Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

428new WordPress flaws this week

399,168entries in the database

41,587 results · page 708 of 832

Apr 5, 2023YourChannel: Cross-Site Request ForgeryCVE-2023-1870 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on the saveLang function. This makes it possible for unauthenticated attackers to change the plugin's quick language translation settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
YourChannel
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2023YourChannel: Stored Cross-Site ScriptingCVE-2023-1869 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
YourChannel
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 5, 2023YourChannel: Unauthorized loss of dataCVE-2023-1868 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_clear_cache GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to clear the plugin's cache.
Product
YourChannel
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2023YourChannel: Cross-Site Request ForgeryCVE-2023-1867 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
YourChannel
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2023YourChannel: Cross-Site Request ForgeryCVE-2023-1866 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The YourChannel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on the clearKeys function. This makes it possible for unauthenticated attackers to reset the plugin's channel settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
YourChannel
Affected
up to 1.2.4
What to do
Affects up to 1.2.4. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2023YourChannel: Unauthorized loss of dataCVE-2023-1865 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin settings via the yrc_nuke GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to delete YouTube channels from the plugin.
Product
YourChannel
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2023A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress.CVE-2013-10022 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
Affected
3.51 to 3.51
What to do
Affects 3.51 to 3.51. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Apr 5, 2023Auth.CVE-2023-26536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.05 versions.
Fixed in
2.06
What to do
Update the plugin to 2.06 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Sp*tify Play Button for: Stored Cross-Site ScriptingCVE-2023-1840 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Sp*tify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.07 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Sp*tify Play Button for
Affected
up to 2.07
What to do
Affects up to 2.07. Update Sp*tify Play Button for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2023Auth.CVE-2023-23977 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments plugin <= 1.6.1 versions.
Fixed in
1.6.2
What to do
Update the plugin to 1.6.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23870 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 versions.
Fixed in
1.5.9
What to do
Update the plugin to 1.5.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23878 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS plugin <= 4.3.9 versions.
Fixed in
4.4.0
What to do
Update the plugin to 4.4.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23821 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcin Pietrzak Interactive Polish Map plugin <= 1.2 versions.
Fixed in
1.2.1
What to do
Update the plugin to 1.2.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23686 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brett Shumaker Simple Staff List plugin <= 2.2.2 versions.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23685 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin <= 2.8.10 versions.
Fixed in
2.8.11
What to do
Update the plugin to 2.8.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versioCVE-2022-41633 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.2.0 versions.
Fixed in
6.0.3.0
What to do
Update the plugin to 6.0.3.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 3, 2023Solidres: Does not sanitise and escape numerous parameter before outputting them back in pagesCVE-2023-1377 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Solidres
Affected
up to 0.9.4
What to do
Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 3, 2023Redirection: Does not add nonce verification in placeCVE-2023-1330 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack.
Product
Redirection
Fixed in
1.1.4
What to do
Update Redirection to 1.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 3, 2023Shopping Cart & eCommerce Store: Does not validate HTTP requestsCVE-2023-1124 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks.
Product
Shopping Cart & eCommerce Store
Fixed in
5.4.3
What to do
Update Shopping Cart & eCommerce Store to 5.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 3, 2023User Role by BestWebSoft: Does not protect against CSRF in requests to update role capabilitiesCVE-2023-0820 · WordPress plugins & themes · reported by WPScanHigh 8.8
The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.
Product
User Role by BestWebSoft
Fixed in
1.6.7
What to do
Update User Role by BestWebSoft to 1.6.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 3, 2023Image Over Image For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0399 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Image Over Image For WPBakery Page Builder
Fixed in
3.0
What to do
Update Image Over Image For WPBakery Page Builder to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 3, 2023Auth.CVE-2023-26529 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DupeOff.Com DupeOff plugin <= 1.6 versions.
Affected
up to 1.6
What to do
Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-25040 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.
Fixed in
5.12.7
What to do
Update the plugin to 5.12.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-24399 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions.
Fixed in
2.1.3
What to do
Update the plugin to 2.1.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-23681 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Labib Ahmed Image Hover Effects For WPBakery Page Builder plugin <= 4.0 versions.
Fixed in
5.0
What to do
Update the plugin to 5.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.CVE-2023-23677 · WordPress plugins & themes · reported by PatchstackLow 3.8
Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.
Fixed in
0.4.6
What to do
Update the plugin to 0.4.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-23675 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catchsquare WP Smart Preloader plugin <= 1.15 versions.
Fixed in
1.15.1
What to do
Update the plugin to 1.15.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-23670 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions.
Fixed in
1.2.11
What to do
Update the plugin to 1.2.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Collne Inc: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-22705 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin <= 2.8.10 versions.
Product
Collne Inc
Affected
up to 2.8.10
What to do
Affects up to 2.8.10. Update Collne Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47602 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in JoomUnited WP Table Manager plugin <= 3.5.2 versions.
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47613 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud AI ChatBot plugin <= 4.3.0 versions.
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47610 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mr Digital Simple Image Popup plugin <= 1.3.6 versions.
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47607 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Usersnap plugin <= 4.16 versions.
Affected
up to 4.16
What to do
Affects up to 4.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Unauth.CVE-2022-47603 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.1 versions.
Fixed in
2.0.2
What to do
Update the plugin to 2.0.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-45355 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Auth. (admin+) SQL Injection (SQLi) vulnerability in ThimPress WP Pipes plugin <= 1.33 versions.
Affected
up to 1.33
What to do
Affects up to 1.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47596 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 1.9.9 versions.
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Mega Main Menu: Stored Cross-Site ScriptingCVE-2023-1575 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Mega Main Menu
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Mega Main Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 29, 2023Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions.CVE-2023-23861 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions.
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Unauth.CVE-2022-47444 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.5.3 versions.
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47438 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions.
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Unauth.CVE-2022-47433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin CVE-2022-38077 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
Affected
up to 2.2.1
What to do
Affects up to 2.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023GMAce: Cross-Site Request ForgeryCVE-2023-1509 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The GMAce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.2. This is due to missing nonce validation on the gmace_manager_server function called via the wp_ajax_gmace_manager AJAX action. This makes it possible for unauthenticated attackers to modify arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
GMAce
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update GMAce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 28, 2023Auth.CVE-2023-25704 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mehjabin Orthi Interactive SVG Image Map Builder plugin <= 1.0 versions.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Unlimited Elements Unlimited Elements For Elementor: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-47170 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.48 versions.
Product
Unlimited Elements Unlimited Elements For Elementor
Fixed in
1.5.49
What to do
Update Unlimited Elements Unlimited Elements For Elementor to 1.5.49 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Auth.CVE-2022-46863 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.6.4 versions.
Fixed in
9.6.5
What to do
Update the plugin to 9.6.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Auth.CVE-2022-46855 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP Darko Responsive Pricing Table plugin <= 5.1.6 versions.
Fixed in
5.1.7
What to do
Update the plugin to 5.1.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Auth.CVE-2022-46848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <= 3.9.1 versions.
Fixed in
3.9.2
What to do
Update the plugin to 3.9.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Unauth.CVE-2022-45831 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in biplob018 Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 2.8 versions.
Affected
up to 2.8
What to do
Affects up to 2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Unauth.CVE-2022-45825 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in iThemes WPComplete plugin <= 2.9.2 versions.
Fixed in
2.9.5
What to do
Update the plugin to 2.9.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.