Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

41,587 results · page 726 of 832

Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4208 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Nov 30, 2022Unauth.CVE-2022-45842 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores.
Affected
up to 4.6.4
What to do
Affects up to 4.6.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2022Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.CVE-2022-26366 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress.
Affected
up to 5.9
What to do
Affects up to 5.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 29, 2022Appointment Hour Booking: CAPTCHA bypassCVE-2022-4036 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.
Product
Appointment Hour Booking
Affected
up to 1.3.72
What to do
Affects up to 1.3.72. Update Appointment Hour Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Appointment Hour Booking: IFrame InjectionCVE-2022-4035 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page.
Product
Appointment Hour Booking
Affected
up to 1.3.72
What to do
Affects up to 1.3.72. Update Appointment Hour Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Appointment Hour Booking: CSV InjectionCVE-2022-4034 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Product
Appointment Hour Booking
Affected
up to 1.3.72
What to do
Affects up to 1.3.72. Update Appointment Hour Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Quiz and Survey Master: Input validation bypassCVE-2022-4033 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation that allows attackers to inject content other than the specified value (i.e. a number, file path, etc..). This makes it possible attackers to submit values other than the intended input type.
Product
Quiz and Survey Master
Affected
up to 8.0.4
What to do
Affects up to 8.0.4. Update Quiz and Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Quiz and Survey Master: IFrame InjectionCVE-2022-4032 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and output escaping that allowed iframe tags to be injected. This makes it possible for unauthenticated attackers to inject iFrames in pages that will execute whenever a user accesses an injected page.
Product
Quiz and Survey Master
Affected
up to 8.0.4
What to do
Affects up to 8.0.4. Update Quiz and Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Simple:Press: Arbitrary file modificationsCVE-2022-4031 · WordPress plugins & themes · reported by WordfenceLow 3.8
The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does not properly restrict files to be edited in the context of the plugin. This makes it possible with attackers, with high-level permissions such as an administrator, to supply paths to arbitrary files on the server that can be modified outside of the intended scope of the plugin.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Simple:Press: Path TraversalCVE-2022-4030 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated during user avatar deletion. This makes it possible with attackers, with minimal permissions such as a subscriber, to supply paths to arbitrary files on the server that will subsequently be deleted. This can be used to delete the wp-config.php file that can allow an attacker to configure the site and achieve remote code execution.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Simple:Press: Reflected Cross-Site ScriptingCVE-2022-4029 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This would be highly complex to exploit as it would require the attacker to set the cookie a cookie for the targeted user.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Simple:Press: Stored Cross-Site ScriptingCVE-2022-4028 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to inject arbitrary web scripts in pages when modifying a profile signature that will execute whenever a user accesses an injected page.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Simple:Press: Stored Cross-Site ScriptingCVE-2022-4027 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when responding to forum threads that will execute whenever a user accesses an injected page.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022TeraWallet: Insecure Direct Object ReferenceCVE-2022-3995 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lock_unlock_terawallet AJAX action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to lock/unlock other users wallets.
Product
TeraWallet
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update TeraWallet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Photospace Gallery: Stored Cross-Site ScriptingCVE-2022-3991 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photospace Gallery
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Photospace Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022WP Affiliate Platform: Cross-Site Request ForgeryCVE-2022-3898 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on various functions including the affiliates_menu method. This makes it possible for unauthenticated attackers to delete affiliate records, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WP Affiliate Platform
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tipsandtricks-hq.com wordfence.com
Nov 29, 2022WP Affiliate Platform: Stored Cross-Site ScriptingCVE-2022-3897 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Affiliate Platform
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tipsandtricks-hq.com wordfence.com
Nov 29, 2022WP Affiliate Platform: Reflected Cross-Site ScriptingCVE-2022-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is unlikely to work in modern browsers.
Product
WP Affiliate Platform
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tipsandtricks-hq.com wordfence.com
Nov 29, 2022Becustom: Cross-Site Request ForgeryCVE-2022-3747 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update the plugin's settings like betheme_url_slug, replaced_theme_author, and betheme_label to name a few, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Becustom
Affected
up to 1.0.5.2
What to do
Affects up to 1.0.5.2. Update Becustom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com muffingroup.com
Nov 29, 2022Ultimate Member: Remote Code ExecutionCVE-2022-3384 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes it through call_user_func(). This is restricted to non-parameter PHP functions like phpinfo(); since user supplied parameters are not passed through the function. This makes it possible for authenticated attackers, with administrative privileges, to execute code on the server.
Product
Ultimate Member
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 29, 2022Ultimate Member: Remote Code ExecutionCVE-2022-3383 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes it through call_user_func(). This makes it possible for authenticated attackers, with administrative capabilities, to execute code on the server.
Product
Ultimate Member
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 29, 2022Ultimate Member: Directory traversalCVE-2022-3361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths using traversal (../../) to access and include files outside of the intended directory. If an attacker can successfully upload a php file then remote code execution via inclusion may also be possible. Note: for users with less than administrative capabilities, /wp-admin access needs to be enabled for that user in order for this to be exploitable by those users.
Product
Ultimate Member
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Ultimate Member to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Nov 29, 2022The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data.CVE-2021-31693 · WordPress plugins & themes · reported by MITREMedium 6.1
The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware information, previously connected to this CVE ID because of a typo, is at CVE-2022-31693.
Product
10Web Photo Gallery
Affected
up to 1.5.68
What to do
Affects up to 1.5.68. Update 10Web Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Nov 28, 2022Auth.CVE-2022-38140 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.
Affected
up to 12.1.10
What to do
Affects up to 12.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 28, 2022Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.CVE-2022-34654 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.
Fixed in
1.8.3
What to do
Update the plugin to 1.8.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 28, 2022The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks inCVE-2022-4169 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.
Affected
up to 3.2.16
What to do
Affects up to 3.2.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
Product
WP User Merger
Fixed in
1.5.3
What to do
Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Nov 28, 2022Find and Replace All: Does not have CSRF checkCVE-2022-3850 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack
Product
Find and Replace All
Fixed in
1.3
What to do
Update Find and Replace All to 1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3849 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
Product
WP User Merger
Fixed in
1.5.3
What to do
Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3848 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
Product
WP User Merger
Fixed in
1.5.3
What to do
Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Nov 28, 2022Showing URL in QR Code: Does not have CSRF checkCVE-2022-3847 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack
Product
Showing URL in QR Code
Affected
up to 0.0.1
What to do
Affects up to 0.0.1. Update Showing URL in QR Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Nov 28, 2022Analytics for WP: Does not sanitise and escape some of its settingsCVE-2022-3839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Analytics for WP WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Analytics for WP
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Analytics for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Google Forms: Does not sanitise and escape some of its settingsCVE-2022-3834 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Google Forms
Affected
up to 0.95
What to do
Affects up to 0.95. Update Google Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Fancier Author Box by ThematoSoup: Does not sanitise and escape some of its settingsCVE-2022-3833 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Fancier Author Box by ThematoSoup
Affected
up to 1.4
What to do
Affects up to 1.4. Update Fancier Author Box by ThematoSoup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022reCAPTCHA: Does not sanitise and escape some of its settingsCVE-2022-3831 · WordPress plugins & themes · reported by WPScanMedium 4.8
The reCAPTCHA WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
reCAPTCHA
Affected
up to 1.6
What to do
Affects up to 1.6. Update reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Video Thumbnails: Does not sanitise and escape some of its settingsCVE-2022-3828 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Video Thumbnails
Affected
up to 2.12.3
What to do
Affects up to 2.12.3. Update Video Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022WP Admin UI Customize: Does not sanitise and escape some of its settingsCVE-2022-3824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Admin UI Customize
Fixed in
1.5.13
What to do
Update WP Admin UI Customize to 1.5.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Beautiful Cookie Consent Banner: Does not sanitise and escape some of its settingsCVE-2022-3823 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Beautiful Cookie Consent Banner
Fixed in
2.9.1
What to do
Update Beautiful Cookie Consent Banner to 2.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Donations via PayPal: Does not sanitise and escape some of its settingsCVE-2022-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Donations via PayPal
Fixed in
1.9.9
What to do
Update Donations via PayPal to 1.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022OWM Weather: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3769 · WordPress plugins & themes · reported by WPScanHigh 8.8
The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as contributor
Product
OWM Weather
Fixed in
5.6.9
What to do
Update OWM Weather to 5.6.9 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Nov 28, 2022WPSmartContracts: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3768 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
Product
WPSmartContracts
Fixed in
1.3.12
What to do
Update WPSmartContracts to 1.3.12 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Nov 28, 2022HTML Forms: Does not properly properly escape a parameter before using it in a SQL statementCVE-2022-3689 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
Product
HTML Forms
Fixed in
1.3.25
What to do
Update HTML Forms to 1.3.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Jeeng Push Notifications: Does not sanitise and escape some of its settingsCVE-2022-3610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Jeeng Push Notifications
Fixed in
2.0.4
What to do
Update Jeeng Push Notifications to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list: Does not validate dataCVE-2022-3603 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.
Product
Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list
Fixed in
2.0.69
What to do
Update Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list to 2.0.69 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Image Hover Effects Css3: Does not sanitise and escape some of its settingsCVE-2022-3601 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Image Hover Effects Css3
Affected
up to 4.5
What to do
Affects up to 4.5. Update Image Hover Effects Css3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Awesome Support: Does not ensure that the exported tickets archive to be downloaded belongs to the user making the requestCVE-2022-3511 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
Product
Awesome Support
Fixed in
6.1.2
What to do
Update Awesome Support to 6.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Checkout Field Editor (Checkout Manager) for WooCommerce: Unserializes user input provided via the settingsCVE-2022-3490 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Product
Checkout Field Editor (Checkout Manager) for WooCommerce
Fixed in
1.8.0
What to do
Update Checkout Field Editor (Checkout Manager) for WooCommerce to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Salat Times: Does not sanitize and escapes its settingsCVE-2022-2983 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Salat Times
Fixed in
3.2.2
What to do
Update Salat Times to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Find and Replace All: Does not sanitize and escape some parameters from its setting page before outputting them back to the userCVE-2022-2311 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.
Product
Find and Replace All
Fixed in
1.3
What to do
Update Find and Replace All to 1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022Download: Does not properly validate a user has the required privileges to access a backup's nonce identifierCVE-2021-25059 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.
Product
Download
Fixed in
2.0.0
What to do
Update Download to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.