Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,587 results · page 679 of 832
Aug 16, 2023SEO ALert: Does not sanitise and escape some of its settingsCVE-2023-2225 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO ALert WordPress plugin through 1.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SEO ALert
- Affected
- up to 1.59
- What to do
- Affects up to 1.59. Update SEO ALert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2023WP Inventory Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2123 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- WP Inventory Manager
- Fixed in
- 2.1.0.13
- What to do
- Update WP Inventory Manager to 2.1.0.13 or newer.
Aug 16, 2023Image Optimizer by 10web: Does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panelCVE-2023-2122 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.
- Product
- Image Optimizer by 10web
- Fixed in
- 1.0.27
- What to do
- Update Image Optimizer by 10web to 1.0.27 or newer.
Aug 16, 2023Booking Manager: Does not validate URLs input in it's admin panel or in shortcodes for showing events from a remoteCVE-2023-1977 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
- Product
- Booking Manager
- Fixed in
- 2.0.29
- What to do
- Update Booking Manager to 2.0.29 or newer.
Aug 16, 2023WP EasyPay: Does not escape some generated URLs before outputting them back in pagesCVE-2023-1465 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
- Product
- WP EasyPay
- Fixed in
- 4.1
- What to do
- Update WP EasyPay to 4.1 or newer.
Aug 16, 2023Yellow Yard Searchbar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1110 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Yellow Yard Searchbar
- Fixed in
- 2.8.12
- What to do
- Update Yellow Yard Searchbar to 2.8.12 or newer.
Aug 16, 2023YARPP: Does not validate and escape some of its shortcode attributes before using them in SQL statement/sCVE-2023-0579 · WordPress plugins & themes · reported by WPScanHigh 8.8
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks.
- Product
- YARPP
- Fixed in
- 5.30.3
- What to do
- Update YARPP to 5.30.3 or newer.
Aug 16, 2023REST API TO MiniProgram: Does not have authorisation and CSRF checks in an AJAX actionCVE-2023-0551 · WordPress plugins & themes · reported by WPScanMedium 5.4
The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments
- Product
- REST API TO MiniProgram
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2023URL Params: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0274 · WordPress plugins & themes · reported by WPScanMedium 5.4
The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- URL Params
- Fixed in
- 2.5
- What to do
- Update URL Params to 2.5 or newer.
Aug 16, 2023Tiempo.com: Does not have CSRF checkCVE-2023-0058 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Tiempo.com
- Affected
- up to 0.1.2
- What to do
- Affects up to 0.1.2. Update Tiempo.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2023ClickFunnels: Does not validate and escape one of its shortcode attributesCVE-2022-4782 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- ClickFunnels
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update ClickFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2023PT Woo: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-30871 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce plugin <= 1.1.0 versions.
- Product
- PT Woo
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update PT Woo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 16, 2023Unauth.CVE-2023-30779 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <= 1.5.51 versions.
- Affected
- up to 1.5.51
- What to do
- Affects up to 1.5.51. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 16, 2023Auth.CVE-2023-30786 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Benjamin Guy Captcha Them All plugin <= 1.3.3 versions.
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 16, 2023Unauth.CVE-2023-30785 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Grid plugin <= 1.21 versions.
- Affected
- up to 1.21
- What to do
- Affects up to 1.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 16, 2023Auth.CVE-2023-30784 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <= 1.5.2 versions.
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 16, 2023Unauth.CVE-2023-30782 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.5 versions.
- Affected
- up to 3.7.5
- What to do
- Affects up to 3.7.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 16, 2023Unauth.CVE-2023-30473 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Maxim Glazunov YML for Yandex Market plugin <= 3.10.7 versions.
- Affected
- up to 3.10.7
- What to do
- Affects up to 3.10.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 16, 2023WP Remote Users Sync: Unauthorized access of data and addition of dataCVE-2023-4374 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber privileges or above, to view logs.
- Product
- WP Remote Users Sync
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update WP Remote Users Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 16, 2023WP Remote Users Sync: Server Side Request ForgeryCVE-2023-3958 · WordPress plugins & themes · reported by WordfenceHigh 8.5
The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This was partially patched in version 1.2.12 and fully patched in version 1.2.13.
- Product
- WP Remote Users Sync
- Affected
- up to 1.2.12
- What to do
- Affects up to 1.2.12. Update WP Remote Users Sync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 15, 2023Auth.CVE-2023-30778 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry plugin <= 10.0.1 versions.
- Affected
- up to 10.0.1
- What to do
- Affects up to 10.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 15, 2023Unauth.CVE-2023-30747 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPGem WooCommerce Easy Duplicate Product plugin <= 0.3.0.0 versions.
- Affected
- up to 0.3.0.0
- What to do
- Affects up to 0.3.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 15, 2023Unauth.CVE-2023-30498 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeFlavors Vimeotheque: Vimeo WordPress Plugin <= 2.2.1 versions.
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 15, 2023InfiniteWP Client: Sensitive Information ExposureCVE-2023-2916 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.
- Product
- InfiniteWP Client
- Affected
- up to 1.11.1
- What to do
- Affects up to 1.11.1. Update InfiniteWP Client to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 15, 2023User Submitted Posts: Stored Cross-Site ScriptingCVE-2023-4308 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- User Submitted Posts
- Affected
- up to 20230809
- What to do
- Affects up to 20230809. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 14, 2023WP-EMail: Does not sanitise and escape some of its settingsCVE-2023-3721 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-EMail WordPress plugin before 2.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP-EMail
- Fixed in
- 2.69.1
- What to do
- Update WP-EMail to 2.69.1 or newer.
Aug 14, 2023Contact Form Builder by Bit Form: Does not sanitise and escape some of its settingsCVE-2023-3645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Builder by Bit Form WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Contact Form Builder by Bit Form
- Fixed in
- 2.2.0
- What to do
- Update Contact Form Builder by Bit Form to 2.2.0 or newer.
Aug 14, 2023Simple Author Box: Does not verify a user ID before outputting information about that userCVE-2023-3601 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Author Box WordPress plugin before 2.52 does not verify a user ID before outputting information about that user, leading to arbitrary user information disclosure to users with a role as low as Contributor.
- Product
- Simple Author Box
- Fixed in
- 2.52
- What to do
- Update Simple Author Box to 2.52 or newer.
Aug 14, 2023User Activity Log: Does not correctly sanitise and escape several parameters before using it in a SQL statementCVE-2023-3435 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
- Product
- User Activity Log
- Fixed in
- 1.6.5
- What to do
- Update User Activity Log to 1.6.5 or newer.
Aug 14, 2023Custom Field For WP Job Manager: Does not sanitise and escape some of its settingsCVE-2023-3328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Field For WP Job Manager WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Custom Field For WP Job Manager
- Fixed in
- 1.2
- What to do
- Update Custom Field For WP Job Manager to 1.2 or newer.
Aug 14, 2023Ultimate Addons for Contact Form 7: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2803 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Ultimate Addons for Contact Form 7
- Fixed in
- 3.1.29
- What to do
- Update Ultimate Addons for Contact Form 7 to 3.1.29 or newer.
Aug 14, 2023Ultimate Addons for Contact Form 7: Does not sanitise and escape some of its settingsCVE-2023-2802 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Addons for Contact Form 7
- Fixed in
- 3.1.29
- What to do
- Update Ultimate Addons for Contact Form 7 to 3.1.29 or newer.
Aug 14, 2023WP Brutal AI: Does not sanitise and escape some of its settingsCVE-2023-2606 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Brutal AI WordPress plugin before 2.06 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Brutal AI
- Fixed in
- 2.06
- What to do
- Update WP Brutal AI to 2.06 or newer.
Aug 14, 2023Elementor Website Builder: Does not filter out user-controlled URLs from being loaded into the DOMCVE-2022-4953 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
- Product
- Elementor Website Builder
- Fixed in
- 3.5.5
- What to do
- Update Elementor Website Builder to 3.5.5 or newer.
Aug 14, 2023Unauth.CVE-2023-30754 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt plugin <= 1.8.5 versions.
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 14, 2023Auth.CVE-2023-30752 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Silvia Pfeiffer and Andrew Nimmo External Videos plugin <= 2.0.1 versions.
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 14, 2023Auth.CVE-2023-30751 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in iControlWP Article Directory Redux plugin <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 14, 2023Auth.CVE-2023-30749 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in ihomefinder Optima Express + MarketBoost IDX Plugin plugin <= 7.3.0 versions.
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 14, 2023Unauth.CVE-2023-30489 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Email Subscription Popup plugin <= 1.2.16 versions.
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 14, 2023Unauth.CVE-2023-28535 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Paytm Paytm Payment Donation plugin <= 2.2.0 versions.
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 14, 2023Unauth.CVE-2023-30483 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.9.2 versions.
- Affected
- up to 3.3.9.2
- What to do
- Affects up to 3.3.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 14, 2023Auth.CVE-2023-30477 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Essitco AFFILIATE Solution plugin <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 14, 2023Unauth.CVE-2023-30475 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Elliot Sowersby, RelyWP WooCommerce Affiliate Plugin – Coupon Affiliates plugin <= 5.4.5 versions.
- Affected
- up to 5.4.5
- What to do
- Affects up to 5.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 14, 2023Auth.CVE-2023-29097 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in a3rev Software a3 Portfolio plugin <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 12, 2023Premium Packages - Sell Digital Products Securely: Privilege escalationCVE-2023-4293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
- Product
- Premium Packages - Sell Digital Products Securely
- Affected
- up to 5.7.4
- What to do
- Affects up to 5.7.4. Update Premium Packages - Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 11, 2023Canto: Remote File InclusionCVE-2023-3452 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow_url_include is enabled. Local File Inclusion is also possible, albeit less useful because it requires that the attacker be able to upload a malicious php file via FTP or some other means into a directory readable by the web server.
- Product
- Canto
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Canto to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 10, 2023Auth.CVE-2023-38397 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eggemplo Gestion-Pymes plugin <= 1.5.6 versions.
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 10, 2023Auth.CVE-2023-37388 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sudipto Pratap Mahato Simple Light Weight Social Share plugin <= 2.0 versions.
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 10, 2023Unauth.CVE-2023-39314 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.2 versions.
- Affected
- up to 3.30.2
- What to do
- Affects up to 3.30.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 10, 2023Auth.CVE-2023-37983 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Noël Jackson Art Direction plugin <= 0.2.4 versions.
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.