Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,155 results · page 9 of 24
Feb 23, 2024Admin side data storage for Contact Form 7: SQL InjectionCVE-2024-1776 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'form-id' parameter in all versions up to, and including, 1.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Admin side data storage for Contact Form 7
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Admin side data storage for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 21, 2024Admin Menu Editor: Cross-Site Request Forgery (CSRF)CVE-2024-24876 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Janis Elsts Admin Menu Editor.This issue affects Admin Menu Editor: from n/a through 1.12.
- Product
- Admin Menu Editor
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Admin Menu Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 29, 2024Page Builder: Pagelayer: Doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5124 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.0
- What to do
- Update Page Builder: Pagelayer to 1.8.0 or newer.
Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- WordPress Database Administrator
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Print Invoice & Delivery Notes for WooCommerce: Is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders pageCVE-2023-0479 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the edit_others_shop_orders capability. WooCommerce must be installed and active. This vulnerability is caused by a urldecode() after cleanup with esc_url_raw(), allowing double encoding.
- Product
- Print Invoice & Delivery Notes for WooCommerce
- Fixed in
- 4.7.2
- What to do
- Update Print Invoice & Delivery Notes for WooCommerce to 4.7.2 or newer.
Jan 16, 2024Slide Anything: Does not properly sanitize or escape the slide title before outputting it in the admin pagesCVE-2022-2413 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfiltered_html capability is disabled.
- Product
- Slide Anything
- Fixed in
- 2.3.47
- What to do
- Update Slide Anything to 2.3.47 or newer.
Jan 16, 2024Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (suchCVE-2022-1538 · WordPress plugins & themes · reported by WPScanHigh 7.2
Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed.
- Fixed in
- 1.1.1
- What to do
- Update the plugin to 1.1.1 or newer.
Jan 16, 2024WP-PostRatings: Does not sanitise the postratings_image parameter from its options page (wp-admin/adminCVE-2021-25117 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php). Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfiltered_html capability is disabled.
- Product
- WP-PostRatings
- Fixed in
- 1.86.1
- What to do
- Update WP-PostRatings to 1.86.1 or newer.
Jan 16, 2024WP Editor: Did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameterCVE-2021-24151 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.
- Product
- WP Editor
- Fixed in
- 1.2.7
- What to do
- Update WP Editor to 1.2.7 or newer.
Jan 8, 2024WP VR: Does not authorisation and CSRF in a function hooked to admin_initCVE-2023-6529 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admin_init, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities.
- Product
- WP VR
- Fixed in
- 8.3.15
- What to do
- Update WP VR to 8.3.15 or newer.
Jan 8, 2024Any unauthenticated user may send e-mail from the site with any title or content to the adminCVE-2023-6042 · WordPress plugins & themes · reported by WPScanHigh 7.5
Any unauthenticated user may send e-mail from the site with any title or content to the admin
- Fixed in
- 2.0.3
- What to do
- Update the plugin to 2.0.3 or newer.
Jan 5, 2024White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: Cross-Site Request Forgery (CSRF)CVE-2023-52128 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0.
- Product
- White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard
- Affected
- up to 2.9.0
- What to do
- Affects up to 2.9.0. Update White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 31, 2023WP Adminify: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52132 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.
- Product
- WP Adminify
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update WP Adminify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 29, 2023Frontend Admin by DynamiApps: Unrestricted Upload of File with Dangerous TypeCVE-2023-51411 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps.This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.
- Product
- Frontend Admin by DynamiApps
- Affected
- up to 3.18.3
- What to do
- Affects up to 3.18.3. Update Frontend Admin by DynamiApps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 18, 2023IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perfCVE-2023-6222 · WordPress plugins & themes · reported by WPScanHigh 7.2
IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks
- Fixed in
- 3.4.2.1
- What to do
- Update the plugin to 3.4.2.1 or newer.
Full record and what to do →NVD recorddrive.google.comwpscan.com
Dec 4, 2023eCommerce Product Catalog Plugin for: Does not have CSRF checks in some of its admin pagesCVE-2023-5979 · WordPress plugins & themes · reported by WPScanMedium 6.5
The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products
- Product
- eCommerce Product Catalog Plugin for
- Fixed in
- 3.3.26
- What to do
- Update eCommerce Product Catalog Plugin for to 3.3.26 or newer.
Nov 30, 2023WP Roadmap – Product Feedback Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-41128 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design WP Roadmap – Product Feedback Board allows Stored XSS.This issue affects WP Roadmap – Product Feedback Board: from n/a through 1.0.8.
- Product
- WP Roadmap – Product Feedback Board
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update WP Roadmap – Product Feedback Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 27, 2023WassUp Real Time Analytics: Does not escape IP address provided via some headers before outputting them back in an admin pageCVE-2023-5653 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins
- Product
- WassUp Real Time Analytics
- Affected
- up to 1.9.4.5
- What to do
- Affects up to 1.9.4.5. Update WassUp Real Time Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 27, 2023Asgaros Forum: Allows forum administratorsCVE-2023-5604 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.
- Product
- Asgaros Forum
- Fixed in
- 2.7.1
- What to do
- Update Asgaros Forum to 2.7.1 or newer.
Nov 20, 2023The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change tCVE-2023-4824 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- What to do
- Update the plugin to the newest version.
Nov 12, 2023Church Admin: Server-Side Request Forgery (SSRF)CVE-2023-38515 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Server-Side Request Forgery (SSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 3.7.56.
- Product
- Church Admin
- Affected
- up to 3.7.56
- What to do
- Affects up to 3.7.56. Update Church Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in gl_SPICE New Adman plugin <= 1.6.8 versions.CVE-2023-27441 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in gl_SPICE New Adman plugin <= 1.6.8 versions.
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.CVE-2023-28618 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.
- Affected
- up to 1.16
- What to do
- Affects up to 1.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 6, 2023Proper Fraction LLC: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-47184 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Proper Fraction LLC. Admin Bar & Dashboard Access Control plugin <= 1.2.8 versions.
- Product
- Proper Fraction LLC
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Proper Fraction LLC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 31, 2023Groundhogg Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-40681 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11.10 versions.
- Product
- Groundhogg Inc
- Fixed in
- 2.7.11.11
- What to do
- Update Groundhogg Inc to 2.7.11.11 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 16, 2023File Manager Pro: Allows admin users to upload arbitrary filesCVE-2023-4861 · WordPress plugins & themes · reported by WPScanHigh 7.2
The File Manager Pro WordPress plugin before 1.8.1 allows admin users to upload arbitrary files, even in environments where such a user should not be able to gain full control of the server, such as a multisite installation. This leads to remote code execution.
- Product
- File Manager Pro
- Fixed in
- 1.8.1
- What to do
- Update File Manager Pro to 1.8.1 or newer.
Oct 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Rémi Leclercq Hide admin notices – Admin Notification Center plugin <= 2.3.2 versions.CVE-2023-41672 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rémi Leclercq Hide admin notices – Admin Notification Center plugin <= 2.3.2 versions.
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 2, 2023jesweb.Dev Anchor Episodes Index: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-44145 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in jesweb.Dev Anchor Episodes Index (Spotify for Podcasters) plugin <= 2.1.7 versions.
- Product
- jesweb.Dev Anchor Episodes Index
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update jesweb.Dev Anchor Episodes Index to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 29, 2023PressPage Entertainment Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-41661 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.
- Product
- PressPage Entertainment Inc
- Affected
- up to 3.1.35
- What to do
- Affects up to 3.1.35. Update PressPage Entertainment Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 29, 2023Groundhogg Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-41657 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. HollerBox plugin <= 2.3.2 versions.
- Product
- Groundhogg Inc
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Groundhogg Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 27, 2023David F: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-27617 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions.
- Product
- David F
- Fixed in
- 10.6.7
- What to do
- Update David F to 10.6.7 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 11, 2023WP Adminify: Does not sanitise and escape some of its settingsCVE-2023-4060 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Adminify
- Fixed in
- 3.1.6
- What to do
- Update WP Adminify to 3.1.6 or newer.
Sep 1, 2023Liam Gladdy: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-25042 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Liam Gladdy (Storm Consultancy) oAuth Twitter Feed for Developers plugin <= 2.3.0 versions.
- Product
- Liam Gladdy
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Liam Gladdy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 30, 2023XootiX Side Cart Woocommerce: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-28415 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XootiX Side Cart Woocommerce (Ajax) plugin <= 2.2 versions.
- Product
- XootiX Side Cart Woocommerce
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update XootiX Side Cart Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 30, 2023All Users Messenger: Does not prevent non-administrator users from deleting messages from the all-users messengerCVE-2023-4023 · WordPress plugins & themes · reported by WPScanMedium 4.3
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger.
- Product
- All Users Messenger
- Affected
- up to 1.24
- What to do
- Affects up to 1.24. Update All Users Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 21, 2023Change WP Admin Login: Discloses the URL of the hidden login pageCVE-2023-3604 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered.
- Product
- Change WP Admin Login
- Fixed in
- 1.1.4
- What to do
- Update Change WP Admin Login to 1.1.4 or newer.
Aug 17, 2023Steve Curtis, St: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-30874 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Steve Curtis, St. Pete Design Gps Plotter plugin <= 5.1.4 versions.
- Product
- Steve Curtis, St
- Affected
- up to 5.1.4
- What to do
- Affects up to 5.1.4. Update Steve Curtis, St to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Aug 16, 2023Image Optimizer by 10web: Does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panelCVE-2023-2122 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.
- Product
- Image Optimizer by 10web
- Fixed in
- 1.0.27
- What to do
- Update Image Optimizer by 10web to 1.0.27 or newer.
Aug 16, 2023Booking Manager: Does not validate URLs input in it's admin panel or in shortcodes for showing events from a remoteCVE-2023-1977 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.
- Product
- Booking Manager
- Fixed in
- 2.0.29
- What to do
- Update Booking Manager to 2.0.29 or newer.
Aug 10, 2023brandiD Social Proof: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-24389 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in brandiD Social Proof (Testimonial) Slider plugin <= 2.2.3 versions.
- Product
- brandiD Social Proof
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update brandiD Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 24, 2023User Activity Log: Does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pagesCVE-2023-2761 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- User Activity Log
- Fixed in
- 1.6.3
- What to do
- Update User Activity Log to 1.6.3 or newer.
Jul 18, 2023Repute InfoSystems ARMember: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-47421 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.
- Product
- Repute InfoSystems ARMember
- What to do
- Update Repute InfoSystems ARMember to the newest version.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions.CVE-2023-37889 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions.
- Affected
- up to 2.0.13
- What to do
- Affects up to 2.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2023David F: Auth. (admin+) SQL Injection (SQLi)CVE-2023-29095 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Auth. (admin+) SQL Injection (SQLi) vulnerability in David F. Carr RSVPMaker plugin < 10.5.5 versions.
- Product
- David F
- Fixed in
- 10.5.5
- What to do
- Update David F to 10.5.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 4, 2023Protect WP Admin: Discloses the URL of the admin panel via a redirection of a crafted URLCVE-2023-3139 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.
- Product
- Protect WP Admin
- Fixed in
- 4.0
- What to do
- Update Protect WP Admin to 4.0 or newer.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jun 26, 2023Eric Martin SimpleModal Contact Form: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-29438 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Martin SimpleModal Contact Form (SMCF) plugin <= 1.2.9 versions.
- Product
- Eric Martin SimpleModal Contact Form
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update Eric Martin SimpleModal Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 22, 2023Grade Us, Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-28774 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Grade Us, Inc. Review Stream plugin <= 1.6.5 versions.
- Product
- Grade Us, Inc
- Affected
- up to 1.6.5
- What to do
- Affects up to 1.6.5. Update Grade Us, Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 20, 2023Vadym K: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-35878 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.
- Product
- Vadym K
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Vadym K to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 9, 2023The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up toCVE-2023-2767 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Affected
- up to 4.19.1
- What to do
- Affects up to 4.19.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 6, 2023Controlled Admin Access: Privilege EscalationCVE-2021-4360 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.
- Product
- Controlled Admin Access
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Controlled Admin Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.svn.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.