Updated 54 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

428new WordPress flaws this week

399,168entries in the database

41,587 results · page 659 of 832

Nov 8, 2023Auth.CVE-2023-47226 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin <= 1.0.20 versions.
Affected
up to 1.0.20
What to do
Affects up to 1.0.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Auth.CVE-2023-47223 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <= 2.0 versions.
Affected
up to 2.0
What to do
Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Auth.CVE-2023-47190 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin <= 1.9.0 versions.
Affected
up to 1.9.0
What to do
Affects up to 1.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Auth.CVE-2023-47181 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson IdeaPush plugin <= 8.52 versions.
Affected
up to 8.52
What to do
Affects up to 8.52. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Unauth.CVE-2023-46643 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GARY JEZORSKI CloudNet360 plugin <= 3.2.0 versions.
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Auth.CVE-2023-46642 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin <= 1.2.2 versions.
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023D: Auth. (contributor+) Stored Cross-Site Scripting (XSS)CVE-2023-46640 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in D. Relton Medialist plugin <= 1.3.9 versions.
Product
D
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Unauth.CVE-2023-46627 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.
Affected
up to 2.1
What to do
Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Unauth.CVE-2023-46626 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FLOWFACT WP Connector plugin <= 2.1.7 versions.
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Unauth.CVE-2023-46621 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin <= 1.4.11 versions.
Affected
up to 1.4.11
What to do
Affects up to 1.4.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Auth.CVE-2023-46613 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jens Kuerschner Add to Calendar Button plugin <= 1.5.1 versions.
Fixed in
1.5.1
What to do
Update the plugin to 1.5.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 8, 2023Unauth.CVE-2023-32298 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kathy Darling Simple User Listing plugin <= 1.9.2 versions.
Affected
up to 1.9.2
What to do
Affects up to 1.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023UpdraftPlus: WordPress Backup & Migration: Cross-Site Request ForgeryCVE-2023-5982 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information.
Product
UpdraftPlus: WordPress Backup & Migration
Affected
up to 1.23.10
What to do
Affects up to 1.23.10. Update UpdraftPlus: WordPress Backup & Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2023Amazonify: Stored Cross-Site ScriptingCVE-2023-5819 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. However, please note that this can also be combined with CVE-2023-5818 for CSRF to XSS.
Product
Amazonify
Affected
up to 0.8.1
What to do
Affects up to 0.8.1. Update Amazonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Nov 7, 2023Amazonify: Cross-Site Request ForgeryCVE-2023-5818 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage() function. This makes it possible for unauthenticated attackers to update the plugins settings, including the Amazon Tracking ID, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Amazonify
Affected
up to 0.8.1
What to do
Affects up to 0.8.1. Update Amazonify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2023Directorist – WordPress Business Directory Plugin with Classified Ads Listings: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-41798 · WordPress plugins & themes · reported by PatchstackMedium 5.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: from n/a through 7.7.1.
Product
Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update Directorist – WordPress Business Directory Plugin with Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Jazz Popups: Cross-Site Request Forgery (CSRF)CVE-2023-32966 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through 1.8.7.
Product
Jazz Popups
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update Jazz Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Auth.CVE-2023-28499 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in simonpedge Slide Anything – Responsive Content / HTML Slider and Carousel plugin <= 2.4.9 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Email Templates Customizer and Designer for WordPress and WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2022-47181 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.
Product
Email Templates Customizer and Designer for WordPress and WooCommerce
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Email Templates Customizer and Designer for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Posts and Users Stats: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-44738 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.
Product
Posts and Users Stats
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Posts and Users Stats to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Simple CSV/XLS Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-42882 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.
Product
Simple CSV/XLS Exporter
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update Simple CSV/XLS Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Export Users Data CSV: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-41616 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.
Product
Export Users Data CSV
Affected
up to 2.1
What to do
Affects up to 2.1. Update Export Users Data CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WP CSV Exporter: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-38702 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.
Product
WP CSV Exporter
Affected
up to 2.0
What to do
Affects up to 2.0. Update WP CSV Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Emails & Newsletters with Jackmail: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46821 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.
Product
Emails & Newsletters with Jackmail
Affected
up to 1.2.22
What to do
Affects up to 1.2.22. Update Emails & Newsletters with Jackmail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023ReviewX – Multi-criteria Rating & Reviews for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46809 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.
Product
ReviewX – Multi-criteria Rating & Reviews for WooCommerce
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update ReviewX – Multi-criteria Rating & Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Export Users Data Distinct: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46804 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export Users Data Distinct: from n/a through 1.3.
Product
Export Users Data Distinct
Affected
up to 1.3
What to do
Affects up to 1.3. Update Export Users Data Distinct to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Simple Newsletter Plugin – Noptin: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46803 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.
Product
Simple Newsletter Plugin – Noptin
Affected
up to 1.9.5
What to do
Affects up to 1.9.5. Update Simple Newsletter Plugin – Noptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Site Reviews: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46801 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.
Product
Site Reviews
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45810 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce: from n/a through 5.5.2.
Product
Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce
Affected
up to 5.5.2
What to do
Affects up to 5.5.2. Update Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WordPress Comments Import & Export: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45370 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.
Product
WordPress Comments Import & Export
Affected
up to 2.3.1
What to do
Affects up to 2.3.1. Update WordPress Comments Import & Export to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Commenter Emails: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45360 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Scott Reilly Commenter Emails.This issue affects Commenter Emails: from n/a through 2.6.1.
Product
Commenter Emails
Affected
up to 2.6.1
What to do
Affects up to 2.6.1. Update Commenter Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023amr users: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45348 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in anmari amr users.This issue affects amr users: from n/a through 4.59.4.
Product
amr users
Affected
up to 4.59.4
What to do
Affects up to 4.59.4. Update amr users to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023User Blocker: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45078 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5.
Product
User Blocker
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update User Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Post to CSV by BestWebSoft: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-36527 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0.
Product
Post to CSV by BestWebSoft
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update Post to CSV by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023KB Support: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-25983 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84.
Product
KB Support
Affected
up to 1.5.84
What to do
Affects up to 1.5.84. Update KB Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Form Builder | Create Responsive Contact Forms: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-23796 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.
Product
Form Builder | Create Responsive Contact Forms
Affected
up to 1.9.9.0
What to do
Affects up to 1.9.9.0. Update Form Builder | Create Responsive Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): Improper Neutralization of Formula Elements in a CSV FileCVE-2023-23678 · WordPress plugins & themes · reported by PatchstackMedium 4
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): from n/a through 2.2.5.
Product
WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023GiveWP: Improper Neutralization of Formula Elements in a CSV FileCVE-2023-22719 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1.
Product
GiveWP
Affected
up to 2.25.1
What to do
Affects up to 2.25.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46802 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
Product
Product Reviews Import Export for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Product Reviews Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 20231003 Mortgage Application: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45357 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Lenderd 1003 Mortgage Application.This issue affects 1003 Mortgage Application: from n/a through 1.75.
Product
1003 Mortgage Application
Affected
up to 1.75
What to do
Affects up to 1.75. Update 1003 Mortgage Application to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023UsersWP: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-47442 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.
Product
UsersWP
Affected
up to 1.2.3.9
What to do
Affects up to 1.2.3.9. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Simple History – user activity log, audit tool: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-45350 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Improper Neutralization of Formula Elements in a CSV File vulnerability in Pär Thernström Simple History – user activity log, audit tool.This issue affects Simple History – user activity log, audit tool: from n/a through 3.3.1.
Product
Simple History – user activity log, audit tool
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Simple History – user activity log, audit tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023WD WidgetTwitter: SQL InjectionCVE-2023-5709 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WD WidgetTwitter
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update WD WidgetTwitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2023Gift Up Gift Cards for WordPress and WooCommerce: Stored Cross-Site ScriptingCVE-2023-5703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in all versions up to, and including, 2.20.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gift Up Gift Cards for WordPress and WooCommerce
Affected
up to 2.20.1
What to do
Affects up to 2.20.1. Update Gift Up Gift Cards for WordPress and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2023Featured Image Caption: Stored Cross-Site ScriptingCVE-2023-5669 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, and including, 0.8.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Featured Image Caption
Affected
up to 0.8.10
What to do
Affects up to 0.8.10. Update Featured Image Caption to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2023Social Feed: Stored Cross-Site ScriptingCVE-2023-5661 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including, 1.5.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with author-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Social Feed
Affected
up to 1.5.4.6
What to do
Affects up to 1.5.4.6. Update Social Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 7, 2023SendPress Newsletters: Stored Cross-Site ScriptingCVE-2023-5660 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.22.3.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SendPress Newsletters
Affected
up to 1.22.3.31
What to do
Affects up to 1.22.3.31. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2023Interact: Embed A Quiz On Your Site: Stored Cross-Site ScriptingCVE-2023-5659 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all versions up to, and including, 3.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Interact: Embed A Quiz On Your Site
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Interact: Embed A Quiz On Your Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2023Bitly's: Stored Cross-Site ScriptingCVE-2023-5577 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Bitly's
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Bitly's to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2023QR Code Tag: Stored Cross-Site ScriptingCVE-2023-5567 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
QR Code Tag
Affected
up to 1.0
What to do
Affects up to 1.0. Update QR Code Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.