Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

41,587 results · page 710 of 832

Mar 23, 2023Auth.CVE-2023-22716 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.35 versions.
Fixed in
1.1.36
What to do
Update the plugin to 1.1.36 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Auth.CVE-2023-22715 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Lester 'GaMerZ' Chan WP-CommentNavi plugin <= 1.12.1 versions.
Fixed in
1.12.2
What to do
Update the plugin to 1.12.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Auth.CVE-2023-22712 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TemplatesNext TemplatesNext ToolKit plugin <= 3.2.7 versions.
Fixed in
3.2.8
What to do
Update the plugin to 3.2.8 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6: Auth. (admin+) Stored Cross-site Scripting (XSS)CVE-2023-28422 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.
Product
MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6
Fixed in
3.8.7
What to do
Update MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6 to 3.8.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 8.1.8 versions.CVE-2023-22704 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 8.1.8 versions.
Affected
up to 8.1.8
What to do
Affects up to 8.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.CVE-2022-47431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.
Fixed in
2.1.0
What to do
Update the plugin to 2.1.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Auth.CVE-2022-45843 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin <= 3.5.1.9 versions.
Fixed in
3.5.1.11
What to do
Update the plugin to 3.5.1.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Auth.CVE-2022-44742 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions.
Fixed in
1.4.9
What to do
Update the plugin to 1.4.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 22, 2023The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue.CVE-2023-28667 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue. The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present.
Affected
up to 1.23
What to do
Affects up to 1.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpCVE-2023-28666 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.
Affected
up to 2.1.4.1
What to do
Affects up to 2.1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the teCVE-2023-28665 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user.
Fixed in
2.2.2
What to do
Update the plugin to 2.2.2 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' paramCVE-2023-28664 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_CVE-2023-28663 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action.
Fixed in
3.11
What to do
Update the plugin to 3.11 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template paCVE-2023-28662 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.
Affected
up to 4.3.1
What to do
Affects up to 4.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_dCVE-2023-28661 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_data action.
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_rCVE-2023-28660 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action.
Affected
up to 2.3.14
What to do
Affects up to 2.3.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] paraCVE-2023-28659 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action.
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 21, 2023Auth.CVE-2022-42485 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions.
Fixed in
6.1
What to do
Update the plugin to 6.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2023Auth.CVE-2022-41831 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions.
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 21, 2023Auth.CVE-2022-41785 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions.
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress.CVE-2012-10009 · WordPress plugins & themes · reported by VulDBHigh 7.3
A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage of the file 404Like.php. The manipulation of the argument searchWord leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 2c4b589d27554910ab1fd104ddbec9331b540f7f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223404.
Product
404like
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update 404like to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 20, 2023ProfileGrid: Provides an AJAX endpoint for resetting a user password but does not implement proper authorizationCVE-2023-0940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
Product
ProfileGrid
Fixed in
5.3.1
What to do
Update ProfileGrid to 5.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023VK All in One Expansion Unit: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2023-0937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
VK All in One Expansion Unit
Fixed in
9.87.1.0
What to do
Update VK All in One Expansion Unit to 9.87.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not validate the user meta to be retrieved via the user shortcodeCVE-2023-0911 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
Product
WordPress Shortcodes Plugin — Shortcodes Ultimate
Fixed in
5.12.8
What to do
Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the requestCVE-2023-0890 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
Product
WordPress Shortcodes Plugin — Shortcodes Ultimate
Fixed in
5.12.8
What to do
Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WP Meta SEO: Does not authorize several ajax actionsCVE-2023-0876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability.
Product
WP Meta SEO
Fixed in
4.5.3
What to do
Update WP Meta SEO to 4.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WP Meta SEO: Does not properly sanitize and escape inputs into SQL queriesCVE-2023-0875 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.
Product
WP Meta SEO
Fixed in
4.5.3
What to do
Update WP Meta SEO to 4.5.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WooCommerce Multiple Customer Addresses & Shipping: Does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the requestCVE-2023-0865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.
Product
WooCommerce Multiple Customer Addresses & Shipping
Fixed in
21.7
What to do
Update WooCommerce Multiple Customer Addresses & Shipping to 21.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Paid Memberships Pro: Does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL queryCVE-2023-0631 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
Product
Paid Memberships Pro
Fixed in
2.9.12
What to do
Update Paid Memberships Pro to 2.9.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Slimstat Analytics: Does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL queryCVE-2023-0630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.
Product
Slimstat Analytics
Fixed in
4.9.3.3
What to do
Update Slimstat Analytics to 4.9.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WPB Advanced FAQ: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0370 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WPB Advanced FAQ
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update WPB Advanced FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023GoToWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0369 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
GoToWP
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update GoToWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023React Webcam: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0365 · WordPress plugins & themes · reported by WPScanMedium 5.4
The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
React Webcam
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update React Webcam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023real.Kit: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
real.Kit
Fixed in
5.1.1
What to do
Update real.Kit to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Custom Content Shortcode: Does not validate one of its shortcode attributeCVE-2023-0340 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
Product
Custom Content Shortcode
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Custom Content Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Custom Content Shortcode
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Responsive Clients Logo Gallery Plugin for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0175 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive Clients Logo Gallery Plugin for
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Responsive Clients Logo Gallery Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023GetResponse for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0167 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GetResponse for WordPress plugin through 5.5.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
GetResponse for
Affected
up to 5.5.31
What to do
Affects up to 5.5.31. Update GetResponse for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Saan World Clock: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0145 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Saan World Clock
Affected
up to 1.8
What to do
Affects up to 1.8. Update Saan World Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WP OAuth Server (OAuth Authentication): Has a flawed CSRF and authorisation checkCVE-2022-4148 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client.
Product
WP OAuth Server (OAuth Authentication)
Fixed in
4.3.0
What to do
Update WP OAuth Server (OAuth Authentication) to 4.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3894 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.
Product
WP OAuth Server (OAuth Authentication)
Fixed in
4.2.5
What to do
Update WP OAuth Server (OAuth Authentication) to 4.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.CVE-2022-47591 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions.CVE-2023-23721 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in David Gwyer Admin Log plugin <= 1.50 versions.
Affected
up to 1.50
What to do
Affects up to 1.50. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Auth.CVE-2023-23718 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Esstat17 Page Loading Effects plugin <= 2.0.0 versions.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.CVE-2023-22682 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.
Affected
up to 1.4.0.1
What to do
Affects up to 1.4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Auth.CVE-2023-22680 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Altanic No API Amazon Affiliate plugin <= 4.2.2 versions.
Affected
up to 4.2.2
What to do
Affects up to 4.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Auth.CVE-2023-22679 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Nicolas Lemoine WP Better Emails plugin <= 0.4 versions.
Affected
up to 0.4
What to do
Affects up to 0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.CVE-2023-22678 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rafael Dery Superior FAQ plugin <= 1.0.2 versions.
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions.CVE-2022-47592 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions.
Affected
up to 0.1
What to do
Affects up to 0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Auth.CVE-2023-25795 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in WP-master.Ir Feed Changer & Remover plugin <= 0.2 versions.
Affected
up to 0.2
What to do
Affects up to 0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.