Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

489 results · page 8 of 10

Dec 29, 2023Rename Media Files: Improper Control of Generation of Code ('Code Injection')CVE-2023-32095 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Milan Dinić Rename Media Files.This issue affects Rename Media Files: from n/a through 1.0.1.
Product
Rename Media Files
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Rename Media Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 26, 2023rtMedia for WordPress, BuddyPress and bbPress: Loads the contents of the import file in an unsafe mannerCVE-2023-5939 · WordPress plugins & themes · reported by WPScanHigh 7.2
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.
Product
rtMedia for WordPress, BuddyPress and bbPress
Fixed in
4.6.16
What to do
Update rtMedia for WordPress, BuddyPress and bbPress to 4.6.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023rtMedia for WordPress, BuddyPress and bbPress: Does not validate files to be uploadedCVE-2023-5931 · WordPress plugins & themes · reported by WPScanHigh 8.8
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server
Product
rtMedia for WordPress, BuddyPress and bbPress
Fixed in
4.6.16
What to do
Update rtMedia for WordPress, BuddyPress and bbPress to 4.6.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 20, 2023Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: Unrestricted Upload of File with Dangerous TypeCVE-2023-40204 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unrestricted Upload of File with Dangerous Type vulnerability in Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager.This issue affects Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager: from n/a through 2.9.2.
Product
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Photo Engine (Media Organizer & Lightroom): Authorization Bypass Through User-Controlled KeyCVE-2023-38513 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom): from n/a through 6.2.5.
Product
Photo Engine (Media Organizer & Lightroom)
Affected
up to 6.2.5
What to do
Affects up to 6.2.5. Update Photo Engine (Media Organizer & Lightroom) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Media File Renamer: Rename Files (Manual, Auto & AI): Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-44991 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Media File Renamer: Rename Files (Manual, Auto & AI).This issue affects Media File Renamer: Rename Files (Manual, Auto & AI): from n/a through 5.6.9.
Product
Media File Renamer: Rename Files (Manual, Auto & AI)
Affected
up to 5.6.9
What to do
Affects up to 5.6.9. Update Media File Renamer: Rename Files (Manual, Auto & AI) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: Cross-Site Request Forgery (CSRF)CVE-2023-33214 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
Product
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Affected
up to 3.1
What to do
Affects up to 3.1. Update Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023MyBookTable Bookstore by Stormhill Media: Cross-Site Request Forgery (CSRF)CVE-2023-48331 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stormhill Media MyBookTable Bookstore by Stormhill Media allows Cross Site Request Forgery.This issue affects MyBookTable Bookstore by Stormhill Media: from n/a through 3.3.4.
Product
MyBookTable Bookstore by Stormhill Media
Affected
up to 3.3.4
What to do
Affects up to 3.3.4. Update MyBookTable Bookstore by Stormhill Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-41127 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Evergreen Content Poster Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media allows Stored XSS.This issue affects Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media: from n/a through 1.3.6.1.
Product
Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media
Affected
up to 1.3.6.1
What to do
Affects up to 1.3.6.1. Update Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023Medialist: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-5942 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Medialist
Fixed in
1.4.1
What to do
Update Medialist to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tagsCVE-2023-5845 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Social Media Share Buttons WordPress plugin before 5.1.1 leaks password-protected post content to unauthenticated visitors in some meta tags
Product
Simple Social Media Share Buttons
Fixed in
5.1.1
What to do
Update Simple Social Media Share Buttons to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.CVE-2023-29428 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions.
Affected
up to 1.1.3
What to do
Affects up to 1.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Sybre Waaijer Pro Mime Types – Manage file media types plugin <= 1.0.7 versions.CVE-2023-32502 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sybre Waaijer Pro Mime Types – Manage file media types plugin <= 1.0.7 versions.
Fixed in
2.0.0
What to do
Update the plugin to 2.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023CITS Support svg, webp Media and TTF,OTF File Upload: Does not sanitise uploaded SVG filesCVE-2023-5458 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
CITS Support svg, webp Media and TTF,OTF File Upload
Fixed in
3.0
What to do
Update CITS Support svg, webp Media and TTF,OTF File Upload to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Novo-media Novo-Map : your WP posts on custom google maps plugin <= 1.1.2 versions.CVE-2023-46190 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Novo-media Novo-Map : your WP posts on custom google maps plugin <= 1.1.2 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023Social Media Share Buttons & Social Sharing Icons: Cross-Site Request ForgeryCVE-2023-5602 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Social Media Share Buttons & Social Sharing Icons
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Social Media Share Buttons & Social Sharing Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Social Media Share Buttons & Social Sharing Icons: Sensitive Information ExposureCVE-2023-5070 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsi_save_export function. This can allow subscribers to export plugin settings that include social media authentication tokens and secrets as well as app passwords.
Product
Social Media Share Buttons & Social Sharing Icons
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Social Media Share Buttons & Social Sharing Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 16, 2023PowerPress Podcasting plugin by Blubrry: Does not sanitize and escape the media url field in postsCVE-2023-4820 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin.
Product
PowerPress Podcasting plugin by Blubrry
Fixed in
11.0.12
What to do
Update PowerPress Podcasting plugin by Blubrry to 11.0.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Enable Media Replace: Unserializes user input via the Remove Background featureCVE-2023-4643 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog
Product
Enable Media Replace
Fixed in
4.1.3
What to do
Update Enable Media Replace to 4.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions.CVE-2023-44259 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions.
Affected
up to 2.10.2
What to do
Affects up to 2.10.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 22, 2023Media Library Assistant: Stored Cross-Site ScriptingCVE-2023-4716 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including, 3.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Media Library Assistant
Affected
up to 3.10
What to do
Affects up to 3.10. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2023Media Library Assistant: Local File Inclusion and Remote Code ExecutionCVE-2023-4634 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.
Product
Media Library Assistant
Affected
up to 3.09
What to do
Affects up to 3.09. Update Media Library Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Sep 4, 2023Media from FTP: Does not properly limit who can use the pluginCVE-2023-4019 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.
Product
Media from FTP
Fixed in
11.17
What to do
Update Media from FTP to 11.17 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023Upload Media By URL: Does not have CSRF checkCVE-2023-3720 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Upload Media By URL WordPress plugin before 1.0.8 does not have CSRF check when uploading files, which could allow attackers to make logged in admins upload files (including HTML containing JS code for users with the unfiltered_html capability) on their behalf.
Product
Upload Media By URL
Fixed in
1.0.8
What to do
Update Upload Media By URL to 1.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.CVE-2023-37386 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions.CVE-2023-25036 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions.
Affected
up to 1.6
What to do
Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2023Sell Media: Cross-Site Request ForgeryCVE-2021-4420 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Sell Media plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.5. This is due to missing or incorrect nonce validation on the sell_media_process() function. This makes it possible for unauthenticated attackers to sell media paypal orders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Sell Media
Affected
up to 2.5.5
What to do
Affects up to 2.5.5. Update Sell Media to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.CVE-2022-47144 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <= 1.1 versions.CVE-2022-46865 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <= 1.1 versions.
Affected
up to 1.1
What to do
Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.CVE-2023-23724 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.
Fixed in
3.10
What to do
Update the plugin to 3.10 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.CVE-2022-47142 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 4, 2023A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress.CVE-2017-20183 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in External Media without Import Plugin up to 1.0.0 on WordPress. It has been declared as problematic. This vulnerability affects the function print_media_new_panel of the file external-media-without-import.php. The manipulation of the argument url/error/width/height/mime-type leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.0.1 is able to address this issue. The patch is identified as 9d2ecd159a6e2e3f710b4f1c28e2714f66502746. It is recommended to upgrade the affected component. VDB-227950 is the identifier assigned to this vulnerability.
Product
External Media without Import
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update External Media without Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Apr 10, 2023Auto Rename Media On Upload: Does not sanitise and escape some of its settingsCVE-2023-0605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Rename Media On Upload WordPress plugin before 1.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Auto Rename Media On Upload
Fixed in
1.1.0
What to do
Update Auto Rename Media On Upload to 1.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 4, 2023A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress.CVE-2014-125090 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in Media Downloader Plugin 0.1.992 on WordPress. It has been declared as problematic. This vulnerability affects the function dl_file_resumable of the file getfile.php. The manipulation of the argument file leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.1.993 is able to address this issue. The patch is identified as 77beb720c682b9300035ab5f96eee225181d8a92. It is recommended to upgrade the affected component. VDB-222262 is the identifier assigned to this vulnerability.
Affected
0.1.992 to 0.1.992
What to do
Affects 0.1.992 to 0.1.992. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Feb 27, 2023Media Library Assistant: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0279 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
Media Library Assistant
Fixed in
3.06
What to do
Update Media Library Assistant to 3.06 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Feb 27, 2023Olevmedia Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0168 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Olevmedia Shortcodes WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Olevmedia Shortcodes
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Olevmedia Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Real Media Library: Does not sanitise and escape the created folder namesCVE-2023-0285 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
Product
Real Media Library
Fixed in
4.18.29
What to do
Update Real Media Library to 4.18.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress.CVE-2022-4905 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 is able to address this issue. The patch is identified as 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. It is recommended to upgrade the affected component. VDB-220750 is the identifier assigned to this vulnerability.
Affected
3.1.1 to 3.1.1
What to do
Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Feb 13, 2023Enable Media Replace: Does not prevent authors from uploading arbitrary files to the siteCVE-2023-0255 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
Product
Enable Media Replace
Fixed in
4.0.2
What to do
Update Enable Media Replace to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023MediaElement.js: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4699 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
Product
MediaElement.js
Affected
up to 4.2.8
What to do
Affects up to 4.2.8. Update MediaElement.js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 13, 2023Mediamatic – Media Library Folders: Cross-Site Request ForgeryCVE-2023-0294 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.1. This is due to missing or incorrect nonce validation on its AJAX actions function. This makes it possible for unauthenticated attackers to change image categories used by the plugin, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Mediamatic – Media Library Folders
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Mediamatic – Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 13, 2023Mediamatic – Media Library Folders: Authorization bypassCVE-2023-0293 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change image categories, which it uses to arrange them in folder views.
Product
Mediamatic – Media Library Folders
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Mediamatic – Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 2, 2023multimedial images: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4370 · WordPress plugins & themes · reported by WPScanHigh 7.2
The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
Product
multimedial images
Affected
up to 1.0b
What to do
Affects up to 1.0b. Update multimedial images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 19, 2022External Media: Does not sanitise and escape some of its settingsCVE-2022-3832 · WordPress plugins & themes · reported by WPScanMedium 4.8
The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
External Media
Fixed in
1.0.36
What to do
Update External Media to 1.0.36 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 18, 2022Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.CVE-2022-41634 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.
Affected
up to 7.1.1
What to do
Affects up to 7.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.CVE-2022-41618 · WordPress plugins & themes · reported by PatchstackLow 3.7
Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.
Affected
up to 3.00
What to do
Affects up to 3.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Oct 25, 2022Blog2Social: Social Media Auto Post & Scheduler: Does not have authorisation in an AJAX actionCVE-2022-3247 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the URL to make a request to is an external one. As a result, any authenticated users, such as subscriber could perform SSRF attacks
Product
Blog2Social: Social Media Auto Post & Scheduler
Fixed in
6.9.10
What to do
Update Blog2Social: Social Media Auto Post & Scheduler to 6.9.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2022Blog2Social: Social Media Auto Post & Scheduler: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3246 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers
Product
Blog2Social: Social Media Auto Post & Scheduler
Fixed in
6.9.10
What to do
Update Blog2Social: Social Media Auto Post & Scheduler to 6.9.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2022Enable Media Replace: Does not ensure that renamed files are moved to the Upload folderCVE-2022-2554 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example
Product
Enable Media Replace
Fixed in
4.0.0
What to do
Update Enable Media Replace to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 30, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.CVE-2021-36839 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73 at WordPress.
Affected
up to 4.73
What to do
Affects up to 4.73. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.