Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,905 results · page 70 of 79
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.CVE-2023-24419 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.
- Affected
- up to 5.5.6
- What to do
- Affects up to 5.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions.CVE-2022-43459 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions.
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 27, 2023Registration Forms: Does not properly validate the redirection URLCVE-2023-0552 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability
- Product
- Registration Forms
- Fixed in
- 3.8.2.3
- What to do
- Update Registration Forms to 3.8.2.3 or newer.
Feb 23, 2023The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue.CVE-2023-26326 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
- Fixed in
- 2.7.8
- What to do
- Update the plugin to 2.7.8 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Feb 17, 2023WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions: Cross-Site Request Forgery (CSRF)CVE-2023-24388 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions (create, duplicate, edit, delete).
- Product
- WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions
- Fixed in
- 3.2.4
- What to do
- Update WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions affects plugin forms actions to 3.2.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 13, 2023Profile Builder – User Profile & User Registration Forms: Sensitive information disclosureCVE-2023-0814 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Feb 13, 2023Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.CVE-2022-41134 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.
- Fixed in
- 1.0.16
- What to do
- Update the plugin to 1.0.16 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 13, 2023GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training: Does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary postsCVE-2023-0405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.
- Product
- GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training
- Fixed in
- 1.4.38
- What to do
- Update GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training to 1.4.38 or newer.
Feb 13, 2023Zoho Forms: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0169 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Zoho Forms
- Fixed in
- 3.0.1
- What to do
- Update Zoho Forms to 3.0.1 or newer.
Feb 6, 2023Send PDF for Contact Form 7: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-0143 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Send PDF for Contact Form 7
- Fixed in
- 0.9.9.2
- What to do
- Update Send PDF for Contact Form 7 to 0.9.9.2 or newer.
Feb 6, 2023Happyforms: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0096 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Happyforms
- Fixed in
- 1.22.0
- What to do
- Update Happyforms to 1.22.0 or newer.
Jan 27, 2023ContentStudio: Sensitive Information ExposureCVE-2023-0557 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
- Product
- ContentStudio
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2023The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-tCVE-2022-0316 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.
- Product
- WeStand
- Fixed in
- 2.1
- What to do
- Update WeStand to 2.1 or newer.
Jan 14, 2023Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.CVE-2022-38467 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 9, 2023Multi Step Form: Does not sanitise and escape some of its form fieldsCVE-2022-4196 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Multi Step Form
- Fixed in
- 1.7.8
- What to do
- Update Multi Step Form to 1.7.8 or newer.
Jan 2, 2023The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site ScripCVE-2022-4114 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks.
- Fixed in
- 1.2.33
- What to do
- Update the plugin to 1.2.33 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Dec 26, 2022Simple Basic Contact Form: Does not sanitise and escape some of its settingsCVE-2022-4226 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Basic Contact Form
- Fixed in
- 20221201
- What to do
- Update Simple Basic Contact Form to 20221201 or newer.
Dec 26, 2022Stop Spammers Security | Block Spam Users, Comments, Forms: Passes base64 encoded user input to the unserialize() PHP functionCVE-2022-4120 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2022.6
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2022.6 or newer.
Dec 26, 2022Paytium: Mollie payment forms & donations: Does not sanitise and escape some of its settingsCVE-2022-4042 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paytium: Mollie payment forms & donations
- Fixed in
- 4.3.7
- What to do
- Update Paytium: Mollie payment forms & donations to 4.3.7 or newer.
Dec 19, 2022Registration Forms: Does not have authorisation and CSRFCVE-2022-4024 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)
- Product
- Registration Forms
- Fixed in
- 3.8.1.3
- What to do
- Update Registration Forms to 3.8.1.3 or newer.
Dec 19, 2022Directorist: Does not prevent users with low privileges (like subscribers) from accessing sensitive system informationCVE-2022-3961 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information.
- Product
- Directorist
- Fixed in
- 7.4.4
- What to do
- Update Directorist to 7.4.4 or newer.
Dec 12, 2022Easy Form Builder: Does not sanitise and escape some of its settingsCVE-2022-3906 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Easy Form Builder
- Fixed in
- 3.4.0
- What to do
- Update Easy Form Builder to 3.4.0 or newer.
Nov 29, 2022WP Affiliate Platform: Cross-Site Request ForgeryCVE-2022-3898 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on various functions including the affiliates_menu method. This makes it possible for unauthenticated attackers to delete affiliate records, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Affiliate Platform
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtipsandtricks-hq.comwordfence.com
Nov 29, 2022WP Affiliate Platform: Stored Cross-Site ScriptingCVE-2022-3897 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Affiliate Platform
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtipsandtricks-hq.comwordfence.com
Nov 29, 2022WP Affiliate Platform: Reflected Cross-Site ScriptingCVE-2022-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is unlikely to work in modern browsers.
- Product
- WP Affiliate Platform
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtipsandtricks-hq.comwordfence.com
Nov 28, 2022Google Forms: Does not sanitise and escape some of its settingsCVE-2022-3834 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Google Forms
- Affected
- up to 0.95
- What to do
- Affects up to 0.95. Update Google Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022HTML Forms: Does not properly properly escape a parameter before using it in a SQL statementCVE-2022-3689 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
- Product
- HTML Forms
- Fixed in
- 1.3.25
- What to do
- Update HTML Forms to 1.3.25 or newer.
Nov 21, 2022DeepL Pro API translation: Discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an externalCVE-2022-3691 · WordPress plugins & themes · reported by WPScanHigh 7.5
The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.
- Product
- DeepL Pro API translation
- Fixed in
- 1.7.5
- What to do
- Update DeepL Pro API translation to 1.7.5 or newer.
Nov 21, 2022Contact Form 7 Database Addon: Does not validate dataCVE-2022-3634 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection
- Product
- Contact Form 7 Database Addon
- Fixed in
- 1.2.6.5
- What to do
- Update Contact Form 7 Database Addon to 1.2.6.5 or newer.
Nov 21, 2022WP User Frontend: Uses a user supplied argument called urhidden in its registration formCVE-2021-24649 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP User Frontend WordPress plugin before 3.5.29 uses a user supplied argument called urhidden in its registration form, which contains the role for the account to be created with, encrypted via wpuf_encryption(). This could allow an attacker having access to the AUTH_KEY and AUTH_SALT constant (via an arbitrary file access issue for example, or if the blog is using the default keys) to create an account with any role they want, such as admin
- Product
- WP User Frontend
- Fixed in
- 3.5.29
- What to do
- Update WP User Frontend to 3.5.29 or newer.
Nov 18, 2022Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-42883 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.
- Affected
- up to 7.3.10
- What to do
- Affects up to 7.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 14, 2022WPForms Pro: Does not validate its form dataCVE-2022-3574 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.
- Product
- WPForms Pro
- Fixed in
- 1.7.7
- What to do
- Update WPForms Pro to 1.7.7 or newer.
Nov 14, 2022reSmush.it : the only free Image Optimizer & compress: Does not perform CSRF checks for any of its AJAX actionsCVE-2022-2449 · WordPress plugins & themes · reported by WPScanMedium 6.5
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
- Product
- reSmush.it : the only free Image Optimizer & compress
- Fixed in
- 0.4.4
- What to do
- Update reSmush.it : the only free Image Optimizer & compress to 0.4.4 or newer.
Nov 7, 2022Contact Form: Does not validate and escape fieldsCVE-2022-3463 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
- Product
- Contact Form
- Fixed in
- 4.3.13
- What to do
- Update Contact Form to 4.3.13 or newer.
Oct 25, 2022Contact Bank: Does not sanitise and escape some of its Form settingsCVE-2022-3350 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Contact Bank
- Affected
- up to 3.0.30
- What to do
- Affects up to 3.0.30. Update Contact Bank to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2022Form Maker by 10Web: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3300 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.6
- What to do
- Update Form Maker by 10Web to 1.15.6 or newer.
Oct 17, 2022Drag and Drop Multiple File Upload: Does not properly check for the upload size limit set in formsCVE-2022-3282 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.
- Product
- Drag and Drop Multiple File Upload
- Fixed in
- 1.3.6.5
- What to do
- Update Drag and Drop Multiple File Upload to 1.3.6.5 or newer.
Oct 11, 2022Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at: Unauthenticated Options Change and Content InjectionCVE-2021-36913 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Options Change and Content Injection vulnerability in Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at WordPress allows attackers to change options and inject scripts into the footer HTML. Requires an additional extension (plugin) AccessiBe.
- Product
- Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update Qube One Redirection for Contact Form 7 plugin <= 2.4.0 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 10, 2022Advanced Comment Form: Does not sanitise and escape its settingsCVE-2022-3220 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Advanced Comment Form
- Fixed in
- 1.2.1
- What to do
- Update Advanced Comment Form to 1.2.1 or newer.
Oct 10, 2022The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & GraCVE-2022-3154 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license
- Fixed in
- 4.4.5.4
- What to do
- Update the plugin to 4.4.5.4 or newer.
Sep 26, 2022Ninja Forms Contact Form: Unserialises the content of an imported fileCVE-2022-2903 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.13
- What to do
- Update Ninja Forms Contact Form to 3.6.13 or newer.
Sep 23, 2022Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPressCVE-2022-40194 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress
- Affected
- up to 5.3.5
- What to do
- Affects up to 5.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.CVE-2022-36791 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 19, 2022NEX-Forms: Does not properly sanitise and escape user input before using it in SQL statementsCVE-2022-3142 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Product
- NEX-Forms
- Fixed in
- 7.9.7
- What to do
- Update NEX-Forms to 7.9.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.commedium.com
Sep 19, 2022Form Builder CP: Does not sanitise and escape some of its form settingsCVE-2022-2567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Form Builder CP
- Fixed in
- 1.2.32
- What to do
- Update Form Builder CP to 1.2.32 or newer.
Sep 9, 2022Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.CVE-2022-40191 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 6, 2022WP Libre Form 2 plugin <= 2.0.8 at: Unauthenticated Sensitive Information DisclosureCVE-2022-34867 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions. Affects only versions from 2.0.0 to 2.0.8.
- Product
- WP Libre Form 2 plugin <= 2.0.8 at
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update WP Libre Form 2 plugin <= 2.0.8 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compatchstack.com
Sep 6, 2022Transposh WordPress Translation: Sensitive information disclosure to unauthenticated usersCVE-2022-2462 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.9.6
- What to do
- Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Sep 5, 2022Simple Payment Donations & Subscriptions: Does not sanitise and escape user input given in its formsCVE-2022-2565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
- Product
- Simple Payment Donations & Subscriptions
- Fixed in
- 4.2.1
- What to do
- Update Simple Payment Donations & Subscriptions to 4.2.1 or newer.
Aug 29, 2022Mailchimp for WooCommerce: Has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LANCVE-2022-2556 · WordPress plugins & themes · reported by WPScanLow 2.7
The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
- Product
- Mailchimp for WooCommerce
- Fixed in
- 2.7.2
- What to do
- Update Mailchimp for WooCommerce to 2.7.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.