Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

428new WordPress flaws this week

399,168entries in the database

41,587 results · page 694 of 832

Jun 6, 2023Kali Forms: Cross-Site Request ForgeryCVE-2020-36717 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Kali Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to incorrect nonce handling throughout the plugin's function. This makes it possible for unauthenticated attackers to access the plugin's administrative functions via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Kali Forms
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023WP Activity Log: Authorization bypassCVE-2020-36716 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to run the setup wizard (if it has not been run previously) and access plugin configuration options.
Product
WP Activity Log
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP Activity Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Login/Signup Popup: Authorization bypassCVE-2020-36715 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arbitrary web scripts into the plugin settings that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Login/Signup Popup
Affected
up to 1.4
What to do
Affects up to 1.4. Update Login/Signup Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023MStore API: Authentication bypassCVE-2020-36713 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5. This is due to unrestricted access to the 'register' and 'update_user_profile' routes. This makes it possible for unauthenticated attackers to create new administrator accounts, delete existing administrator accounts, or escalate privileges on any account.
Product
MStore API
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com acunetix.com
Jun 6, 2023Kali Forms: Unauthenticated Arbitrary Post DeletionCVE-2020-36712 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliforms_form_delete_uploaded_file function lacking any privilege or user protections. This makes it possible for unauthenticated attackers to delete any site post or page with the id parameter.
Product
Kali Forms
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Avada: Stored Cross-Site ScriptingCVE-2020-36711 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the update_layout function in versions up to, and including, 6.2.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers, and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Avada
Affected
up to 6.2.3
What to do
Affects up to 6.2.3. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com theme-fusion.com
Jun 6, 2023WPS Hide Login: Login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sitesCVE-2020-36710 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.
Product
WPS Hide Login
Affected
up to 1.5.4.2
What to do
Affects up to 1.5.4.2. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Page Builder: KingComposer: Stored Cross-Site ScriptingCVE-2020-36709 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Page Builder: KingComposer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via via shortcode in versions before 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Page Builder: KingComposer
Fixed in
2.9.4
What to do
Update Page Builder: KingComposer to 2.9.4 or newer.
Full record and what to do →NVD record blog.nintechnet.com wpsocket.com
Jun 6, 2023The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0,CVE-2020-36708 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.
Affected
up to Shapely
What to do
Affects up to Shapely. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 6, 2023Coming Soon & Maintenance Mode Page: Cross-Site Request ForgeryCVE-2020-36707 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.57. This is due to confusing logic functions missing or having incorrect nonce validation. This makes it possible for unauthenticated attackers to gain and perform otherwise unauthorized access and actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Coming Soon & Maintenance Mode Page
Affected
up to 1.57
What to do
Affects up to 1.57. Update Coming Soon & Maintenance Mode Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record jetpack.com wpscan.com
Jun 6, 2023Fruitful: Stored Cross-Site ScriptingCVE-2020-36704 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fruitful Theme for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters stored via the fruitful_theme_options_action AJAX action in versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Fruitful
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update Fruitful to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Elementor Website Builder: Stored Cross-Site ScriptingCVE-2020-36703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG image uploads in versions up to, and including 2.9.7 This makes it possible for authenticated attackers with the upload_files capability to inject arbitrary web scripts in pages that will execute whenever a user accesses the page with the stored web scripts.
Product
Elementor Website Builder
Affected
up to 2.9.7
What to do
Affects up to 2.9.7. Update Elementor Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Ultimate Addons for Gutenberg: Authenticated Settings ChangeCVE-2020-36702 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14.7. This is due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber+ roles to update the plugin's settings.
Product
Ultimate Addons for Gutenberg
Affected
up to 1.14.7
What to do
Affects up to 1.14.7. Update Ultimate Addons for Gutenberg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023Page Builder: KingComposer: Arbitrary File UploadsCVE-2020-36701 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Page Builder: KingComposer plugin for WordPress is vulnerable to Arbitrary File Uploads in versions up to, and including, 2.9.3 via the 'process_bulk_action' function in the 'kingcomposer/includes/kc.extensions.php' file. This makes it possible for authenticated users with author level permissions and above to upload arbitrary files onto the server which can be used to execute code on the server.
Product
Page Builder: KingComposer
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Page Builder: KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Page Builder: KingComposer: Authorization bypassCVE-2020-36700 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Page Builder: KingComposer plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.9.3. This is due to a security nonce being leaked in the '/wp-admin/index.php' page. This makes it possible for authenticated attackers to change arbitrary WordPress options, delete arbitrary files/folders, and inject arbitrary content.
Product
Page Builder: KingComposer
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update Page Builder: KingComposer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Quick Page/Post Redirect: Authorization bypassCVE-2020-36699 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax and qppr_delete_quick_redirect functions in versions up to, and including, 5.1.9. This makes it possible for low-privileged attackers to interact with the plugin settings and to create a redirect link that would forward all traffic to an external malicious website.
Product
Quick Page/Post Redirect
Affected
up to 5.1.9
What to do
Affects up to 5.1.9. Update Quick Page/Post Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023WP GDPR: Authorization bypassCVE-2020-36697 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings.
Product
WP GDPR
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update WP GDPR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com acunetix.com
Jun 6, 2023Product Input Fields for WooCommerce: Authorization bypassCVE-2020-36696 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for unauthenticated attackers to download files from the vulnerable service.
Product
Product Input Fields for WooCommerce
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Funnel Builder: Authorization bypassCVE-2019-25151 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service.
Product
Funnel Builder
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Funnel Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023Email Templates: HTML InjectionCVE-2019-25150 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Email Templates plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.3. This makes it possible for attackers to present phishing forms or conduct cross-site request forgery attacks against site administrators.
Product
Email Templates
Affected
up to 1.3
What to do
Affects up to 1.3. Update Email Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023Gallery Images Ape: Arbitrary Plugin DeactivationCVE-2019-25149 · WordPress plugins & themes · reported by WordfenceHigh 7.6
The Gallery Images Ape plugin for WordPress is vulnerable to Arbitrary Plugin Deactivation in versions up to, and including, 2.0.6. This allows authenticated attackers with any capability level to deactivate any plugin on the site, including plugins necessary to site functionality or security.
Product
Gallery Images Ape
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Gallery Images Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023WP HTML Mail: HTML injectionCVE-2019-25148 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.9.0.3 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such as clicking on a link.
Product
WP HTML Mail
Affected
up to 2.9.0.3
What to do
Affects up to 2.9.0.3. Update WP HTML Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.svn.wordpress.org
Jun 6, 2023Pretty Links: Stored Cross-Site ScriptingCVE-2019-25147 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Pretty Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via various IP headers as well as the referer header in versions up to, and including, 2.1.9 due to insufficient input sanitization and output escaping in the track_link function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Pretty Links
Affected
up to 2.1.9
What to do
Affects up to 2.1.9. Update Pretty Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023DELUCKS SEO: Stored Cross-Site ScriptingCVE-2019-25146 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The DELUCKS SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the saveSettings() function that had no capability checks in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever a victim accesses the page.
Product
DELUCKS SEO
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update DELUCKS SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Contact Form & SMTP Plugin by PirateForms: HTML injection in the ‘public/class-pirateforms-publicCVE-2019-25145 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims.
Product
Contact Form & SMTP Plugin by PirateForms
Affected
up to 2.5.1
What to do
Affects up to 2.5.1. Update Contact Form & SMTP Plugin by PirateForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023WP HTML Mail: HTML injectionCVE-2019-25144 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator into performing an action such as clicking on a link.
Product
WP HTML Mail
Affected
up to 2.2.10
What to do
Affects up to 2.2.10. Update WP HTML Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023GDPR Cookie Compliance: Authorization bypassCVE-2019-25143 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_settings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings.
Product
GDPR Cookie Compliance
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update GDPR Cookie Compliance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (CVE-2019-25142 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.nintechnet.com themes.trac.wordpress.org
Jun 6, 2023Easy WP SMTP: Authorization bypassCVE-2019-25141 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.
Product
Easy WP SMTP
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update Easy WP SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023WordPress Coming Soon Page & Maintenance Mode: Stored Cross-Site ScriptingCVE-2019-25140 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WordPress Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logo_width, logo_height, rcsp_logo_url, home_sec_link_txt, rcsp_headline and rcsp_description parameters in versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WordPress Coming Soon Page & Maintenance Mode
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update WordPress Coming Soon Page & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Coming Soon Page & Maintenance Mode: Unauthenticated settings resetCVE-2019-25139 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php file which makes it possible for unauthenticated attackers to trigger a plugin settings reset.
Product
Coming Soon Page & Maintenance Mode
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Coming Soon Page & Maintenance Mode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023User Submitted Posts: Arbitrary file uploadsCVE-2019-25138 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The User Submitted Posts plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the usp_check_images function in versions up to, and including, 20190312. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
User Submitted Posts
Affected
up to 20190312
What to do
Affects up to 20190312. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023Delete All Comments: Arbitrary file uploadsCVE-2016-15033 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php file in versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Product
Delete All Comments
Affected
up to 2.0
What to do
Affects up to 2.0. Update Delete All Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023ReviewX: Privilege escalationCVE-2023-2833 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_screen_options[option]' and 'wp_screen_options[value]' parameters during a screen option update.
Product
ReviewX
Affected
up to 1.6.13
What to do
Affects up to 1.6.13. Update ReviewX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Jun 5, 2023WP User Switch: Authentication bypassCVE-2023-2546 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP User Switch plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0.2. This is due to incorrect authentication checking in the 'wpus_allow_user_to_admin_bar_menu' function with the 'wpus_who_switch' cookie value. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator, if they have access to the username.
Product
WP User Switch
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update WP User Switch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Jun 5, 2023A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress.CVE-2015-10117 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 5966a5e6343e3d5610bdfa126a5cfbae95e629b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230664.
Product
Gravity Forms DPS PxPay
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Gravity Forms DPS PxPay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jun 5, 2023A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress.CVE-2015-10116 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_new_favicon of the file admin/class-favicon-by-realfavicongenerator-admin.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.2.13 is able to address this issue. The identifier of the patch is 949a1ae7216216350458844f50a72f100b56d4e7. It is recommended to upgrade the affected component. The identifier VDB-230661 was assigned to this vulnerability.
Product
RealFaviconGenerator Favicon
Affected
up to 1.2.12
What to do
Affects up to 1.2.12. Update RealFaviconGenerator Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jun 5, 2023A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress.CVE-2013-10030 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issue is some unknown functionality of the file wordpress-exit-box-lite.php. The manipulation leads to information disclosure. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230672.
Product
Exit Box Lite
Affected
up to 1.06
What to do
Affects up to 1.06. Update Exit Box Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jun 5, 2023A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress.CVE-2013-10029 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the function exitboxadmin of the file wordpress-exit-box-lite.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.10 is able to address this issue. The patch is named fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230671.
Product
Exit Box Lite
Affected
up to 1.06
What to do
Affects up to 1.06. Update Exit Box Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jun 5, 2023A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress.CVE-2015-10115 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the function process_request of the file classes/class-woosidebars-sbm-converter.php. The manipulation leads to open redirect. It is possible to initiate the attack remotely. Upgrading to version 1.1.2 is able to address this issue. The patch is named a0efb4ffb9dfe2925b889c1aa5ea40b4abbbda8a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230655.
Product
WooSidebars Sidebar Manager Converter
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WooSidebars Sidebar Manager Converter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jun 5, 2023A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress.CVE-2015-10114 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function enable_custom_post_sidebars of the file classes/class-woo-sidebars.php. The manipulation of the argument sendback leads to open redirect. The attack may be launched remotely. Upgrading to version 1.4.2 is able to address this issue. The patch is identified as 1ac6d6ac26e185673f95fc1ccc56a392169ba601. It is recommended to upgrade the affected component. VDB-230654 is the identifier assigned to this vulnerability.
Product
WooSidebars
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update WooSidebars to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jun 5, 2023A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress.CVE-2015-10113 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in WooFramework Tweaks Plugin up to 1.0.1 on WordPress. Affected by this vulnerability is the function admin_screen_logic of the file wooframework-tweaks.php. The manipulation of the argument url leads to open redirect. The attack can be launched remotely. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is 3b57d405149c1a59d1119da6e0bb8212732c9c88. It is recommended to upgrade the affected component. The identifier VDB-230653 was assigned to this vulnerability.
Product
WooFramework Tweaks
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WooFramework Tweaks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Jun 5, 2023Get your number: Does not sanitise and escape some of its settingsCVE-2023-2634 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Get your number WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Get your number
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update Get your number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2023Survey Maker: Does not escape some parameters before outputting them back in attributesCVE-2023-2572 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Survey Maker
Fixed in
3.4.7
What to do
Update Survey Maker to 3.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2023Quiz Maker: Does not escape some parameters before outputting them back in attributesCVE-2023-2571 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Quiz Maker
Fixed in
6.4.2.7
What to do
Update Quiz Maker to 6.4.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 202310Web Social Post Feed: Does not sanitise and escape some parameter before outputting it back in a pageCVE-2023-2503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
10Web Social Post Feed
Fixed in
1.2.9
What to do
Update 10Web Social Post Feed to 1.2.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2023
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Stop Spammers Security | Block Spam Users, Comments, Forms
Fixed in
2023
What to do
Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2023Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not sanitise and escape a parameter before outputting it back in the admin dashboardCVE-2023-2472 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Fixed in
3.1.61
What to do
Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.61 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2023ConvertKit: Does not escape a parameter before outputting it back in an attributeCVE-2023-2337 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
ConvertKit
Fixed in
2.2.1
What to do
Update ConvertKit to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.