Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,587 results · page 720 of 832
Jan 23, 2023WP Statistics: Does not escape a parameterCVE-2022-4230 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
- Product
- WP Statistics
- Fixed in
- 13.2.9
- What to do
- Update WP Statistics to 13.2.9 or newer.
Jan 23, 2023The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress pCVE-2022-4017 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places, allowing attackers to make logged in users perform unwanted actions via CSRF attacks
- Fixed in
- 6.0.1
- What to do
- Update the plugin to 6.0.1 or newer.
Jan 23, 2023EU Cookie Law for GDPR/CCPA: Does not sanitise and escape some of its settingsCVE-2022-3811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- EU Cookie Law for GDPR/CCPA
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update EU Cookie Law for GDPR/CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023Analyticator: Unserializes user input provided via the settingsCVE-2022-3425 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- Analyticator
- Fixed in
- 6.5.6
- What to do
- Update Analyticator to 6.5.6 or newer.
Jan 23, 2023The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-tCVE-2022-0316 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.
- Product
- WeStand
- Fixed in
- 2.1
- What to do
- Update WeStand to 2.1 or newer.
Jan 23, 2023Passster: Does not properly check for passwordCVE-2021-24881 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request.
- Product
- Passster
- Fixed in
- 3.5.5.9
- What to do
- Update Passster to 3.5.5.9 or newer.
Jan 23, 2023Passster: Does not escape the area parameter of its shortcodeCVE-2021-24837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Passster
- Fixed in
- 3.5.5.8
- What to do
- Update Passster to 3.5.5.8 or newer.
Jan 20, 2023The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forCVE-2023-23492 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.
- Fixed in
- 1.4.2
- What to do
- Update the plugin to 1.4.2 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 20, 2023The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qemCVE-2023-23491 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.1
The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.
- Fixed in
- 9.7.5
- What to do
- Update the plugin to 9.7.5 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 20, 2023The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveCVE-2023-23490 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 8.8
The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action.
- Fixed in
- 3.1.2
- What to do
- Update the plugin to 3.1.2 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 20, 2023The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of iCVE-2023-23489 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action.
- Fixed in
- 3.1.0.4
- What to do
- Update the plugin to 3.1.0.4 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 20, 2023The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmproCVE-2023-23488 · WordPress plugins & themes · reported by vulnreport@tenable.comCritical 9.8
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.
- Fixed in
- 2.9.8
- What to do
- Update the plugin to 2.9.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comtenable.com
Jan 19, 2023Auth.CVE-2022-40697 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions.
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 19, 2023Events Made Easy: Authorization bypassCVE-2023-0404 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy
- Product
- Events Made Easy
- Affected
- up to 2.3.16
- What to do
- Affects up to 2.3.16. Update Events Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 19, 2023Social Warfare: Cross-Site Request ForgeryCVE-2023-0403 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on several AJAX actions. This makes it possible for unauthenticated attackers to delete post meta information and reset network access tokens, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Social Warfare
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update Social Warfare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 19, 2023Social Warfare: Authorization bypassCVE-2023-0402 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete post meta information and reset network access tokens.
- Product
- Social Warfare
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update Social Warfare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 18, 2023Custom 404 Pro: Cross-Site Request ForgeryCVE-2023-0385 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrect nonce validation on the custom_404_pro_admin_init function. This makes it possible for unauthenticated attackers to delete logs, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Custom 404 Pro
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Custom 404 Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 17, 2023Auth.CVE-2022-43462 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Auth. SQL Injection (SQLi) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions.
- Affected
- up to 5.00
- What to do
- Affects up to 5.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 17, 2023Auth.CVE-2022-42462 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions.
- Affected
- up to 5.00
- What to do
- Affects up to 5.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 17, 2023Cross-Site Request Forgery (CSRF) in MiKa's OSM – OpenStreetMap plugin <= 6.0.1 versions.CVE-2022-30544 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) in MiKa's OSM – OpenStreetMap plugin <= 6.0.1 versions.
- Affected
- up to 6.0.1
- What to do
- Affects up to 6.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 16, 2023RSSImport: Does not validate and escape one of its shortcode attributesCVE-2022-4658 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- RSSImport
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update RSSImport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Welcart e-Commerce: Does not validate and escapes one of its shortcode attributesCVE-2022-4655 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.9
- What to do
- Update Welcart e-Commerce to 2.8.9 or newer.
Jan 16, 2023Greenshift: Does not validate and escape one of its shortcode attributesCVE-2022-4653 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Greenshift
- Fixed in
- 4.8.9
- What to do
- Update Greenshift to 4.8.9 or newer.
Jan 16, 2023Real Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4648 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Real Testimonials
- Fixed in
- 2.6.0
- What to do
- Update Real Testimonials to 2.6.0 or newer.
Jan 16, 2023Video Conferencing with Zoom: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4578 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Video Conferencing with Zoom
- Fixed in
- 4.0.10
- What to do
- Update Video Conferencing with Zoom to 4.0.10 or newer.
Jan 16, 2023Seriously Simple Podcasting: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Seriously Simple Podcasting
- Fixed in
- 2.19.1
- What to do
- Update Seriously Simple Podcasting to 2.19.1 or newer.
Jan 16, 2023Tickera: Does not have CSRF check in placeCVE-2022-4549 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- Tickera
- Fixed in
- 3.5.1.0
- What to do
- Update Tickera to 3.5.1.0 or newer.
Jan 16, 2023Conditional Payment Methods for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4547 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin.
- Product
- Conditional Payment Methods for WooCommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Conditional Payment Methods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 16, 2023MashShare: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- MashShare
- Fixed in
- 3.8.7
- What to do
- Update MashShare to 3.8.7 or newer.
Jan 16, 2023ConvertKit: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4508 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- ConvertKit
- Fixed in
- 2.0.5
- What to do
- Update ConvertKit to 2.0.5 or newer.
Jan 16, 2023Real Cookie Banner: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4507 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Real Cookie Banner
- Fixed in
- 3.4.10
- What to do
- Update Real Cookie Banner to 3.4.10 or newer.
Jan 16, 2023Easy Accordion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4487 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Accordion
- Fixed in
- 2.2.0
- What to do
- Update Easy Accordion to 2.2.0 or newer.
Jan 16, 2023Meteor Slides: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4486 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Meteor Slides
- Fixed in
- 1.5.7
- What to do
- Update Meteor Slides to 1.5.7 or newer.
Jan 16, 2023Social Share, Social Login and Social Comments: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4484 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.44
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.44 or newer.
Jan 16, 2023Insert Pages: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4483 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Insert Pages
- Fixed in
- 3.7.5
- What to do
- Update Insert Pages to 3.7.5 or newer.
Jan 16, 2023Carousel, Slider, Gallery by WP Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4482 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Carousel, Slider, Gallery by WP Carousel
- Fixed in
- 2.5.3
- What to do
- Update Carousel, Slider, Gallery by WP Carousel to 2.5.3 or newer.
Jan 16, 2023Mesmerize Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4481 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Mesmerize Companion
- Fixed in
- 1.6.135
- What to do
- Update Mesmerize Companion to 1.6.135 or newer.
Jan 16, 2023Click to Chat: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4480 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Click to Chat
- Fixed in
- 3.18.1
- What to do
- Update Click to Chat to 3.18.1 or newer.
Jan 16, 2023Font Awesome: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4478 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Font Awesome
- Fixed in
- 4.3.2
- What to do
- Update Font Awesome to 4.3.2 or newer.
Jan 16, 2023Smash Balloon Social Post Feed: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 4.1.6
- What to do
- Update Smash Balloon Social Post Feed to 4.1.6 or newer.
Jan 16, 2023Download Manager: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4476 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Download Manager
- Fixed in
- 3.2.62
- What to do
- Update Download Manager to 3.2.62 or newer.
Jan 16, 2023Simple Membership: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4469 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Simple Membership
- Fixed in
- 4.2.2
- What to do
- Update Simple Membership to 4.2.2 or newer.
Jan 16, 2023WP Video Lightbox: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4465 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- WP Video Lightbox
- Fixed in
- 1.9.7
- What to do
- Update WP Video Lightbox to 1.9.7 or newer.
Jan 16, 2023Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, whiCVE-2022-4464 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.
- Fixed in
- 1.2.1
- What to do
- Update the plugin to 1.2.1 or newer.
Jan 16, 2023Sidebar Widgets by CodeLights: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4460 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- Sidebar Widgets by CodeLights
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 20233D FlipBook: Does not validate or escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4453 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators.
- Product
- 3D FlipBook
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4451 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Sharing
- Fixed in
- 3.3.45
- What to do
- Update Social Sharing to 3.3.45 or newer.
Jan 16, 2023Page scroll to id: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4449 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Page scroll to id
- Fixed in
- 1.7.6
- What to do
- Update Page scroll to id to 1.7.6 or newer.
Jan 16, 2023Fontsy: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4447 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Fontsy
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update Fontsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Custom Post Types and Custom Fields creator: Does not sanitize and escape some of its settingsCVE-2022-4442 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Custom Post Types and Custom Fields creator
- Fixed in
- 2.3.3
- What to do
- Update Custom Post Types and Custom Fields creator to 2.3.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.