Vulnerability database

1,125 results · page 8 of 23

• May 22, 2024Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced: Stored Cross-Site ScriptingCVE-2024-3611 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tbex-version' shortcode in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced

  Affected

  up to 1.4.9

  What to do

  Affects up to 1.4.9. Update Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwordpress.orgwordfence.com

• May 17, 2024Church Admin: Missing AuthorizationCVE-2024-31281 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.6.

  Product

  Church Admin

  Affected

  up to 4.1.6

  What to do

  Affects up to 4.1.6. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• May 14, 2024ADFO – Custom data in admin dashboard: Reflected Cross-Site ScriptingCVE-2024-4104 · WordPress plugins & themes · reported by WordfenceMedium 6.1

  The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dbp_id' parameter in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  Product

  ADFO – Custom data in admin dashboard

  Affected

  up to 1.9.0

  What to do

  Affects up to 1.9.0. Update ADFO – Custom data in admin dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 14, 2024ADFO – Custom data in admin dashboard: Cross-Site Request ForgeryCVE-2024-4103 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller() function. This makes it possible for unauthenticated attackers to edit the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  ADFO – Custom data in admin dashboard

  Affected

  up to 1.9.0

  What to do

  Affects up to 1.9.0. Update ADFO – Custom data in admin dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• May 14, 2024Church Admin: Cross-Site Request Forgery (CSRF)CVE-2024-34828 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32.

  Product

  Church Admin

  Affected

  up to 4.1.32

  What to do

  Affects up to 4.1.32. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• May 14, 2024Administrator Cross Site Scripting (XSS) in Archives Calendar Widget <= 1.0.15 versions.CVE-2024-33950 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Administrator Cross Site Scripting (XSS) in Archives Calendar Widget <= 1.0.15 versions.

  Affected

  up to 1.0.15

  What to do

  Affects up to 1.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• May 2, 2024Frontend Admin by DynamiApps: Improper missing encryption exception handling on the 'fea_encrypt' functionCVE-2024-3729 · WordPress plugins & themes · reported by WordfenceCritical 9.8

  The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can be used to add and edit administrator user for privilege escalation, or to automatically log in users for authentication bypass, or manipulate the post processing form that can be used to inject arbitrary web scripts. This can only be exploited if the 'openssl' php extension is not loaded on the server.

  Product

  Frontend Admin by DynamiApps

  Affected

  up to 3.19.4

  What to do

  Affects up to 3.19.4. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• May 2, 2024Admin Page Spider: Stored Cross-Site ScriptingCVE-2024-2401 · WordPress plugins & themes · reported by WordfenceMedium 4.4

  The Admin Page Spider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

  Product

  Admin Page Spider

  Affected

  up to 3.31

  What to do

  Affects up to 3.31. Update Admin Page Spider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• May 2, 2024Admin Bar Remover: Unauthorized modification of dataCVE-2024-1716 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Admin Bar Remover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_form() function in all versions up to, and including, 1.0.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to enable or disable the admin bar on the front-end of the site.

  Product

  Admin Bar Remover

  Affected

  up to 1.0.2.2

  What to do

  Affects up to 1.0.2.2. Update Admin Bar Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Apr 29, 2024Absolutely Glamorous Custom Admin: Server-Side Request Forgery (SSRF)CVE-2024-33627 · WordPress plugins & themes · reported by PatchstackMedium 4.4

  Server-Side Request Forgery (SSRF) vulnerability in Cusmin Absolutely Glamorous Custom Admin.This issue affects Absolutely Glamorous Custom Admin: from n/a through 7.2.2.

  Product

  Absolutely Glamorous Custom Admin

  Affected

  up to 7.2.2

  What to do

  Affects up to 7.2.2. Update Absolutely Glamorous Custom Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 24, 2024Slash Admin: Cross-Site Request Forgery (CSRF)CVE-2024-32958 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Cross-Site Request Forgery (CSRF) vulnerability in Giorgos Sarigiannidis Slash Admin allows Cross-Site Scripting (XSS).This issue affects Slash Admin: from n/a through 3.8.1.

  Product

  Slash Admin

  Affected

  up to 3.8.1

  What to do

  Affects up to 3.8.1. Update Slash Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 24, 2024Import WP: Does not prevent users with the administrator role from pinging conducting SSRF attacksCVE-2023-7253 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.

  Product

  Import WP

  Fixed in

  2.13.1

  What to do

  Update Import WP to 2.13.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 15, 2024Church Admin: Cross-Site Request Forgery (CSRF)CVE-2024-32090 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.

  Product

  Church Admin

  Affected

  up to 4.0.27

  What to do

  Affects up to 4.0.27. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 15, 2024Ads.Txt Admin: Cross-Site Request Forgery (CSRF)CVE-2024-32448 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in VideoYield.Com Ads.Txt Admin.This issue affects Ads.Txt Admin: from n/a through 1.3.

  Product

  Ads.Txt Admin

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Ads.Txt Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 7, 2024Easy Login Styler – White Label Admin Login Page for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-31344 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phpbits Creative Studio Easy Login Styler – White Label Admin Login Page for WordPress allows Stored XSS.This issue affects Easy Login Styler – White Label Admin Login Page for WordPress: from n/a through 1.0.6.

  Product

  Easy Login Styler – White Label Admin Login Page for

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update Easy Login Styler – White Label Admin Login Page for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 7, 2024Church Admin: Unrestricted Upload of File with Dangerous TypeCVE-2024-31280 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.5.

  Product

  Church Admin

  Affected

  up to 4.1.5

  What to do

  Affects up to 4.1.5. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perforCVE-2024-2278 · WordPress plugins & themes · reported by WPScanMedium 6.1

  Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

  Fixed in

  1.4.4

  What to do

  Update the plugin to 1.4.4 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 29, 2024Church Admin: Missing AuthorizationCVE-2024-30505 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.

  Product

  Church Admin

  Affected

  up to 4.1.18

  What to do

  Affects up to 4.1.18. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 29, 2024Church Admin: Cross-Site Request Forgery (CSRF)CVE-2024-30493 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7.

  Product

  Church Admin

  Affected

  up to 4.1.7

  What to do

  Affects up to 4.1.7. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 28, 2024Church Admin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-30244 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.

  Product

  Church Admin

  Affected

  up to 4.0.27

  What to do

  Affects up to 4.0.27. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 27, 2024Church Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30197 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.26.

  Product

  Church Admin

  Affected

  up to 4.0.26

  What to do

  Affects up to 4.0.26. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 27, 2024Church Admin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-30193 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.17.

  Product

  Church Admin

  Affected

  up to 4.1.17

  What to do

  Affects up to 4.1.17. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Mar 26, 2024The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29832 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 6.1

  The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.

  Fixed in

  1.8.22

  What to do

  Update the plugin to 1.8.22 or newer.

  Full record and what to do →NVD recordappcheck-ng.comwordpress.org

• Mar 26, 2024The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29810 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4

  The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

  Fixed in

  1.8.22

  What to do

  Update the plugin to 1.8.22 or newer.

  Full record and what to do →NVD recordappcheck-ng.comwordpress.org

• Mar 26, 2024The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29809 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4

  The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

  Fixed in

  1.8.22

  What to do

  Update the plugin to 1.8.22 or newer.

  Full record and what to do →NVD recordappcheck-ng.comwordpress.org

• Mar 26, 2024The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.CVE-2024-29808 · WordPress plugins & themes · reported by info@appcheck-ng.comMedium 5.4

  The image_id parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_id parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

  Fixed in

  1.8.22

  What to do

  Update the plugin to 1.8.22 or newer.

  Full record and what to do →NVD recordappcheck-ng.comwordpress.org

• Mar 18, 2024Enjoy Social Feed plugin for WordPress website: Does not have authorisation and CSRF in various function hooked to admin_initCVE-2024-0779 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example

  Product

  Enjoy Social Feed plugin for WordPress website

  Affected

  up to 6.2.2

  What to do

  Affects up to 6.2.2. Update Enjoy Social Feed plugin for WordPress website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 11, 2024Seriously Simple Podcasting: Discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted requestCVE-2023-6444 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.

  Product

  Seriously Simple Podcasting

  Fixed in

  3.0.0

  What to do

  Update Seriously Simple Podcasting to 3.0.0 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Feb 23, 2024Admin side data storage for Contact Form 7: Unauthorized modification of dataCVE-2024-1779 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_status() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter the message read status of messages.

  Product

  Admin side data storage for Contact Form 7

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Admin side data storage for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 23, 2024Admin side data storage for Contact Form 7: Unauthorized modification of dataCVE-2024-1778 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_bookmark() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter bookmark statuses.

  Product

  Admin side data storage for Contact Form 7

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Admin side data storage for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 23, 2024Admin side data storage for Contact Form 7: Cross-Site Request ForgeryCVE-2024-1777 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the settings update function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

  Product

  Admin side data storage for Contact Form 7

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Admin side data storage for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 23, 2024Admin side data storage for Contact Form 7: SQL InjectionCVE-2024-1776 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'form-id' parameter in all versions up to, and including, 1.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  Admin side data storage for Contact Form 7

  Affected

  up to 1.1.1

  What to do

  Affects up to 1.1.1. Update Admin side data storage for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Feb 21, 2024Admin Menu Editor: Cross-Site Request Forgery (CSRF)CVE-2024-24876 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12.

  Product

  Admin Menu Editor

  Affected

  up to 1.12

  What to do

  Affects up to 1.12. Update Admin Menu Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Jan 29, 2024Page Builder: Pagelayer: Doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5124 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.

  Product

  Page Builder: Pagelayer

  Fixed in

  1.8.0

  What to do

  Update Page Builder: Pagelayer to 1.8.0 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

  Product

  WordPress Database Administrator

  Affected

  up to 1.0.3

  What to do

  Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 16, 2024Print Invoice & Delivery Notes for WooCommerce: Is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders pageCVE-2023-0479 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.

  Product

  Print Invoice & Delivery Notes for WooCommerce

  Fixed in

  4.7.2

  What to do

  Update Print Invoice & Delivery Notes for WooCommerce to 4.7.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 16, 2024Slide Anything: Does not properly sanitize or escape the slide title before outputting it in the admin pagesCVE-2022-2413 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfiltered_html capability is disabled.

  Product

  Slide Anything

  Fixed in

  2.3.47

  What to do

  Update Slide Anything to 2.3.47 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 16, 2024Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (suchCVE-2022-1538 · WordPress plugins & themes · reported by WPScanHigh 7.2

  Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed.

  Fixed in

  1.1.1

  What to do

  Update the plugin to 1.1.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 16, 2024WP-PostRatings: Does not sanitise the postratings_image parameter from its options page (wp-admin/adminCVE-2021-25117 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php). Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfiltered_html capability is disabled.

  Product

  WP-PostRatings

  Fixed in

  1.86.1

  What to do

  Update WP-PostRatings to 1.86.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 16, 2024WP Editor: Did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameterCVE-2021-24151 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.

  Product

  WP Editor

  Fixed in

  1.2.7

  What to do

  Update WP Editor to 1.2.7 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 8, 2024WP VR: Does not authorisation and CSRF in a function hooked to admin_initCVE-2023-6529 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.

  Product

  WP VR

  Fixed in

  8.3.15

  What to do

  Update WP VR to 8.3.15 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 8, 2024Any unauthenticated user may send e-mail from the site with any title or content to the adminCVE-2023-6042 · WordPress plugins & themes · reported by WPScanHigh 7.5

  Any unauthenticated user may send e-mail from the site with any title or content to the admin

  Fixed in

  2.0.3

  What to do

  Update the plugin to 2.0.3 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Jan 5, 2024White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: Cross-Site Request Forgery (CSRF)CVE-2023-52128 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0.

  Product

  White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard

  Affected

  up to 2.9.0

  What to do

  Affects up to 2.9.0. Update White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Dec 31, 2023WP Adminify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52132 · WordPress plugins & themes · reported by PatchstackHigh 7.6

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.

  Product

  WP Adminify

  Affected

  up to 3.1.6

  What to do

  Affects up to 3.1.6. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Dec 29, 2023Frontend Admin by DynamiApps: Unrestricted Upload of File with Dangerous TypeCVE-2023-51411 · WordPress plugins & themes · reported by PatchstackCritical 10

  Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.

  Product

  Frontend Admin by DynamiApps

  Affected

  up to 3.18.3

  What to do

  Affects up to 3.18.3. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Dec 18, 2023IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perfCVE-2023-6222 · WordPress plugins & themes · reported by WPScanHigh 7.2

  IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks

  Fixed in

  3.4.2.1

  What to do

  Update the plugin to 3.4.2.1 or newer.

  Full record and what to do →NVD recorddrive.google.comwpscan.com

• Dec 4, 2023eCommerce Product Catalog Plugin for: Does not have CSRF checks in some of its admin pagesCVE-2023-5979 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products

  Product

  eCommerce Product Catalog Plugin for

  Fixed in

  3.3.26

  What to do

  Update eCommerce Product Catalog Plugin for to 3.3.26 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Nov 27, 2023WassUp Real Time Analytics: Does not escape IP address provided via some headers before outputting them back in an admin pageCVE-2023-5653 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins

  Product

  WassUp Real Time Analytics

  Affected

  up to 1.9.4.5

  What to do

  Affects up to 1.9.4.5. Update WassUp Real Time Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Nov 27, 2023Asgaros Forum: Allows forum administratorsCVE-2023-5604 · WordPress plugins & themes · reported by WPScanCritical 9.8

  The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.

  Product

  Asgaros Forum

  Fixed in

  2.7.1

  What to do

  Update Asgaros Forum to 2.7.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Nov 20, 2023The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change tCVE-2023-4824 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordwpscan.comwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.