Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,587 results · page 703 of 832
May 3, 2023Auth.CVE-2023-22713 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin <= 2.1.8 versions.
- Fixed in
- 2.1.9
- What to do
- Update the plugin to 2.1.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Auth.CVE-2023-25797 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions.
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Auth.CVE-2023-25792 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XiaoMac WP Open Social plugin <= 5.0 versions.
- Affected
- up to 5.0
- What to do
- Affects up to 5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Auth.CVE-2023-25789 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tapfiliate plugin <= 3.0.12 versions.
- Affected
- up to 3.0.12
- What to do
- Affects up to 3.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Auth.CVE-2023-25787 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wbolt team WP资源下载管理 plugin <= 1.3.9 versions.
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Auth.CVE-2023-25786 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Thom Stark Eyes Only: User Access Shortcode plugin <= 1.8.2 versions.
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Auth.CVE-2023-25784 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bon Plan Gratos Sticky Ad Bar plugin <= 1.3.1 versions.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Auth.CVE-2023-25783 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Moss FireCask Like & Share Button plugin <= 1.1.5 versions.
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.CVE-2023-23790 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.
- Fixed in
- 2.9.11
- What to do
- Update the plugin to 2.9.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.CVE-2023-22691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2023Auth.CVE-2023-23723 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.
- Fixed in
- 3.10
- What to do
- Update the plugin to 3.10 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2023Easy Digital Downloads: Improper AuthenticationCVE-2023-30869 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1.
- Product
- Easy Digital Downloads
- Affected
- up to 3.1.1.4.1
- What to do
- Affects up to 3.1.1.4.1. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2023The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow useCVE-2023-1196 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields (ACF) Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present.
- Fixed in
- 6.1.0
- What to do
- Update the plugin to 6.1.0 or newer.
May 2, 2023Blocksy Companion: Does not ensure that posts to be accessed via a shortcode are already public and can be viewedCVE-2023-1911 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example
- Product
- Blocksy Companion
- Fixed in
- 1.8.82
- What to do
- Update Blocksy Companion to 1.8.82 or newer.
May 2, 2023Limit Login Attempts: Does not sanitize and escape usernamesCVE-2023-1861 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
- Product
- Limit Login Attempts
- Affected
- up to 1.7.2
- What to do
- Affects up to 1.7.2. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2023Download Manager: Leaks master key information without the need for a passwordCVE-2023-1809 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files.
- Product
- Download Manager
- Fixed in
- 6.3.0
- What to do
- Update Download Manager to 6.3.0 or newer.
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the page parameter before outputting it back in an attributeCVE-2023-1805 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Product Catalog Feed by PixelYourSite
- Fixed in
- 2.1.1
- What to do
- Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the edit parameter before outputting it back in an attributeCVE-2023-1804 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
- Product
- Product Catalog Feed by PixelYourSite
- Fixed in
- 2.1.1
- What to do
- Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
May 2, 2023SupportCandy: Does not validate and escape user input before using it in an SQL statementCVE-2023-1730 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks
- Product
- SupportCandy
- Fixed in
- 3.1.5
- What to do
- Update SupportCandy to 3.1.5 or newer.
May 2, 2023SEOPress: Unserializes user input provided via the settingsCVE-2023-1669 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- SEOPress
- Fixed in
- 6.5.0.3
- What to do
- Update SEOPress to 6.5.0.3 or newer.
May 2, 2023WP Custom Author URL: Does not sanitise and escape some of its settingsCVE-2023-1614 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Custom Author URL
- Fixed in
- 1.0.5
- What to do
- Update WP Custom Author URL to 1.0.5 or newer.
May 2, 2023Quick Paypal Payments: Does not sanitise and escape some of its settingsCVE-2023-1554 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quick Paypal Payments WordPress plugin before 5.7.26.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Quick Paypal Payments
- Fixed in
- 5.7.26.4
- What to do
- Update Quick Paypal Payments to 5.7.26.4 or newer.
May 2, 2023MyCryptoCheckout: Does not escape some URLs before outputting them in attributesCVE-2023-1546 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MyCryptoCheckout WordPress plugin before 2.124 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
- Product
- MyCryptoCheckout
- Fixed in
- 2.124
- What to do
- Update MyCryptoCheckout to 2.124 or newer.
May 2, 2023Site Reviews: Does not sanitise and escape some of its settingsCVE-2023-1525 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Site Reviews
- Fixed in
- 6.7.1
- What to do
- Update Site Reviews to 6.7.1 or newer.
May 2, 2023Ruby Help Desk: Does not ensure that the ticket being modified belongs to the user making the requestCVE-2023-1125 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
- Product
- Ruby Help Desk
- Fixed in
- 1.3.4
- What to do
- Update Ruby Help Desk to 1.3.4 or newer.
May 2, 2023SMTP Mailing Queue: Does not sanitise and escape some of its settingsCVE-2023-1090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SMTP Mailing Queue WordPress plugin before 2.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SMTP Mailing Queue
- Fixed in
- 2.0.1
- What to do
- Update SMTP Mailing Queue to 2.0.1 or newer.
May 2, 2023amr ical events lists: Does not sanitise and escape some of its settingsCVE-2023-1021 · WordPress plugins & themes · reported by WPScanMedium 4.8
The amr ical events lists WordPress plugin through 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- amr ical events lists
- Affected
- up to 6.6
- What to do
- Affects up to 6.6. Update amr ical events lists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2023ZYREX POPUP: Does not validate the type of files uploadedCVE-2023-0924 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ZYREX POPUP WordPress plugin through 1.0 does not validate the type of files uploaded when creating a popup, allowing a high privileged user (such as an Administrator) to upload arbitrary files, even when modifying the file system is disallowed, such as in a multisite install.
- Product
- ZYREX POPUP
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update ZYREX POPUP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2023StagTools: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0891 · WordPress plugins & themes · reported by WPScanMedium 5.4
The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- StagTools
- Fixed in
- 2.3.7
- What to do
- Update StagTools to 2.3.7 or newer.
May 1, 2023A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress.CVE-2014-125100 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in BestWebSoft Job Board Plugin 1.0.0 on WordPress. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is dbb71deee071422ce3e663fbcdce3ad24886f940. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227764.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2023A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress.CVE-2013-10026 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Mail Subscribe List Plugin up to 2.0.10 on WordPress. This issue affects some unknown processing of the file index.php. The manipulation of the argument sml_name/sml_email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.1 is able to address this issue. The identifier of the patch is 484970ef8285cae51d2de3bd4e4684d33c956c28. It is recommended to upgrade the affected component. The identifier VDB-227765 was assigned to this vulnerability.
- Product
- Mail Subscribe List
- Affected
- up to 2.0.10
- What to do
- Affects up to 2.0.10. Update Mail Subscribe List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 30, 2023A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress.CVE-2015-10105 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function valid_js_identifier of the file ip_blacklist_cloud.php of the component CSV File Import. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. Upgrading to version 3.43 is able to address this issue. The identifier of the patch is 6e6fe8c6fda7cbc252eef083105e08d759c07312. It is recommended to upgrade the affected component. The identifier VDB-227757 was assigned to this vulnerability.
- Product
- IP Blacklist Cloud
- Affected
- up to 3.42
- What to do
- Affects up to 3.42. Update IP Blacklist Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 30, 2023A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress.CVE-2015-10104 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.
- Affected
- 1.0.0 to 1.0.0
- What to do
- Affects 1.0.0 to 1.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2023Profile Builder – User Profile & User Registration Forms: Unauthorized password resetsCVE-2023-2297 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
- Product
- Profile Builder – User Profile & User Registration Forms
- Affected
- up to 3.9.0
- What to do
- Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Apr 25, 2023Auth.CVE-2023-25461 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in namithjawahar Wp-Insert plugin <= 2.5.0 versions.
- Fixed in
- 2.5.1
- What to do
- Update the plugin to 2.5.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-24005 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin plugin <= 2.5.3 versions.
- Fixed in
- 2.6
- What to do
- Update the plugin to 2.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-23995 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin <= 1.1.2 versions.
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-23889 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
- Affected
- up to 5.7.25
- What to do
- Affects up to 5.7.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-23866 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Carlos Moreira Interactive Geo Maps plugin <= 1.5.8 versions.
- Fixed in
- 1.5.9
- What to do
- Update the plugin to 1.5.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023miniOrange WordPress Social Login and Register: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23710 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
- Product
- miniOrange WordPress Social Login and Register
- Fixed in
- 7.6.0
- What to do
- Update miniOrange WordPress Social Login and Register to 7.6.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-25793 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 versions.
- Fixed in
- 2.0.3
- What to do
- Update the plugin to 2.0.3 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-25485 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions.
- Fixed in
- 1.3.16
- What to do
- Update the plugin to 1.3.16 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-25484 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions.
- Fixed in
- 2.1.9
- What to do
- Update the plugin to 2.1.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2022-47608 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.
- Fixed in
- 8.0.4
- What to do
- Update the plugin to 8.0.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.CVE-2023-27619 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-25710 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0 versions.
- Fixed in
- 1.5.0
- What to do
- Update the plugin to 1.5.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-25490 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions.
- Fixed in
- 1.7.5
- What to do
- Update the plugin to 1.7.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Auth.CVE-2023-25479 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.
- Fixed in
- 1.3.9
- What to do
- Update the plugin to 1.3.9 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.CVE-2022-45837 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2023WPCode: Has a flawed CSRFCVE-2023-1624 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the expected folder. This could allow attackers to make users with the wpcode_activate_snippets capability delete arbitrary log files on the server, including outside of the blog folders
- Product
- WPCode
- Fixed in
- 2.0.9
- What to do
- Update WPCode to 2.0.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.