Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
640 results · page 8 of 13
Feb 13, 2023Responsive Gallery Grid: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.9
- What to do
- Update Responsive Gallery Grid to 2.3.9 or newer.
Feb 13, 2023JetWidgets For Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0034 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- JetWidgets For Elementor
- Fixed in
- 1.0.14
- What to do
- Update JetWidgets For Elementor to 1.0.14 or newer.
Feb 13, 2023Paid Memberships Pro: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4830 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Paid Memberships Pro
- Fixed in
- 2.9.9
- What to do
- Update Paid Memberships Pro to 2.9.9 or newer.
Feb 13, 2023Youtube Channel Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4783 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Youtube Channel Gallery
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Youtube Channel Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023GigPress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4759 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GigPress
- Fixed in
- 2.3.28
- What to do
- Update GigPress to 2.3.28 or newer.
Feb 13, 2023Lightbox Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4682 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Lightbox Gallery
- Fixed in
- 0.9.5
- What to do
- Update Lightbox Gallery to 0.9.5 or newer.
Feb 13, 2023TemplatesNext ToolKit: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- TemplatesNext ToolKit
- Fixed in
- 3.2.8
- What to do
- Update TemplatesNext ToolKit to 3.2.8 or newer.
Feb 13, 2023WP Visitor Statistics (Real Time Traffic): Does not validate and escape one of its shortcode attributesCVE-2022-4656 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 6.5
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 6.5 or newer.
Feb 13, 2023Easy PayPal Buy Now Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4628 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Easy PayPal Buy Now Button
- Fixed in
- 1.7.4
- What to do
- Update Easy PayPal Buy Now Button to 1.7.4 or newer.
Feb 13, 2023Twenty20 Image Before-After: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4580 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Twenty20 Image Before-After
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update Twenty20 Image Before-After to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023Meks Flexible Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4562 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meks Flexible Shortcodes WordPress plugin before 1.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Meks Flexible Shortcodes
- Fixed in
- 1.3.5
- What to do
- Update Meks Flexible Shortcodes to 1.3.5 or newer.
Feb 13, 2023Rich Table of Contents: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4551 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rich Table of Contents WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Rich Table of Contents
- Fixed in
- 1.3.9
- What to do
- Update Rich Table of Contents to 1.3.9 or newer.
Feb 13, 2023Better Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4512 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Better Font Awesome
- Fixed in
- 2.0.4
- What to do
- Update Better Font Awesome to 2.0.4 or newer.
Feb 13, 2023Widgets on Pages: Does not validate and escape its shortcode attributes before outputting them back in the pageCVE-2022-4488 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Widgets on Pages
- Fixed in
- 1.8.0
- What to do
- Update Widgets on Pages to 1.8.0 or newer.
Feb 13, 2023Widget Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4473 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Widget Shortcode
- Affected
- up to 0.3.5
- What to do
- Affects up to 0.3.5. Update Widget Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023YARPP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4471 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- YARPP
- Fixed in
- 5.30.3
- What to do
- Update YARPP to 5.30.3 or newer.
Feb 13, 2023amr shortcode any widget: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4458 · WordPress plugins & themes · reported by WPScanMedium 5.4
The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- amr shortcode any widget
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update amr shortcode any widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023GiveWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4448 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GiveWP
- Fixed in
- 2.24.0
- What to do
- Update GiveWP to 2.24.0 or newer.
Feb 6, 2023Tutor LMS: Does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributesCVE-2023-0236 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Tutor LMS
- Fixed in
- 2.0.10
- What to do
- Update Tutor LMS to 2.0.10 or newer.
Feb 6, 2023Annual Archive: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0178 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Annual Archive
- Fixed in
- 1.6.0
- What to do
- Update Annual Archive to 1.6.0 or newer.
Feb 6, 2023Giveaways and Contests by RafflePress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0176 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.11.3
- What to do
- Update Giveaways and Contests by RafflePress to 1.11.3 or newer.
Feb 6, 2023WP VR: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0174 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP VR
- Fixed in
- 8.2.7
- What to do
- Update WP VR to 8.2.7 or newer.
Feb 6, 2023Drag & Drop Sales Funnel Builder for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0173 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Drag & Drop Sales Funnel Builder for
- Fixed in
- 2.6.9
- What to do
- Update Drag & Drop Sales Funnel Builder for to 2.6.9 or newer.
Feb 6, 2023jQuery T(-) Countdown Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0171 · WordPress plugins & themes · reported by WPScanMedium 5.4
The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- jQuery T(-) Countdown Widget
- Fixed in
- 2.3.24
- What to do
- Update jQuery T(-) Countdown Widget to 2.3.24 or newer.
Feb 6, 2023Html5 Audio Player: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0170 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Html5 Audio Player
- Fixed in
- 2.1.12
- What to do
- Update Html5 Audio Player to 2.1.12 or newer.
Feb 6, 2023GamiPress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0154 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GamiPress
- Fixed in
- 1.0.9
- What to do
- Update GamiPress to 1.0.9 or newer.
Feb 6, 2023Vimeo Video Autoplay Automute: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0153 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Vimeo Video Autoplay Automute
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Vimeo Video Autoplay Automute to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Cloak Front End Email: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Cloak Front End Email
- Fixed in
- 1.9.2
- What to do
- Update Cloak Front End Email to 1.9.2 or newer.
Feb 6, 2023WordPrezi: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0149 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WordPrezi
- Fixed in
- 0.9
- What to do
- Update WordPrezi to 0.9 or newer.
Feb 6, 2023Gallery Factory Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Gallery Factory Lite
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Gallery Factory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Flexible Captcha: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0147 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Flexible Captcha
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Flexible Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Naver Map: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0146 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Naver Map
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Naver Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Send PDF for Contact Form 7: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-0143 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Send PDF for Contact Form 7
- Fixed in
- 0.9.9.2
- What to do
- Update Send PDF for Contact Form 7 to 0.9.9.2 or newer.
Feb 6, 2023WC Vendors Marketplace: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0072 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WC Vendors Marketplace
- Fixed in
- 2.4.5
- What to do
- Update WC Vendors Marketplace to 2.4.5 or newer.
Feb 6, 2023ResponsiveVoice Text To Speech: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0070 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ResponsiveVoice Text To Speech
- Fixed in
- 1.7.7
- What to do
- Update ResponsiveVoice Text To Speech to 1.7.7 or newer.
Feb 6, 2023EAN for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0062 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- EAN for WooCommerce
- Fixed in
- 4.4.3
- What to do
- Update EAN for WooCommerce to 4.4.3 or newer.
Feb 6, 2023Clean Login: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Clean Login
- Fixed in
- 1.13.7
- What to do
- Update Clean Login to 1.13.7 or newer.
Feb 6, 2023Breadcrumb: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4836 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Breadcrumb
- Fixed in
- 1.5.33
- What to do
- Update Breadcrumb to 1.5.33 or newer.
Feb 6, 2023YourChannel: Everything you want in a YouTube: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- YourChannel: Everything you want in a YouTube
- Fixed in
- 1.2.3
- What to do
- Update YourChannel: Everything you want in a YouTube to 1.2.3 or newer.
Feb 6, 2023Simple Tooltips: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Simple Tooltips
- Fixed in
- 2.1.4
- What to do
- Update Simple Tooltips to 2.1.4 or newer.
Feb 6, 2023WP-ShowHide: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4825 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-ShowHide WordPress plugin before 1.05 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP-ShowHide
- Fixed in
- 1.05
- What to do
- Update WP-ShowHide to 1.05 or newer.
Feb 6, 2023WP Blog and Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4824 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Blog and Widgets
- Fixed in
- 2.3.1
- What to do
- Update WP Blog and Widgets to 2.3.1 or newer.
Feb 6, 2023Materialis Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4762 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Materialis Companion
- Fixed in
- 1.3.40
- What to do
- Update Materialis Companion to 1.3.40 or newer.
Feb 6, 2023My YouTube Channel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4756 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- My YouTube Channel
- Fixed in
- 3.23.0
- What to do
- Update My YouTube Channel to 3.23.0 or newer.
Feb 6, 2023Post Category Image With Grid and Slider: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4747 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Post Category Image With Grid and Slider
- Fixed in
- 1.4.8
- What to do
- Update Post Category Image With Grid and Slider to 1.4.8 or newer.
Feb 6, 2023Strong Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4717 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Strong Testimonials
- Fixed in
- 3.0.3
- What to do
- Update Strong Testimonials to 3.0.3 or newer.
Feb 6, 2023Leaflet Maps Marker: Does not validate and escape one of its shortcode attributesCVE-2022-4677 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Leaflet Maps Marker
- Fixed in
- 3.12.7
- What to do
- Update Leaflet Maps Marker to 3.12.7 or newer.
Feb 6, 2023Ibtana: Does not validate and escape one of its shortcode attributesCVE-2022-4674 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
- Product
- Ibtana
- Fixed in
- 1.1.8.8
- What to do
- Update Ibtana to 1.1.8.8 or newer.
Feb 6, 2023PDF.js Viewer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- PDF.js Viewer
- Fixed in
- 2.1.8
- What to do
- Update PDF.js Viewer to 2.1.8 or newer.
Feb 6, 2023Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4664 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 3.6.0
- What to do
- Update Logo Slider to 3.6.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.