Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

41,587 results · page 713 of 832

Mar 6, 2023WPaudio MP3 Player: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0069 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WPaudio MP3 Player
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update WPaudio MP3 Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Product GTIN (EAN, UPC, ISBN) for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0068 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Product GTIN (EAN, UPC, ISBN) for WooCommerce
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update Product GTIN (EAN, UPC, ISBN) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023i2 Pros & Cons: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0065 · WordPress plugins & themes · reported by WPScanMedium 5.4
The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
i2 Pros & Cons
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update i2 Pros & Cons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023eVision Responsive Column Layout Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0064 · WordPress plugins & themes · reported by WPScanMedium 5.4
The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
eVision Responsive Column Layout Shortcodes
Affected
up to 2.3
What to do
Affects up to 2.3. Update eVision Responsive Column Layout Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023WordPress Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0063 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WordPress Shortcodes
Affected
up to 1.6.36
What to do
Affects up to 1.6.36. Update WordPress Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023WooCommerce Checkout Field Manager: Does not validate files to be uploadedCVE-2022-4328 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
Product
WooCommerce Checkout Field Manager
Fixed in
18.0
What to do
Update WooCommerce Checkout Field Manager to 18.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Replyable: Does not validate the class name submitted by the requestCVE-2022-4265 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the prompt_dismiss_notice action and also lacks CSRF check in the related action. This could allow any authenticated users, such as subscriber to perform Object Injection attacks. The attack could also be done via a CSRF vector against any authenticated user
Product
Replyable
Fixed in
2.2.10
What to do
Update Replyable to 2.2.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress.CVE-2015-10093 · WordPress plugins & themes · reported by VulDBLow 2.6
A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is e7059727274d2767c240c55c02c163eaa4ba6c62. It is recommended to upgrade the affected component. The identifier VDB-222325 was assigned to this vulnerability.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
Mar 6, 2023A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress.CVE-2015-10092 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the function add_slug_meta_box of the file includes/class-qtranslate-slug.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.1.17 is able to address this issue. The name of the patch is 74b3932696f9868e14563e51b7d0bb68c53bf5e4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222324.
Product
Qtranslate Slug
Affected
up to 1.1.16
What to do
Affects up to 1.1.16. Update Qtranslate Slug to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 5, 2023A vulnerability, which was classified as problematic, has been found in Landing Pages Plugin up to 1.8.7 on WordPress.CVE-2015-10090 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in Landing Pages Plugin up to 1.8.7 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.8 is able to address this issue. The name of the patch is c8e22c1340c11fedfb0a0a67ea690421bdb62b94. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222320.
Product
Landing Pages
Affected
up to 1.8.7
What to do
Affects up to 1.8.7. Update Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 5, 2023A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic.CVE-2014-125092 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in MaxButtons Plugin up to 1.26.0 on WordPress and classified as problematic. This issue affects the function maxbuttons_strip_px of the file includes/maxbuttons-button.php. The manipulation of the argument button_id leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.26.1 is able to address this issue. The patch is named e74564c9e3b7429808e317f4916bd1c26ef0b806. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222323.
Product
MaxButtons
Affected
up to 1.26.0
What to do
Affects up to 1.26.0. Update MaxButtons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 5, 2023A vulnerability, which was classified as problematic, was found in Subscribe to Comments Plugin up to 2.0.7 on WordPress.CVE-2006-10001 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in Subscribe to Comments Plugin up to 2.0.7 on WordPress. This affects an unknown part of the file subscribe-to-comments.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The identifier of the patch is 9683bdf462fcac2f32b33be98f0b96497fbd1bb6. It is recommended to upgrade the affected component. The identifier VDB-222321 was assigned to this vulnerability.
Product
Subscribe to Comments
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Subscribe to Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 4, 2023A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical.CVE-2014-125091 · WordPress plugins & themes · reported by VulDBMedium 4.7
A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 6d7168cbf12d1c183bacc5cd5678f6f5b0d518d2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222268.
Affected
1.0.1 to 1.0.1
What to do
Affects 1.0.1 to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Mar 4, 2023A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress.CVE-2014-125090 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dl_file_resumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.1.993 is able to address this issue. The patch is identified as 77beb720c682b9300035ab5f96eee225181d8a92. It is recommended to upgrade the affected component. VDB-222262 is the identifier assigned to this vulnerability.
Affected
0.1.992 to 0.1.992
What to do
Affects 0.1.992 to 0.1.992. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Mar 3, 2023Watu Quiz: Reflected Cross-Site ScriptingCVE-2023-0968 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dn’, 'email', 'points', and 'date' parameters in versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Watu Quiz
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 2, 2023Metform Elementor Contact Form Builder: Stored Cross-Site ScriptingCVE-2023-0084 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 2, 2023Cost Calculator: Stored Cross-Site ScriptingCVE-2023-1155 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cost Calculator
Affected
up to 1.8
What to do
Affects up to 1.8. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Mar 2, 2023Metform Elementor Contact Form Builder: ReCaptcha BypassCVE-2023-0085 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to reCaptcha Bypass in versions up to, and including, 3.2.1. This is due to insufficient server side checking on the captcha value submitted during a form submission. This makes it possible for unauthenticated attackers to bypass Captcha restrictions and for attackers to utilize bots to submit forms.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.CVE-2022-47148 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.
Fixed in
3.2.6
What to do
Update the plugin to 3.2.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification.CVE-2022-46806 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification.
Fixed in
1.1.11
What to do
Update the plugin to 1.1.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactivatCVE-2022-46805 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactivation of plugin rulesets.
Fixed in
2.3.2
What to do
Update the plugin to 2.3.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.5.1 leading to plugin settings change.CVE-2022-46798 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.5.1 leading to plugin settings change.
Fixed in
2.5.2
What to do
Update the plugin to 2.5.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leadsCVE-2022-46797 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leads to plugin settings change.
Fixed in
5.2.4
What to do
Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy chCVE-2022-45804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy change, included plugin deactivate & activate.
Fixed in
3.2.11
What to do
Update the plugin to 3.2.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.CVE-2022-45068 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.
Fixed in
6.4.0
What to do
Update the plugin to 6.4.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change.CVE-2022-40198 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change.
Affected
up to 1.3.24
What to do
Affects up to 1.3.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.CVE-2022-38468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.
Affected
up to 3.28
What to do
Affects up to 3.28. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu plugin <= 3.0.1 leading to form deletion.CVE-2023-23984 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu plugin <= 3.0.1 leading to form deletion.
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions: Cross-Site Request Forgery (CSRF)CVE-2023-23974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update).
Product
Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions
Fixed in
9.7.5
What to do
Update Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions to 9.7.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0.CVE-2023-23973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0.
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 1, 2023A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress.CVE-2023-1112 · WordPress plugins & themes · reported by VulDBMedium 4.7
A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222072.
Fixed in
5.0.6.3
What to do
Update the plugin to 5.0.6.3 or newer.
Full record and what to do →NVD record github.com vuldb.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion.CVE-2023-23983 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 can lead to theme deletion.
Affected
up to 1.5.8
What to do
Affects up to 1.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.CVE-2023-23865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Checkout Plugins Stripe Payments For WooCommerce plugin <= 1.4.10 leads to settings change.
Fixed in
1.4.11
What to do
Update the plugin to 1.4.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.CVE-2022-47612 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.
Fixed in
2.4.6
What to do
Update the plugin to 2.4.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft.CVE-2022-47179 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft.
Fixed in
5.6.12
What to do
Update the plugin to 5.6.12 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.CVE-2023-24419 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.
Affected
up to 5.5.6
What to do
Affects up to 5.5.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in AutomatorWP plugin <= 2.5.0 leads to object delete.CVE-2023-23992 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AutomatorWP plugin <= 2.5.0 leads to object delete.
Fixed in
2.5.1
What to do
Update the plugin to 2.5.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2023Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions.CVE-2022-43459 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions.
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 28, 2023GN Publisher: Reflected Cross-Site ScriptingCVE-2023-1080 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
GN Publisher
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update GN Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 28, 2023WP Meta SEO: Cross-Site Request ForgeryCVE-2023-1028 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the setIgnore function. This makes it possible for unauthenticated attackers to update plugin options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2023WP Meta SEO: Unauthorized sitemap generationCVE-2023-1027 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCategoryInSitemap function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to obtain post categories. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2023WP Meta SEO: Unauthorized access of dataCVE-2023-1026 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to get post listings by category as long as those posts are published. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2023WP Meta SEO: Unauthorized sitemap generationCVE-2023-1024 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSitemaps function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to generate sitemaps. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2023WP Meta SEO: Unauthorized plugin settings updateCVE-2023-1023 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitemapSettings function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to change sitemap-related settings of the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2023WP Meta SEO: Unauthorized options updateCVE-2023-1022 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to update google analytics options maintained by the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2023Registration Forms: Does not properly validate the redirection URLCVE-2023-0552 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability
Product
Registration Forms
Fixed in
3.8.2.3
What to do
Update Registration Forms to 3.8.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2023Namaste! LMS: Does not sanitize and escape some of its settingsCVE-2023-0548 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Namaste! LMS
Fixed in
2.5.9.4
What to do
Update Namaste! LMS to 2.5.9.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2023Arigato Autoresponder and Newsletter: Does not sanitize and escape some of its settingsCVE-2023-0543 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Arigato Autoresponder and Newsletter
Fixed in
2.1.7.2
What to do
Update Arigato Autoresponder and Newsletter to 2.1.7.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2023GS Insever Portfolio: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0539 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
GS Insever Portfolio
Fixed in
1.4.5
What to do
Update GS Insever Portfolio to 1.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 27, 2023Donation Block For PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0535 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Donation Block For PayPal
Fixed in
2.1.0
What to do
Update Donation Block For PayPal to 2.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.