- Fixed in
- 1.1.8
- What to do
- Update WP Plugin Manager to 1.1.8 or newer.
Mar 27, 2023Complianz WordPress plugin before 6.4.2, Complianz Premium: Do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1069 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Complianz WordPress plugin before 6.4.2, Complianz Premium
- Fixed in
- 6.4.2
- What to do
- Update Complianz WordPress plugin before 6.4.2, Complianz Premium to 6.4.2 or newer.
Mar 27, 2023The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through CVE-2020-36666 · WordPress plugins & themes · reported by WPScanHigh 8.8
The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
- Product
- directory-pro
- Fixed in
- 1.9.5
- What to do
- Update directory-pro to 1.9.5 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Mar 27, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.CVE-2022-30705 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.
- Fixed in
- 2.35.1.3.0
- What to do
- Update the plugin to 2.35.1.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.CVE-2022-47145 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.
- Fixed in
- 3.5.8
- What to do
- Update the plugin to 3.5.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 23, 2023MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6: Auth. (admin+) Stored Cross-site Scripting (XSS)CVE-2023-28422 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.
- Product
- MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6
- Fixed in
- 3.8.7
- What to do
- Update MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6 to 3.8.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 8.1.8 versions.CVE-2023-22704 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 8.1.8 versions.
- Affected
- up to 8.1.8
- What to do
- Affects up to 8.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.CVE-2022-47431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.
- Fixed in
- 2.1.0
- What to do
- Update the plugin to 2.1.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 22, 2023The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue.CVE-2023-28667 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present.
- Affected
- up to 1.23
- What to do
- Affects up to 1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 22, 2023The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpCVE-2023-28666 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.
- Affected
- up to 2.1.4.1
- What to do
- Affects up to 2.1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 22, 2023The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the teCVE-2023-28665 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user.
- Fixed in
- 2.2.2
- What to do
- Update the plugin to 2.2.2 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 22, 2023The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' paramCVE-2023-28664 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 22, 2023The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_CVE-2023-28663 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action.
- Fixed in
- 3.11
- What to do
- Update the plugin to 3.11 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 22, 2023The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template paCVE-2023-28662 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 22, 2023The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_dCVE-2023-28661 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_data action.
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 22, 2023The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_rCVE-2023-28660 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action.
- Affected
- up to 2.3.14
- What to do
- Affects up to 2.3.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 22, 2023The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] paraCVE-2023-28659 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action.
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 20, 2023A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress.CVE-2012-10009 · WordPress plugins & themes · reported by VulDBHigh 7.3
A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage of the file 404Like.php. The manipulation of the argument searchWord leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 2c4b589d27554910ab1fd104ddbec9331b540f7f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223404.
- Product
- 404like
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update 404like to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not validate the user meta to be retrieved via the user shortcodeCVE-2023-0911 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
- Product
- WordPress Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 5.12.8
- What to do
- Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the requestCVE-2023-0890 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
- Product
- WordPress Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 5.12.8
- What to do
- Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Mar 20, 2023Responsive Clients Logo Gallery Plugin for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0175 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Clients Logo Gallery Plugin for
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Responsive Clients Logo Gallery Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.CVE-2022-47591 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions.CVE-2023-23721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions.
- Affected
- up to 1.50
- What to do
- Affects up to 1.50. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.CVE-2023-22682 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.
- Affected
- up to 1.4.0.1
- What to do
- Affects up to 1.4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.CVE-2023-22678 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions.CVE-2022-47592 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions.
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions.CVE-2023-22681 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Aarvanshinfotech Online Exam Software: eExamhall plugin <= 4.0 versions.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Chasil Universal Star Rating plugin <= 2.1.0 version.CVE-2022-46867 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Chasil Universal Star Rating plugin <= 2.1.0 version.
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Obox Themes Launchpad – Coming Soon & Maintenance Mode plugin <= 1.0.13 versions.CVE-2022-46854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Obox Themes Launchpad – Coming Soon & Maintenance Mode plugin <= 1.0.13 versions.
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.