Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41,587 results · page 722 of 832
Jan 9, 2023Starter Templates by Kadence WP: Unserialises the content of an imported fileCVE-2022-3679 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
- Product
- Starter Templates by Kadence WP
- Fixed in
- 1.2.17
- What to do
- Update Starter Templates by Kadence WP to 1.2.17 or newer.
Jan 9, 2023WPtouch: Unserialises the content of an imported settings fileCVE-2022-3417 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.
- Product
- WPtouch
- Fixed in
- 4.3.45
- What to do
- Update WPtouch to 4.3.45 or newer.
Jan 9, 2023WPtouch: Does not properly validate images to be uploadedCVE-2022-3416 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- WPtouch
- Fixed in
- 4.3.45
- What to do
- Update WPtouch to 4.3.45 or newer.
Jan 9, 2023WPQA Builder: (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tries to validate that a user already follows another in the wpqa_following_you_ajax actionCVE-2022-3343 · WordPress plugins & themes · reported by WPScanLow 3.5
The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tries to validate that a user already follows another in the wpqa_following_you_ajax action, allowing a user to inflate their score on the site by having another user send repeated follow actions to them.
- Product
- WPQA Builder
- Fixed in
- 5.9.3
- What to do
- Update WPQA Builder to 5.9.3 or newer.
Jan 5, 2023Swifty Page Manager: Cross-Site Request ForgeryCVE-2023-0088 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Swifty Page Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on several AJAX actions handling page creation and deletion among other things. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Swifty Page Manager
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Swifty Page Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 5, 2023Swifty Page Manager: Stored Cross-Site ScriptingCVE-2023-0087 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ parameter in versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Swifty Page Manager
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update Swifty Page Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 5, 2023JetWidgets for Elementor: Cross-Site Request ForgeryCVE-2023-0086 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be used to enable SVG uploads that could make Cross-Site Scripting possible.
- Product
- JetWidgets for Elementor
- Affected
- up to 1.0.12
- What to do
- Affects up to 1.0.12. Update JetWidgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 5, 2023A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress.CVE-2015-10013 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in WebDevStudios taxonomy-switcher Plugin up to 1.0.3 on WordPress. It has been classified as problematic. Affected is the function taxonomy_switcher_init of the file taxonomy-switcher.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.4 is able to address this issue. It is recommended to upgrade the affected component. VDB-217446 is the identifier assigned to this vulnerability.
- Product
- WebDevStudios taxonomy-switcher
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WebDevStudios taxonomy-switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 4, 2023WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes CVE-2023-22622 · WordPress plugins & themes · reported by MITREMedium 5.3
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits.
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddeveloper.wordpress.orggithub.com
Jan 3, 2023Survey Maker – Best WordPress Survey: Stored Cross-Site ScriptingCVE-2023-0038 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page.
- Product
- Survey Maker – Best WordPress Survey
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Survey Maker – Best WordPress Survey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 3, 2023Members Import: Self Cross-Site ScriptingCVE-2022-4663 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site's administrator into uploading a CSV file with the malicious payload.
- Product
- Members Import
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Members Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 2, 2023WP Cerber Security, Anti-spam & Malware Scan: Does not properly block access to the REST API users endpointCVE-2022-4417 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 9.3.3
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 9.3.3 or newer.
Jan 2, 2023Popup Maker: Does not validate and escape one of its shortcode attributesCVE-2022-4381 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Popup Maker
- Fixed in
- 1.16.9
- What to do
- Update Popup Maker to 1.16.9 or newer.
Jan 2, 2023Quote-O-Matic: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4373 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- Quote-O-Matic
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Quote-O-Matic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4371 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023multimedial images: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4370 · WordPress plugins & themes · reported by WPScanHigh 7.2
The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- multimedial images
- Affected
- up to 1.0b
- What to do
- Affects up to 1.0b. Update multimedial images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP-Lister Lite for Amazon: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4369 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin.
- Product
- WP-Lister Lite for Amazon
- Fixed in
- 2.4.4
- What to do
- Update WP-Lister Lite for Amazon to 2.4.4 or newer.
Jan 2, 2023Popup Maker: Does not validate and escape one of its shortcode attributesCVE-2022-4362 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Popup Maker
- Fixed in
- 1.16.9
- What to do
- Update Popup Maker to 1.16.9 or newer.
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4360 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4359 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4358 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4357 · WordPress plugins & themes · reported by WPScanCritical 9.8
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4356 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4355 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4351 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023BookingPress: Suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you pageCVE-2022-4340 · WordPress plugins & themes · reported by WPScanMedium 5.3
The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.
- Product
- BookingPress
- Fixed in
- 1.0.31
- What to do
- Update BookingPress to 1.0.31 or newer.
Jan 2, 2023Product list Widget for Woocommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4329 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product list Widget for Woocommerce WordPress plugin before 3.4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).
- Product
- Product list Widget for Woocommerce
- Fixed in
- 3.4.0
- What to do
- Update Product list Widget for Woocommerce to 3.4.0 or newer.
Jan 2, 2023Custom Field Template: Unserialises the content of an imported fileCVE-2022-4324 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.
- Product
- Custom Field Template
- Fixed in
- 2.5.8
- What to do
- Update Custom Field Template to 2.5.8 or newer.
Jan 2, 2023White Label CMS: Unserializes user input provided via the settingsCVE-2022-4302 · WordPress plugins & themes · reported by WPScanHigh 7.2
The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
- Product
- White Label CMS
- Fixed in
- 2.5
- What to do
- Update White Label CMS to 2.5 or newer.
Jan 2, 2023Wholesale Market: Does not have authorisation checkCVE-2022-4298 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
- Product
- Wholesale Market
- Fixed in
- 2.2.1
- What to do
- Update Wholesale Market to 2.2.1 or newer.
Jan 2, 2023WP AutoComplete Search: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated usersCVE-2022-4297 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- WP AutoComplete Search
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP AutoComplete Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jan 2, 2023WP-Ban: Does not sanitise and escape some of its settingsCVE-2022-4260 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP-Ban
- Fixed in
- 1.69.1
- What to do
- Update WP-Ban to 1.69.1 or newer.
Jan 2, 2023All-in-One Addons for Elementor: Does not sanitise and escape some of its settingsCVE-2022-4256 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- All-in-One Addons for Elementor
- Fixed in
- 2.4.4
- What to do
- Update All-in-One Addons for Elementor to 2.4.4 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated usersCVE-2022-4237 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.6
- What to do
- Update Welcart e-Commerce to 2.8.6 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated usersCVE-2022-4236 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Jan 2, 2023Login with Cognito: Does not sanitise and escape some of its settingsCVE-2022-4200 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login with Cognito
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Login with Cognito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023WP Social Sharing: Does not sanitise and escape some of its settingsCVE-2022-4198 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Social Sharing
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WP Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurity.gentoo.orgwpscan.com
Jan 2, 2023WordPress Filter Gallery: Does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the pageCVE-2022-4142 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled.
- Product
- WordPress Filter Gallery
- Fixed in
- 0.1.6
- What to do
- Update WordPress Filter Gallery to 0.1.6 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a fileCVE-2022-4140 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Jan 2, 2023Image Optimizer, Resizer and CDN: Does not sanitise and escape some of its settingsCVE-2022-4119 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Optimizer, Resizer and CDN
- Fixed in
- 6.8.1
- What to do
- Update Image Optimizer, Resizer and CDN to 6.8.1 or newer.
Jan 2, 2023The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site ScripCVE-2022-4114 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks.
- Fixed in
- 1.2.33
- What to do
- Update the plugin to 1.2.33 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Jan 2, 2023Wholesale Market for WooCommerce: Does not validate user input against path traversal attacksCVE-2022-4109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite)
- Product
- Wholesale Market for WooCommerce
- Fixed in
- 2.0.0
- What to do
- Update Wholesale Market for WooCommerce to 2.0.0 or newer.
Jan 2, 2023Joy Of Text Lite: Does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated usersCVE-2022-4099 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection
- Product
- Joy Of Text Lite
- Fixed in
- 2.3.1
- What to do
- Update Joy Of Text Lite to 2.3.1 or newer.
Jan 2, 2023Cryptocurrency Widgets Pack: Does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4059 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Cryptocurrency Widgets Pack
- Fixed in
- 2.0
- What to do
- Update Cryptocurrency Widgets Pack to 2.0 or newer.
Jan 2, 2023Autoptimize: Uses an easily guessable path to store plugin's exported settings and logsCVE-2022-4057 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
- Product
- Autoptimize
- Fixed in
- 3.1.0
- What to do
- Update Autoptimize to 3.1.0 or newer.
Jan 2, 2023WP User: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4049 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- Product
- WP User
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WP User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Authenticator: Does not prevent subscribers from updating a site's feed access tokenCVE-2022-3994 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the functionality in certain configurations.
- Product
- Authenticator
- Fixed in
- 1.3.1
- What to do
- Update Authenticator to 1.3.1 or newer.
Jan 2, 2023Team Members: Does not sanitize and escapes some of its settingsCVE-2022-3936 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a multisite setup).
- Product
- Team Members
- Fixed in
- 5.2.1
- What to do
- Update Team Members to 5.2.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.