Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

428new WordPress flaws this week

399,168entries in the database

41,587 results · page 706 of 832

Apr 10, 2023WordPress Amazon S3: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0423 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Amazon S3 Plugin WordPress plugin before 1.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WordPress Amazon S3
Fixed in
1.6
What to do
Update WordPress Amazon S3 to 1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Article Directory: Does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panelCVE-2023-0422 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Article Directory WordPress plugin through 1.3 does not properly sanitize the `publish_terms_text` setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts.
Product
Article Directory
Affected
up to 1.3
What to do
Affects up to 1.3. Update Article Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Scheduled Announcements Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0363 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Scheduled Announcements Widget
Fixed in
1.0
What to do
Update Scheduled Announcements Widget to 1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023All-In-One Security (AIOS): Does not escape the content of log files before outputting it to the plugin admin pageCVE-2023-0157 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user (admin+) to plant bogus log files containing malicious JavaScript code that will be executed in the context of any administrator visiting this page.
Product
All-In-One Security (AIOS)
Fixed in
5.1.5
What to do
Update All-In-One Security (AIOS) to 5.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023All-In-One Security (AIOS): Does not limit what log files to display in it's settings pagesCVE-2023-0156 · WordPress plugins & themes · reported by WPScanMedium 4.9
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user (admin+) to view the contents of arbitrary files and list directories anywhere on the server (to which the web server has access). The plugin only displays the last 50 lines of the file.
Product
All-In-One Security (AIOS)
Fixed in
5.1.5
What to do
Update All-In-One Security (AIOS) to 5.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023WP Tiles: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4827 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Tiles WordPress plugin through 1.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Tiles
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Tiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress.CVE-2015-10099 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.
Product
CP Appointment Calendar
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update CP Appointment Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Apr 9, 2023A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress.CVE-2014-125096 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file class.options.php of the component Options Page. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.13 is able to address this issue. The identifier of the patch is fdf1f9e5a1ec738900f962e69c6fa4ec6055ed8d. It is recommended to upgrade the affected component. The identifier VDB-225349 was assigned to this vulnerability.
Fixed in
1.5.13
What to do
Update the plugin to 1.5.13 or newer.
Full record and what to do →NVD record github.com vuldb.com
Apr 9, 2023A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress.CVE-2012-10011 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the function hd_add_media/hd_update_media of the file functions.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 34d66b9f3231a0e2dc0e536a6fe615d736e863f7. It is recommended to upgrade the affected component. VDB-225350 is the identifier assigned to this vulnerability.
Product
HD FLV PLayer
Affected
up to 1.7
What to do
Affects up to 1.7. Update HD FLV PLayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Apr 9, 2023A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic.CVE-2014-125095 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
Affected
1.3.4 to 1.3.4
What to do
Affects 1.3.4 to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Apr 8, 2023A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic.CVE-2013-10025 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this issue is the function exitpageadmin of the file exitpage.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.59 is able to address this issue. The patch is identified as d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. VDB-225266 is the identifier assigned to this vulnerability.
Affected
1.55 to 1.55
What to do
Affects 1.55 to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Apr 8, 2023A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic.CVE-2013-10024 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the file exitpage.php. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.59 is able to address this issue. The identifier of the patch is d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. The identifier VDB-225265 was assigned to this vulnerability.
Affected
1.55 to 1.55
What to do
Affects 1.55 to 1.55. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Apr 8, 2023A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress.CVE-2015-10098 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue is the function print_module_list/show_warnings_section_notice/status_text/ui_get_action_links. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10.6 is able to address this issue. The name of the patch is f30638869e281461b87548e40b517738b4350e47. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225152.
Product
Broken Link Checker
Affected
up to 1.10.5
What to do
Affects up to 1.10.5. Update Broken Link Checker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Apr 8, 2023A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress.CVE-2013-10023 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability was found in Editorial Calendar Plugin up to 2.6 on WordPress. It has been declared as critical. Affected by this vulnerability is the function edcal_filter_where of the file edcal.php. The manipulation of the argument edcal_startDate/edcal_endDate leads to sql injection. The attack can be launched remotely. Upgrading to version 2.7 is able to address this issue. The patch is named a9277f13781187daee760b4dfd052b1b68e101cc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-225151.
Product
Editorial Calendar
Affected
up to 2.6
What to do
Affects up to 2.6. Update Editorial Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Apr 7, 2023Unauth.CVE-2023-29388 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions.
Fixed in
1.7.0
What to do
Update the plugin to 1.7.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-29172 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.46 versions.
Fixed in
1.5.47
What to do
Update the plugin to 1.5.47 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-29171 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-site Scripting (XSS) vulnerability in Magic Post Thumbnail plugin <= 4.1.10 versions.
Fixed in
4.1.11
What to do
Update the plugin to 4.1.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-29170 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in PI Websolution Product Enquiry for WooCommerce, WooCommerce product catalog plugin <= 2.2.12 versions.
Fixed in
2.2.13
What to do
Update the plugin to 2.2.13 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-28792 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions.
Fixed in
1.0.16
What to do
Update the plugin to 1.0.16 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-28789 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions.
Fixed in
1.5.5
What to do
Update the plugin to 1.5.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-28781 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions.
Fixed in
1.5.5
What to do
Update the plugin to 1.5.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-27620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-site Scripting (XSS) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.12 versions.
Fixed in
3.2.13
What to do
Update the plugin to 3.2.13 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25442 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Marcel Pol Zeno Font Resizer plugin <= 1.7.9 versions.
Fixed in
1.8.0
What to do
Update the plugin to 1.8.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-23799 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Leonardo Giacone Easy Panorama plugin <= 1.1.4 versions.
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-29094 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.20 versions.
Fixed in
1.3.21
What to do
Update the plugin to 1.3.21 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-25713 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
Fixed in
5.7.26
What to do
Update the plugin to 5.7.26 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25712 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-Buddy Google Analytics Opt-Out plugin <= 2.3.4 versions.
Fixed in
2.3.5
What to do
Update the plugin to 2.3.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-25711 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPGlobus WPGlobus Translate Options plugin <= 2.1.0 versions.
Fixed in
2.2.0
What to do
Update the plugin to 2.2.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25705 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Go Prayer WP Prayer plugin <= 1.9.6 versions.
Fixed in
1.9.7
What to do
Update the plugin to 1.9.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25702 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.
Fixed in
5.7.26
What to do
Update the plugin to 5.7.26 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25464 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in StreamWeasels Twitch Player plugin <= 2.1.0 versions.
Fixed in
2.1.1
What to do
Update the plugin to 2.1.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-29236 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions.
Fixed in
3.9.7
What to do
Update the plugin to 3.9.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-28993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On Line plugin <= 4.6.1 versions.
Fixed in
4.6.2
What to do
Update the plugin to 4.6.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions.CVE-2023-25716 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions.
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25049 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.4 versions.
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-25041 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Monolit theme <= 2.0.6 versions.
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25031 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1 versions.
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Unauth.CVE-2023-25020 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.
Affected
up to 2.7.1.1
What to do
Affects up to 2.7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-23994 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcel Bootsman Auto Hide Admin Bar plugin <= 1.6.1 versions.
Affected
up to 1.6.1
What to do
Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-23885 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.
Affected
up to 8.0.3.1
What to do
Affects up to 8.0.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25027 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Chained Quiz plugin <= 1.3.2.5 versions.
Affected
up to 1.3.2.5
What to do
Affects up to 1.3.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25024 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Icegram Icegram Collect plugin <= 1.3.8 versions.
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25023 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saleswonder.Biz Webinar ignition plugin <= 2.14.2 versions.
Affected
up to 2.14.2
What to do
Affects up to 2.14.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25022 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Watu Quiz plugin <= 3.3.8 versions.
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25046 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.2 versions.
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-24398 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Snap Creek Software EZP Coming Soon Page plugin <= 1.0.7.3 versions.
Affected
up to 1.0.7.3
What to do
Affects up to 1.0.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25061 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.
Affected
up to 2.7.1.1
What to do
Affects up to 2.7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-25059 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in avalex GmbH avalex – Automatically secure legal texts plugin <= 3.0.3 versions.
Affected
up to 3.0.3
What to do
Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 7, 2023Auth.CVE-2023-24402 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Veribo, Roland Murg WP Booking System – Booking Calendar plugin <= 2.0.18 versions.
Affected
up to 2.0.18
What to do
Affects up to 2.0.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023WP Fastest Cache: Unauthorized data lossCVE-2023-1931 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the deleteCssAndJsCacheToolbar function in versions up to, and including, 1.1.2. This makes it possible for authenticated attackers with subscriber-level access to perform cache deletion.
Product
WP Fastest Cache
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Fastest Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.