Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,587 results · page 717 of 832
Feb 6, 2023Contextual Related Posts: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0252 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Contextual Related Posts
- Fixed in
- 3.3.1
- What to do
- Update Contextual Related Posts to 3.3.1 or newer.
Feb 6, 2023Tutor LMS: Does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributesCVE-2023-0236 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Tutor LMS
- Fixed in
- 2.0.10
- What to do
- Update Tutor LMS to 2.0.10 or newer.
Feb 6, 2023SiteGround Security: Does not properly sanitize user input before using it in an SQL queryCVE-2023-0234 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
- Product
- SiteGround Security
- Fixed in
- 1.3.1
- What to do
- Update SiteGround Security to 1.3.1 or newer.
Feb 6, 2023Annual Archive: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0178 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Annual Archive
- Fixed in
- 1.6.0
- What to do
- Update Annual Archive to 1.6.0 or newer.
Feb 6, 2023Giveaways and Contests by RafflePress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0176 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.11.3
- What to do
- Update Giveaways and Contests by RafflePress to 1.11.3 or newer.
Feb 6, 2023WP VR: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0174 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP VR
- Fixed in
- 8.2.7
- What to do
- Update WP VR to 8.2.7 or newer.
Feb 6, 2023Drag & Drop Sales Funnel Builder for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0173 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Drag & Drop Sales Funnel Builder for
- Fixed in
- 2.6.9
- What to do
- Update Drag & Drop Sales Funnel Builder for to 2.6.9 or newer.
Feb 6, 2023jQuery T(-) Countdown Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0171 · WordPress plugins & themes · reported by WPScanMedium 5.4
The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- jQuery T(-) Countdown Widget
- Fixed in
- 2.3.24
- What to do
- Update jQuery T(-) Countdown Widget to 2.3.24 or newer.
Feb 6, 2023Html5 Audio Player: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0170 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Html5 Audio Player
- Fixed in
- 2.1.12
- What to do
- Update Html5 Audio Player to 2.1.12 or newer.
Feb 6, 2023GamiPress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0154 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GamiPress
- Fixed in
- 1.0.9
- What to do
- Update GamiPress to 1.0.9 or newer.
Feb 6, 2023Vimeo Video Autoplay Automute: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0153 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Vimeo Video Autoplay Automute
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Vimeo Video Autoplay Automute to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Cloak Front End Email: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Cloak Front End Email
- Fixed in
- 1.9.2
- What to do
- Update Cloak Front End Email to 1.9.2 or newer.
Feb 6, 2023WordPrezi: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0149 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WordPrezi
- Fixed in
- 0.9
- What to do
- Update WordPrezi to 0.9 or newer.
Feb 6, 2023Gallery Factory Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Gallery Factory Lite
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Gallery Factory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Flexible Captcha: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0147 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Flexible Captcha
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Flexible Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Naver Map: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0146 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Naver Map
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Naver Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Event Manager and Tickets Selling Plugin for WooCommerce: Does not validate and escape some of its post meta before outputting them back in a page/postCVE-2023-0144 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Event Manager and Tickets Selling Plugin for WooCommerce
- Fixed in
- 3.8.0
- What to do
- Update Event Manager and Tickets Selling Plugin for WooCommerce to 3.8.0 or newer.
Feb 6, 2023Send PDF for Contact Form 7: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-0143 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Send PDF for Contact Form 7
- Fixed in
- 0.9.9.2
- What to do
- Update Send PDF for Contact Form 7 to 0.9.9.2 or newer.
Feb 6, 2023Happyforms: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0096 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Happyforms
- Fixed in
- 1.22.0
- What to do
- Update Happyforms to 1.22.0 or newer.
Feb 6, 2023Page View Count: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0095 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Page View Count
- Fixed in
- 2.6.1
- What to do
- Update Page View Count to 2.6.1 or newer.
Feb 6, 2023ExactMetrics: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0082 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ExactMetrics
- Fixed in
- 7.12.1
- What to do
- Update ExactMetrics to 7.12.1 or newer.
Feb 6, 2023MonsterInsights: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0081 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- MonsterInsights
- Fixed in
- 8.12.1
- What to do
- Update MonsterInsights to 8.12.1 or newer.
Feb 6, 2023WC Vendors Marketplace: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0072 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WC Vendors Marketplace
- Fixed in
- 2.4.5
- What to do
- Update WC Vendors Marketplace to 2.4.5 or newer.
Feb 6, 2023ResponsiveVoice Text To Speech: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0070 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ResponsiveVoice Text To Speech
- Fixed in
- 1.7.7
- What to do
- Update ResponsiveVoice Text To Speech to 1.7.7 or newer.
Feb 6, 2023EAN for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0062 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- EAN for WooCommerce
- Fixed in
- 4.4.3
- What to do
- Update EAN for WooCommerce to 4.4.3 or newer.
Feb 6, 2023Clean Login: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Clean Login
- Fixed in
- 1.13.7
- What to do
- Update Clean Login to 1.13.7 or newer.
Feb 6, 2023Breadcrumb: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4836 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Breadcrumb
- Fixed in
- 1.5.33
- What to do
- Update Breadcrumb to 1.5.33 or newer.
Feb 6, 2023YourChannel: Everything you want in a YouTube: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- YourChannel: Everything you want in a YouTube
- Fixed in
- 1.2.3
- What to do
- Update YourChannel: Everything you want in a YouTube to 1.2.3 or newer.
Feb 6, 2023Simple Tooltips: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Simple Tooltips
- Fixed in
- 2.1.4
- What to do
- Update Simple Tooltips to 2.1.4 or newer.
Feb 6, 2023WP-ShowHide: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4825 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-ShowHide WordPress plugin before 1.05 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP-ShowHide
- Fixed in
- 1.05
- What to do
- Update WP-ShowHide to 1.05 or newer.
Feb 6, 2023WP Blog and Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4824 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Blog and Widgets
- Fixed in
- 2.3.1
- What to do
- Update WP Blog and Widgets to 2.3.1 or newer.
Feb 6, 2023Materialis Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4762 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Materialis Companion
- Fixed in
- 1.3.40
- What to do
- Update Materialis Companion to 1.3.40 or newer.
Feb 6, 2023My YouTube Channel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4756 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- My YouTube Channel
- Fixed in
- 3.23.0
- What to do
- Update My YouTube Channel to 3.23.0 or newer.
Feb 6, 2023Post Category Image With Grid and Slider: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4747 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Post Category Image With Grid and Slider
- Fixed in
- 1.4.8
- What to do
- Update Post Category Image With Grid and Slider to 1.4.8 or newer.
Feb 6, 2023Strong Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4717 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Strong Testimonials
- Fixed in
- 3.0.3
- What to do
- Update Strong Testimonials to 3.0.3 or newer.
Feb 6, 2023Hide My WP: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Hide My WP
- Fixed in
- 6.2.9
- What to do
- Update Hide My WP to 6.2.9 or newer.
Feb 6, 2023Leaflet Maps Marker: Does not validate and escape one of its shortcode attributesCVE-2022-4677 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Leaflet Maps Marker
- Fixed in
- 3.12.7
- What to do
- Update Leaflet Maps Marker to 3.12.7 or newer.
Feb 6, 2023Ibtana: Does not validate and escape one of its shortcode attributesCVE-2022-4674 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
- Product
- Ibtana
- Fixed in
- 1.1.8.8
- What to do
- Update Ibtana to 1.1.8.8 or newer.
Feb 6, 2023PDF.js Viewer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- PDF.js Viewer
- Fixed in
- 2.1.8
- What to do
- Update PDF.js Viewer to 2.1.8 or newer.
Feb 6, 2023Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4664 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 3.6.0
- What to do
- Update Logo Slider to 3.6.0 or newer.
Feb 6, 2023Restaurant Menu: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4657 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Restaurant Menu
- Fixed in
- 2.3.6
- What to do
- Update Restaurant Menu to 2.3.6 or newer.
Feb 6, 2023PPWP: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4626 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- PPWP
- Fixed in
- 1.8.6
- What to do
- Update PPWP to 1.8.6 or newer.
Feb 6, 2023Easy Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Testimonials
- Fixed in
- 3.9.3
- What to do
- Update Easy Testimonials to 3.9.3 or newer.
Feb 6, 2023HUSKY: Unserializes user input provided via the settingsCVE-2022-4489 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- HUSKY
- Fixed in
- 1.3.2
- What to do
- Update HUSKY to 1.3.2 or newer.
Feb 6, 2023WP Show Posts: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4459 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Show Posts
- Fixed in
- 1.1.4
- What to do
- Update WP Show Posts to 1.1.4 or newer.
Feb 6, 2023Stream: Does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionalityCVE-2022-4384 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionality, which may enable them to leak sensitive information.
- Product
- Stream
- Fixed in
- 3.9.2
- What to do
- Update Stream to 3.9.2 or newer.
Feb 6, 2023PDF Generator for: Includes a vendored dompdf example fileCVE-2022-4321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin
- Product
- PDF Generator for
- Fixed in
- 1.1.2
- What to do
- Update PDF Generator for to 1.1.2 or newer.
Feb 6, 2023A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress.CVE-2017-20177 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress. Affected by this issue is the function wangguard_users_info of the file wangguard-user-info.php of the component WGG User List Handler. The manipulation of the argument userIP leads to cross site scripting. The attack may be launched remotely. The patch is identified as 88414951e30773c8d2ec13b99642688284bf3189. It is recommended to apply a patch to fix this issue. VDB-220214 is the identifier assigned to this vulnerability.
- Affected
- 1.8.0 to 1.8.0
- What to do
- Affects 1.8.0 to 1.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 20230mk Shortener: Cross-Site Request ForgeryCVE-2022-2933 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the zeromk_options_page function. This makes it possible for unauthenticated attackers to inject malicious web scripts via the 'zeromk_user' and 'zeromk_apikluc' parameters through a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- 0mk Shortener
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update 0mk Shortener to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 6, 2023Unauth.CVE-2022-29416 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Afterpay Gateway for WooCommerce <= 3.5.0 versions.
- Affected
- up to 3.5.0
- What to do
- Affects up to 3.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.