Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

41,587 results · page 712 of 832

Mar 13, 2023Widgets for WooCommerce Products on Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4661 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Widgets for WooCommerce Products on Elementor
Fixed in
1.0.8
What to do
Update Widgets for WooCommerce Products on Elementor to 1.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Video Background: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4652 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Background WordPress plugin before 2.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Video Background
Fixed in
2.7.5
What to do
Update Video Background to 2.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023WordPress Infinite Scroll: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4466 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WordPress Infinite Scroll
Fixed in
5.6.0.3
What to do
Update WordPress Infinite Scroll to 5.6.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3.0.2 versions.CVE-2023-25973 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3.0.2 versions.
Affected
up to 6.3.0.2
What to do
Affects up to 6.3.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in A2 Hosting A2 Optimized WP plugin <= 3.0.4 versions.CVE-2023-23711 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in A2 Hosting A2 Optimized WP plugin <= 3.0.4 versions.
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2023PixelYourSite PixelYourSite – Your smart PIXEL: Cross-Site Request Forgery (CSRF)CVE-2023-22700 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 9.3.0 versions.
Product
PixelYourSite PixelYourSite – Your smart PIXEL
Affected
up to 9.3.0
What to do
Affects up to 9.3.0. Update PixelYourSite PixelYourSite – Your smart PIXEL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions.CVE-2023-25991 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic plugin <= 5.1.9.2 versions.
Affected
up to 5.1.9.2
What to do
Affects up to 5.1.9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2023SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.CVE-2022-38074 · WordPress plugins & themes · reported by PatchstackHigh 7.1
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.
Affected
up to 13.2.10
What to do
Affects up to 13.2.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2023BackupBuddy: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2022-31474 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1.
Product
BackupBuddy
Affected
up to 8.7.4.1
What to do
Affects up to 8.7.4.1. Update BackupBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ithemes.com patchstack.com
Mar 13, 2023Solidres: Stored Cross-Site ScriptingCVE-2023-1374 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currency_name' parameter in versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Solidres
Affected
up to 0.9.4
What to do
Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record danielkelley.me plugins.trac.wordpress.org
Mar 13, 2023WH Testimonials: Stored Cross-Site ScriptingCVE-2023-1372 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WH Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as wh_homepage, wh_text_short, wh_text_full and in versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WH Testimonials
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update WH Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record danielkelley.me plugins.trac.wordpress.org
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions.CVE-2022-47440 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions.
Affected
up to 1.9.10
What to do
Affects up to 1.9.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.1.1 versions.CVE-2022-47166 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.1.1 versions.
Fixed in
2.2
What to do
Update the plugin to 2.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 11, 2023A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress.CVE-2013-10021 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.8.1 is able to address this issue. The patch is named 0842af8f8a556bc3e39b9ef758173b0a8a9ccbfc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222739.
Product
dd32 Debug Bar
Affected
up to 0.8
What to do
Affects up to 0.8. Update dd32 Debug Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1346 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the clear_page_cache function. This makes it possible for unauthenticated attackers to clear the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1345 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the queue_posts function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1344 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the uucss_update_rule function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1343 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the attach_rule function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1342 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ucss_connect function. This makes it possible for unauthenticated attackers to connect the site to a new license key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ajax_deactivate function. This makes it possible for unauthenticated attackers to turn off caching via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1340 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the clear_uucss_logs function. This makes it possible for unauthenticated attackers to clear plugin logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized settings updateCVE-2023-1339 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the uucss_update_rule function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to update caching rules.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized cache modificationCVE-2023-1338 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the attach_rule function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify cache rules.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized data lossCVE-2023-1337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the clear_uucss_logs function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete plugin log files.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized settings updateCVE-2023-1336 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajax_deactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to disable caching.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized plugin settings updateCVE-2023-1335 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the ucss_connect function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to connect a new license key to the site.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized cache modificationCVE-2023-1334 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the queue_posts function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify the plugin's cache.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized loss of dataCVE-2023-1333 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_page_cache function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete the plugin's cache.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 9, 2023A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic.CVE-2014-125093 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability affects unknown code of the file ad-blocking-detector.php. The manipulation leads to information disclosure. The attack can be initiated remotely. Upgrading to version 1.2.2 is able to address this issue. The patch is identified as 3312b9cd79e5710d1e282fc9216a4e5ab31b3d94. It is recommended to upgrade the affected component. VDB-222610 is the identifier assigned to this vulnerability.
Product
Ad Blocking Detector
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Ad Blocking Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 9, 2023A vulnerability, which was classified as problematic, was found in MMDeveloper A Forms Plugin up to 1.4.2 on WordPress.CVE-2013-10020 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in MMDeveloper A Forms Plugin up to 1.4.2 on WordPress. This affects an unknown part of the file a-forms.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The identifier of the patch is 3e693197bd69b7173cc16d8d2e0a7d501a2a0b06. It is recommended to upgrade the affected component. The identifier VDB-222609 was assigned to this vulnerability.
Product
MMDeveloper A Forms
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update MMDeveloper A Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Mar 7, 2023CMP – Coming Soon & Maintenance: Information ExposureCVE-2023-1263 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled.
Product
CMP – Coming Soon & Maintenance
Affected
up to 4.1.6
What to do
Affects up to 4.1.6. Update CMP – Coming Soon & Maintenance to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023NEX-Forms.: Unauthorized disclosure and modification of dataCVE-2020-36670 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The NEX-Forms. plugin for WordPress is vulnerable to unauthorized disclosure and modification of data in versions up to, and including 7.7.1 due to missing capability checks on several AJAX actions. This makes it possible for authenticated attackers with subscriber level permissions and above to invoke these functions which can be used to perform actions like modify form submission records, deleting files, sending test emails, modifying plugin settings, and more.
Product
NEX-Forms.
Affected
up to 7.7.1
What to do
Affects up to 7.7.1. Update NEX-Forms. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023Total Upkeep: Information disclosureCVE-2022-4932 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Total Upkeep plugin for WordPress is vulnerable to information disclosure in versions up to, and including 1.14.13. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
Product
Total Upkeep
Affected
up to 1.14.13
What to do
Affects up to 1.14.13. Update Total Upkeep to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023BackupWordPress: Information disclosureCVE-2022-4931 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. This is due to missing authorization on the heartbeat_received() function that triggers on WordPress heartbeat. This makes it possible for authenticated attackers, with subscriber-level permissions and above to retrieve back-up paths that can subsequently be used to download the back-up.
Product
BackupWordPress
Affected
up to 3.12
What to do
Affects up to 3.12. Update BackupWordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023WP Statistics: Cross-Site Request ForgeryCVE-2021-4333 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Statistics
Affected
up to 13.1.1
What to do
Affects up to 13.1.1. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023Plus Addons for Elementor: Arbitrary file readsCVE-2021-4332 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an "Info Box" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.
Product
Plus Addons for Elementor
Affected
up to 4.1.9
What to do
Affects up to 4.1.9. Update Plus Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023Plus Addons for Elementor: Privilege escalationCVE-2021-4331 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Plus Addons for Elementor plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin adds a registration form to the Elementor page builders functionality. As part of the registration form, users can choose which role to set as the default for users upon registration. This field is not hidden for lower-level users so any user with access to the Elementor page builder, such as contributors, can set the default role to administrator. Since contributors can not publish posts, only author+ users can elevate privileges without interaction via a site administrator (to approve a post).
Product
Plus Addons for Elementor
Affected
up to 4.1.9
What to do
Affects up to 4.1.9. Update Plus Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in UpThemes Theme DesignFolio Plus 1.2 on WordPress and classified as problematic.CVE-2015-10087 · WordPress plugins & themes · reported by VulDBMedium 6.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in UpThemes Theme DesignFolio Plus 1.2 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 53f6ae62878076f99718e5feb589928e83c879a9. It is recommended to apply a patch to fix this issue. The identifier VDB-221809 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected
up to 1.2
What to do
Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com support.alertlogic.com
Mar 7, 2023The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file tCVE-2021-4330 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for attackers with contributor-lever permissions and above to upload arbitrary files and potentially gain remote code execution in versions up to and including 1.0.13 of Template Kit – Import and versions up to and including 2.0.10 of Envato Elements & Download.
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Cross-Site Request ForgeryCVE-2020-36669 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backup_guard_get_import_backup() function. This makes it possible for unauthenticated attackers to upload arbitrary files to the vulnerable site's server via a forged request, granted they can trick a site's administrator into performing an action such as clicking on a link.
Product
JetBackup – WP Backup, Migrate & Restore
Affected
up to 1.3.9
What to do
Affects up to 1.3.9. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Sensitive information disclosureCVE-2020-36668 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.
Product
JetBackup – WP Backup, Migrate & Restore
Affected
up to 1.4.0
What to do
Affects up to 1.4.0. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 7, 2023JetBackup – WP Backup, Migrate & Restore: Unauthorized back-up location changesCVE-2020-36667 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backup_guard_cloud_dropbox, backup_guard_cloud_gdrive, and backup_guard_cloud_oneDrive functions. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to change to location of back-ups and potentially steal sensitive information from them.
Product
JetBackup – WP Backup, Migrate & Restore
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update JetBackup – WP Backup, Migrate & Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 6, 2023A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress.CVE-2015-10095 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability classified as problematic has been found in woo-popup Plugin up to 1.2.2 on WordPress. This affects an unknown part of the file admin/class-woo-popup-admin.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.3.0 is able to address this issue. The patch is named 7c76ac78f3e16015991b612ff4fa616af4ce9292. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222327.
Product
woo-popup
Affected
up to 1.2.2
What to do
Affects up to 1.2.2. Update woo-popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 6, 2023A vulnerability was found in Fastly Plugin up to 0.97 on WordPress.CVE-2015-10094 · WordPress plugins & themes · reported by VulDBLow 2.4
A vulnerability was found in Fastly Plugin up to 0.97 on WordPress. It has been rated as problematic. Affected by this issue is the function post of the file lib/api.php. The manipulation of the argument url leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.98 is able to address this issue. The patch is identified as d7fe42538f4d4af500e3af9678b6b06fba731656. It is recommended to upgrade the affected component. VDB-222326 is the identifier assigned to this vulnerability.
Product
Fastly
Affected
up to 0.97
What to do
Affects up to 0.97. Update Fastly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 6, 2023Scriptless Social Sharing: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0377 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Scriptless Social Sharing
Fixed in
3.2.2
What to do
Update Scriptless Social Sharing to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023WPCode: Does not have adequate privilege checks in place for several AJAX actionsCVE-2023-0328 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).
Product
WPCode
Fixed in
2.0.7
What to do
Update WPCode to 2.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Advanced Recent Posts: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0212 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Advanced Recent Posts
Affected
up to 0.6.14
What to do
Affects up to 0.6.14. Update Advanced Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Cost Calculator: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0165 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Cost Calculator
Affected
up to 1.8
What to do
Affects up to 1.8. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Resume Builder: Does not sanitize and escape some parameters related to ResumeCVE-2023-0078 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users
Product
Resume Builder
Affected
up to 3.1.1
What to do
Affects up to 3.1.1. Update Resume Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Download Attachments: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0076 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Download Attachments
Fixed in
1.3
What to do
Update Download Attachments to 1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.