Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
409 results · page 7 of 9
Jun 27, 2022Image Gallery: Does not sanitize and escape some of its Image fieldsCVE-2022-1327 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Image Gallery
- Fixed in
- 1.1.6
- What to do
- Update Image Gallery to 1.1.6 or newer.
Jun 27, 2022Form - Contact Form: Does not sanitize and escape Custom text fieldsCVE-2022-1326 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Form - Contact Form
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Form - Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Coming Soon & Maintenance Mode by Colorlib: Does not sanitize and escape some settingsCVE-2022-1945 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in multisite setup)
- Product
- Coming Soon & Maintenance Mode by Colorlib
- Fixed in
- 1.0.99
- What to do
- Update Coming Soon & Maintenance Mode by Colorlib to 1.0.99 or newer.
Jun 13, 2022Export any WordPress data to XML/CSV: Does not sanitize the cpt POST parameterCVE-2022-1800 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability.
- Product
- Export any WordPress data to XML/CSV
- Fixed in
- 1.3.5
- What to do
- Update Export any WordPress data to XML/CSV to 1.3.5 or newer.
Jun 13, 2022Newsletter: Does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pagesCVE-2022-1756 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
- Product
- Newsletter
- Fixed in
- 7.4.5
- What to do
- Update Newsletter to 7.4.5 or newer.
Jun 13, 2022WP Athletics: Does not sanitize parameters before storing them in the databaseCVE-2022-1549 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.
- Product
- WP Athletics
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update WP Athletics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Carousel CK: Does not sanitize and escape Slide's descriptionsCVE-2022-1336 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Carousel CK
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Carousel CK to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Slideshow CK: Does not sanitize and escape Slide's descriptionsCVE-2022-1335 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Slideshow CK
- Fixed in
- 1.4.10
- What to do
- Update Slideshow CK to 1.4.10 or newer.
Jun 13, 2022Advanced Admin Search: Does not sanitize and escape some parameters before outputting them back in an admin pageCVE-2022-0626 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Advanced Admin Search
- Fixed in
- 1.1.6
- What to do
- Update Advanced Admin Search to 1.1.6 or newer.
Jun 8, 2022Video Slider: Does not sanitize or escape some of its video settingsCVE-2022-1541 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Video Slider
- Fixed in
- 1.4.8
- What to do
- Update Video Slider to 1.4.8 or newer.
May 30, 2022Call&Book Mobile Bar: Does not sanitize and escape some of its settingsCVE-2022-1644 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Call&Book Mobile Bar
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Call&Book Mobile Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Form Maker by 10Web: Does not sanitize and escape the Custom Text settingsCVE-2022-1564 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Form Maker by 10Web
- Fixed in
- 1.14.12
- What to do
- Update Form Maker by 10Web to 1.14.12 or newer.
May 30, 2022Slideshow: Does not sanitize and escape some of its default slideshow settingsCVE-2022-1299 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Slideshow
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022IMDB info box: Does not sanitize and escape some of its settingsCVE-2022-1294 · WordPress plugins & themes · reported by WPScanMedium 4.8
The IMDB info box WordPress plugin through 2.0 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- IMDB info box
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update IMDB info box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022BannerMan: Does not sanitize or escape its settingsCVE-2022-1275 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed (such as in multisite)
- Product
- BannerMan
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update BannerMan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Sliderby10Web: Does not properly sanitize and escape some of its settingsCVE-2022-1320 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Sliderby10Web
- Fixed in
- 1.2.52
- What to do
- Update Sliderby10Web to 1.2.52 or newer.
May 23, 2022WP Contacts Manager: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1014 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.
- Product
- WP Contacts Manager
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Contacts Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022WPCargo Track & Trace: Does not sanitize and escapes some of its settingsCVE-2022-1435 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WPCargo Track & Trace
- Fixed in
- 6.9.5
- What to do
- Update WPCargo Track & Trace to 6.9.5 or newer.
May 16, 2022BulletProof Security: Does not sanitize and escape some of its CAPTCHA settingsCVE-2022-1265 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- BulletProof Security
- Fixed in
- 6.1
- What to do
- Update BulletProof Security to 6.1 or newer.
May 16, 2022The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statemenCVE-2022-0867 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users
- Product
- Pricing Table
- Fixed in
- 3.6.1
- What to do
- Update Pricing Table to 3.6.1 or newer.
May 9, 2022Slide Anything: Does not sanitize and escape sliders' descriptionCVE-2022-1303 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Slide Anything
- Fixed in
- 2.3.44
- What to do
- Update Slide Anything to 2.3.44 or newer.
May 9, 2022Personal Dictionary: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1013 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability.
- Product
- Personal Dictionary
- Fixed in
- 1.3.4
- What to do
- Update Personal Dictionary to 1.3.4 or newer.
May 9, 2022Admin Menu Editor: Does not sanitize and escape a parameter before outputting it back in an admin pageCVE-2022-0625 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Admin Menu Editor
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Admin Menu Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2022Photo Gallery by 10Web: Does not properly sanitize the $_GET['image_url'] variableCVE-2022-1282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.3
- What to do
- Update Photo Gallery by 10Web to 1.6.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022Documentor: Fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executedCVE-2022-0773 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.
- Product
- Documentor
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Documentor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022Opensea: Does not sanitize and escape some of its settingsCVE-2022-1228 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Opensea
- Fixed in
- 1.0.3
- What to do
- Update Opensea to 1.0.3 or newer.
Apr 25, 2022Users Ultra: Fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and auCVE-2022-0769 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.
- Product
- Users Ultra
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Users Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Text Hover: Does not sanitize and escape the text to hoverCVE-2022-0737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Text Hover
- Fixed in
- 4.2
- What to do
- Update Text Hover to 4.2 or newer.
Apr 18, 2022Ad Injection: Does not properly sanitize the body of the adverts injected into the pagesCVE-2022-0661 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
- Product
- Ad Injection
- Affected
- up to 1.2.0.19
- What to do
- Affects up to 1.2.0.19. Update Ad Injection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 4, 2022In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GECVE-2022-1170 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.
- Product
- Noo JobMonster
- Fixed in
- 4.5.2.9
- What to do
- Update Noo JobMonster to 4.5.2.9 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Apr 4, 2022Easy Social Icons: Does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statementCVE-2022-0887 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.
- Product
- Easy Social Icons
- Fixed in
- 3.1.4
- What to do
- Update Easy Social Icons to 3.1.4 or newer.
Mar 28, 2022Narnoo Distributor: Fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticatCVE-2022-0679 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.
- Product
- Narnoo Distributor
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Narnoo Distributor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Bulk Creator: Does not sanitize and escape the post_type parameter before outputting it back in an admin pageCVE-2022-0647 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Bulk Creator
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Bulk Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Bank Mellat: Does not sanitize and escape the orderId parameter before outputting it back in an admin pageCVE-2022-0643 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Bank Mellat
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update Bank Mellat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Popup Like box: Does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin pageCVE-2022-0641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Popup Like box
- Fixed in
- 3.6.1
- What to do
- Update Popup Like box to 3.6.1 or newer.
Mar 28, 2022dTabs: Does not sanitize and escape the tab parameter before outputting it back in an admin pageCVE-2022-0621 · WordPress plugins & themes · reported by WPScanMedium 6.1
The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- dTabs
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update dTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Delete Old Orders: Does not sanitize and escape the date parameter before outputting it back in an admin pageCVE-2022-0620 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Delete Old Orders
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Delete Old Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Database Peek: Does not sanitize and escape the match parameter before outputting it back in an admin pageCVE-2022-0619 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Database Peek
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Database Peek to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Conference Scheduler: Does not sanitize and escape the tab parameter before outputting back in an admin pageCVE-2022-0600 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Conference Scheduler
- Fixed in
- 2.4.3
- What to do
- Update Conference Scheduler to 2.4.3 or newer.
Mar 28, 2022Mapping Multiple URLs Redirect Same Page: Does not sanitize and escape the mmursp_id parameter before outputting it back in an admin pageCVE-2022-0599 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Mapping Multiple URLs Redirect Same Page
- Affected
- up to 5.8
- What to do
- Affects up to 5.8. Update Mapping Multiple URLs Redirect Same Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2022Wow Countdowns: Does not sanitize user input into the 'did' parameter and uses it in a SQL statementCVE-2021-25064 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection.
- Product
- Wow Countdowns
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Wow Countdowns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 21, 2022BookingPress: Fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users)CVE-2022-0739 · WordPress plugins & themes · reported by WPScanCritical 9.8
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- BookingPress
- Fixed in
- 1.0.11
- What to do
- Update BookingPress to 1.0.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Pricing Table Builder: Does not sanitize and escape the postid parameter before outputting it back in an admin pageCVE-2022-0640 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Pricing Table Builder
- Fixed in
- 1.1.5
- What to do
- Update Pricing Table Builder to 1.1.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Mega Menu: Does not sanitize and escape the _wpnonce parameter before outputting it back in an admin pageCVE-2022-0628 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Mega Menu
- Fixed in
- 3.0.8
- What to do
- Update Mega Menu to 3.0.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 21, 2022Amelia: Does not sanitize and escape the code parameter before outputting it back in an admin pageCVE-2022-0627 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Amelia
- Fixed in
- 1.0.47
- What to do
- Update Amelia to 1.0.47 or newer.
Mar 21, 2022Modern Events Calendar Lite: Does not sanitize and escape some of the Hourly Schedule parametersCVE-2022-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.4.0
- What to do
- Update Modern Events Calendar Lite to 6.4.0 or newer.
Mar 14, 2022Team Circle Image Slider With Lightbox: Does not sanitize and escape the order_pos parameter before outputting it back in an admin pageCVE-2022-0648 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Team Circle Image Slider With Lightbox
- Fixed in
- 1.0.16
- What to do
- Update Team Circle Image Slider With Lightbox to 1.0.16 or newer.
Mar 14, 2022Countdown, Coming Soon, Maintenance: Does not sanitize and escape the post parameter before outputting it back in an admin pageCVE-2022-0601 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Countdown, Coming Soon, Maintenance
- Fixed in
- 2.2.9
- What to do
- Update Countdown, Coming Soon, Maintenance to 2.2.9 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 17, 2022SEUR Oficial: Does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2021-25005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEUR Oficial WordPress plugin before 1.7.0 does not sanitize and escape some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- SEUR Oficial
- Fixed in
- 1.7.0
- What to do
- Update SEUR Oficial to 1.7.0 or newer.
Jan 10, 2022WPcalc: Does not sanitize user input into the 'did' parameter and uses it in a SQL statementCVE-2021-25054 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPcalc WordPress plugin through 2.1 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection vulnerability.
- Product
- WPcalc
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WPcalc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.