Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,587 results · page 696 of 832
May 30, 2023Easy Forms for Mailchimp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2518 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.9
- What to do
- Update Easy Forms for Mailchimp to 6.8.9 or newer.
May 30, 2023Add to Feedly: Does not sanitize and escape its settingsCVE-2023-2470 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Add to Feedly
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Add to Feedly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Loginizer: Does not escape a parameter before outputting it back in the pageCVE-2023-2296 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Loginizer
- Fixed in
- 1.7.9
- What to do
- Update Loginizer to 1.7.9 or newer.
May 30, 2023Otter: Does not sanitize some user-controlled file paths before performing file operations on themCVE-2023-2288 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
- Product
- Otter
- Fixed in
- 2.2.6
- What to do
- Update Otter to 2.2.6 or newer.
May 30, 2023Orbit Fox by ThemeIsle: Does not limit URLsCVE-2023-2287 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.
- Product
- Orbit Fox by ThemeIsle
- Fixed in
- 2.10.24
- What to do
- Update Orbit Fox by ThemeIsle to 2.10.24 or newer.
May 30, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some URL parametersCVE-2023-2256 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.
- Product
- Product Addons & Fields for WooCommerce
- Fixed in
- 32.0.7
- What to do
- Update Product Addons & Fields for WooCommerce to 32.0.7 or newer.
May 30, 2023Login rebuilder: Does not sanitise and escape some of its settingsCVE-2023-2223 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login rebuilder
- Fixed in
- 2.8.1
- What to do
- Update Login rebuilder to 2.8.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2023Image Optimizer by 10web: Does not sanitize the dir parameterCVE-2023-2117 · WordPress plugins & themes · reported by WPScanLow 2.7
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.
- Product
- Image Optimizer by 10web
- Fixed in
- 1.0.27
- What to do
- Update Image Optimizer by 10web to 1.0.27 or newer.
May 30, 2023Autoptimize: Does not sanitise and escape the settings imported from a previous exportCVE-2023-2113 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
- Product
- Autoptimize
- Fixed in
- 3.1.7
- What to do
- Update Autoptimize to 3.1.7 or newer.
May 30, 2023Fast & Effective Popups & Lead-Generation for: Concatenates user input into an SQL query without escaping it first in the plugin's report API endpointCVE-2023-2111 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL query without escaping it first in the plugin's report API endpoint, which could allow administrators in multi-site configuration to leak sensitive information from the site's database.
- Product
- Fast & Effective Popups & Lead-Generation for
- Fixed in
- 2.1.4
- What to do
- Update Fast & Effective Popups & Lead-Generation for to 2.1.4 or newer.
May 30, 2023Custom 404 Pro: Does not escape some URLs before outputting them in attributesCVE-2023-2023 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
- Product
- Custom 404 Pro
- Fixed in
- 3.7.3
- What to do
- Update Custom 404 Pro to 3.7.3 or newer.
May 30, 2023WP Fastest Cache: Does not have CSRF check in an AJAX actionCVE-2023-1938 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remote_get() function, leading to a Blind SSRF issue
- Product
- WP Fastest Cache
- Fixed in
- 1.1.5
- What to do
- Update WP Fastest Cache to 1.1.5 or newer.
May 30, 2023Download Manager: Does not adequately validate passwords for password-protected filesCVE-2023-1524 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's password.
- Product
- Download Manager
- Fixed in
- 3.2.71
- What to do
- Update Download Manager to 3.2.71 or newer.
May 30, 2023Newsletter Popup: Does not have CSRF checks in some placesCVE-2023-0766 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Newsletter Popup: Does not sanitise and escape some of its settingsCVE-2023-0733 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023AnyWhere Elementor: Discloses a Freemius Secret KeyCVE-2023-0443 · WordPress plugins & themes · reported by WPScanMedium 5.3
The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked.
- Product
- AnyWhere Elementor
- Fixed in
- 1.2.8
- What to do
- Update AnyWhere Elementor to 1.2.8 or newer.
May 30, 2023Elementor Website Builder: Does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statementCVE-2023-0329 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
- Product
- Elementor Website Builder
- Fixed in
- 3.12.2
- What to do
- Update Elementor Website Builder to 3.12.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2023OSM: Does not validate and escape some of its shortcode attributesCVE-2022-4676 · WordPress plugins & themes · reported by WPScanMedium 5.4
The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- OSM
- Affected
- up to 6.01
- What to do
- Affects up to 6.01. Update OSM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2023A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress.CVE-2014-125102 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.0.8 is able to address this issue. The identifier of the patch is 860d1891025548cf0f5f97364c1f51a888f523c3. It is recommended to upgrade the affected component. The identifier VDB-230113 was assigned to this vulnerability.
- Product
- Bestwebsoft Relevant
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Bestwebsoft Relevant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2023Unauth.CVE-2023-27613 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MonitorClick Forms Ada – Form Builder plugin <= 1.0 versions.
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 29, 2023Auth.CVE-2023-23699 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Reynolds Progress Bar plugin <= 2.2.1 versions.
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.CVE-2022-45372 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Codeixer Product Gallery Slider for WooCommerce plugin <= 2.2.8 versions.
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Smash Balloon Custom Twitter Feeds: Cross-Site Request Forgery (CSRF)CVE-2022-33974 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.
- Product
- Smash Balloon Custom Twitter Feeds
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Smash Balloon Custom Twitter Feeds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions.CVE-2023-33926 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions.
- Fixed in
- 1.11.8
- What to do
- Update the plugin to 1.11.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Plugin <= 2.0.4 versions.CVE-2022-36345 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Plugin <= 2.0.4 versions.
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Unauth.CVE-2023-33332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.
- Affected
- up to 2.1.76
- What to do
- Affects up to 2.1.76. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023WooCommerce WooCommerce Follow-Up Emails: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-33319 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.
- Product
- WooCommerce WooCommerce Follow-Up Emails
- Affected
- up to 4.9.40
- What to do
- Affects up to 4.9.40. Update WooCommerce WooCommerce Follow-Up Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023WooCommerce WooCommerce Follow-Up Emails: Cross-Site Request Forgery (CSRF)CVE-2023-33316 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.
- Product
- WooCommerce WooCommerce Follow-Up Emails
- Fixed in
- 4.9.50
- What to do
- Update WooCommerce WooCommerce Follow-Up Emails to 4.9.50 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.CVE-2023-33313 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.
- Fixed in
- 1.3.0
- What to do
- Update the plugin to 1.3.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Auth.CVE-2023-33311 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CRM Perks Contact Form Entries plugin <= 1.3.0 versions.
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023André Bräkling WP-Matomo Integration: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-33211 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions.
- Product
- André Bräkling WP-Matomo Integration
- Affected
- up to 1.0.27
- What to do
- Affects up to 1.0.27. Update André Bräkling WP-Matomo Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Unauth.CVE-2023-32800 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in One Rank Math SEO PRO plugin <= 3.0.35 versions.
- Affected
- up to 3.0.35
- What to do
- Affects up to 3.0.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Auth.CVE-2023-28785 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.
- Affected
- up to 14.9
- What to do
- Affects up to 14.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.4 versions.CVE-2023-33931 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.4 versions.
- Fixed in
- 4.6.5
- What to do
- Update the plugin to 4.6.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Auth.CVE-2023-33328 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps MailChimp Subscribe Form plugin <= 4.0.9.1 versions.
- Fixed in
- 4.0.9.2
- What to do
- Update the plugin to 4.0.9.2 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Unauth.CVE-2023-33326 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.
- Fixed in
- 3.0.0
- What to do
- Update the plugin to 3.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.2 versions.CVE-2023-33315 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.2 versions.
- Fixed in
- 1.1.3
- What to do
- Update the plugin to 1.1.3 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions.CVE-2023-33314 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions.
- Fixed in
- 1.1.3.2
- What to do
- Update the plugin to 1.1.3.2 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Unauth.CVE-2023-33309 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.
- Fixed in
- 4.5.11.1
- What to do
- Update the plugin to 4.5.11.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions.CVE-2023-33212 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.0.6 versions.
- Fixed in
- 3.0.7
- What to do
- Update the plugin to 3.0.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Auth.CVE-2023-32958 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nose Graze Novelist plugin <= 1.2.0 versions.
- Fixed in
- 1.2.1
- What to do
- Update the plugin to 1.2.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023WooDiscuz – WooCommerce Comments: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-33216 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9.
- Product
- WooDiscuz – WooCommerce Comments
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update WooDiscuz – WooCommerce Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress.CVE-2014-125101 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.9 is able to address this issue. The identifier of the patch is 58ed88243e17df766036f4857041edaf358076d3. It is recommended to upgrade the affected component. The identifier VDB-230085 was assigned to this vulnerability.
- Product
- Portfolio Gallery
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Portfolio Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions.CVE-2023-32964 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Made with Fuel Better Notifications for WP plugin <= 1.9.2 versions.
- Fixed in
- 1.9.3
- What to do
- Update the plugin to 1.9.3 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 26, 2023Unauth.CVE-2023-29098 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ArtistScope CopySafe Web Protection plugin <= 3.13 versions.
- Fixed in
- 3.14
- What to do
- Update the plugin to 3.14 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 26, 2023Daniel Mores, A: Cross-Site Request Forgery (CSRF)CVE-2023-25467 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Daniel Mores, A. Huizinga Resize at Upload Plus plugin <= 1.3 versions.
- Product
- Daniel Mores, A
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Daniel Mores, A to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema – All In One Schema Rich Snippets plugin <= 1.6.5 versions.CVE-2023-25058 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema – All In One Schema Rich Snippets plugin <= 1.6.5 versions.
- Fixed in
- 1.6.6
- What to do
- Update the plugin to 1.6.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in BoLiQuan WP Clean Up plugin <= 1.2.3 versions.CVE-2023-25034 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in BoLiQuan WP Clean Up plugin <= 1.2.3 versions.
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Anton Skorobogatov Rus-To-Lat plugin <= 0.3 versions.CVE-2023-25470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Anton Skorobogatov Rus-To-Lat plugin <= 0.3 versions.
- Affected
- up to 0.3
- What to do
- Affects up to 0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in utahta WP Social Bookmarking Light plugin <= 2.0.7 versions.CVE-2023-25029 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in utahta WP Social Bookmarking Light plugin <= 2.0.7 versions.
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.