Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

612 results · page 9 of 13

Sep 27, 2023Options for Twenty Seventeen: Stored Cross-Site ScriptingCVE-2023-5162 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Options for Twenty Seventeen plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social-links' shortcode in versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Options for Twenty Seventeen
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update Options for Twenty Seventeen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 16, 2023Image Optimizer by 10web: Does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panelCVE-2023-2122 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.
Product
Image Optimizer by 10web
Fixed in
1.0.27
What to do
Update Image Optimizer by 10web to 1.0.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2023EWWW Image Optimizer: Cross-Site Request ForgeryCVE-2020-36750 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenticated attackers to perform bulk image optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
EWWW Image Optimizer
Affected
up to 5.8.1
What to do
Affects up to 5.8.1. Update EWWW Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin <= 1.4.5 versions.CVE-2023-25706 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Pagup WordPress Robots.Txt optimization plugin <= 1.4.5 versions.
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin: Use a third-party library that removes the escaping on some HTML charactersCVE-2023-1119 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.
Product
WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin
Fixed in
3.2.13
What to do
Update WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin to 3.2.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 6, 2023WordPress Automatic: Arbitrary options updatesCVE-2021-4374 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.
Product
WordPress Automatic
Affected
up to 3.53.2
What to do
Affects up to 3.53.2. Update WordPress Automatic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023versions up to, and including, 1.21.11 and 1.21.4: The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options ChangeCVE-2020-36725 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings.
Product
versions up to, and including, 1.21.11 and 1.21.4
Affected
up to 1.21.11
What to do
Affects up to 1.21.11. Update versions up to, and including, 1.21.11 and 1.21.4 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com templateinvaders.com
Jun 6, 2023Kali Forms: Authenticated Options ChangeCVE-2020-36720 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated attacker to change (or delete) the plugin's settings.
Product
Kali Forms
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Kali Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (CVE-2019-25142 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record blog.nintechnet.com themes.trac.wordpress.org
May 30, 2023Image Optimizer by 10web: Does not sanitize the dir parameterCVE-2023-2117 · WordPress plugins & themes · reported by WPScanLow 2.7
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.
Product
Image Optimizer by 10web
Fixed in
1.0.27
What to do
Update Image Optimizer by 10web to 1.0.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2023Autoptimize: Does not sanitise and escape the settings imported from a previous exportCVE-2023-2113 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
Product
Autoptimize
Fixed in
3.1.7
What to do
Update Autoptimize to 3.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023ActiveCampaign: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0233 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
ActiveCampaign
Fixed in
8.1.12
What to do
Update ActiveCampaign to 8.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Ultimate Carousel For Elementor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0280 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Ultimate Carousel For Elementor
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Ultimate Carousel For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updCVE-2023-0889 · WordPress plugins & themes · reported by WPScanMedium 6.5
Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, such as enabling registration and set the default role to administrator
Fixed in
2.0.1
What to do
Update the plugin to 2.0.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023W4 Post List: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0374 · WordPress plugins & themes · reported by WPScanMedium 5.4
The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
W4 Post List
Fixed in
2.4.6
What to do
Update W4 Post List to 2.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Simple Giveaways: Does not sanitise and escape some of its Giveaways optionsCVE-2023-1122 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Giveaways WordPress plugin before 2.45.1 does not sanitise and escape some of its Giveaways options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Simple Giveaways
Fixed in
2.45.1
What to do
Update Simple Giveaways to 2.45.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023menu shortcode: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0395 · WordPress plugins & themes · reported by WPScanMedium 5.4
The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
menu shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update menu shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.CVE-2022-30705 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions.
Fixed in
2.35.1.3.0
What to do
Update the plugin to 2.35.1.3.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 17, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1472 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Actions include resetting the API key, accessing or deleting log files, and deleting cache among others.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 13, 2023Popup Builder by OptinMonster: Does not ensure that the campaign to be loaded via some shortcodes is actually a campaignCVE-2023-0772 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
Product
Popup Builder by OptinMonster
Fixed in
2.12.2
What to do
Update Popup Builder by OptinMonster to 2.12.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Cross-Site Request Forgery (CSRF) vulnerability in A2 Hosting A2 Optimized WP plugin <= 3.0.4 versions.CVE-2023-23711 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in A2 Hosting A2 Optimized WP plugin <= 3.0.4 versions.
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1346 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the clear_page_cache function. This makes it possible for unauthenticated attackers to clear the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1345 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the queue_posts function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1344 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the uucss_update_rule function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1343 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the attach_rule function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1342 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ucss_connect function. This makes it possible for unauthenticated attackers to connect the site to a new license key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1341 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ajax_deactivate function. This makes it possible for unauthenticated attackers to turn off caching via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1340 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the clear_uucss_logs function. This makes it possible for unauthenticated attackers to clear plugin logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized settings updateCVE-2023-1339 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the uucss_update_rule function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to update caching rules.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized cache modificationCVE-2023-1338 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the attach_rule function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify cache rules.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized data lossCVE-2023-1337 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the clear_uucss_logs function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete plugin log files.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized settings updateCVE-2023-1336 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajax_deactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to disable caching.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized plugin settings updateCVE-2023-1335 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the ucss_connect function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to connect a new license key to the site.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized cache modificationCVE-2023-1334 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the queue_posts function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify the plugin's cache.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized loss of dataCVE-2023-1333 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_page_cache function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete the plugin's cache.
Product
RapidLoad Power-Up for Autoptimize
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update RapidLoad Power-Up for Autoptimize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 6, 2023Scriptless Social Sharing: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0377 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Scriptless Social Sharing
Fixed in
3.2.2
What to do
Update Scriptless Social Sharing to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 28, 2023WP Meta SEO: Unauthorized options updateCVE-2023-1022 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to update google analytics options maintained by the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2023VK All in One Expansion Unit: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0230 · WordPress plugins & themes · reported by WPScanMedium 5.4
The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
VK All in One Expansion Unit
Fixed in
9.86.0.0
What to do
Update VK All in One Expansion Unit to 9.86.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Easy Digital Downloads: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0380 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Easy Digital Downloads
Fixed in
3.1.0.5
What to do
Update Easy Digital Downloads to 3.1.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Greenshift: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0378 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Greenshift
Fixed in
5.0
What to do
Update Greenshift to 5.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Easy Affiliate Links: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embeddedCVE-2023-0375 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Easy Affiliate Links
Fixed in
3.7.1
What to do
Update Easy Affiliate Links to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023ShopLentor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0231 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
ShopLentor
Fixed in
2.5.4
What to do
Update ShopLentor to 2.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.CVE-2022-41134 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.
Fixed in
1.0.16
What to do
Update the plugin to 1.0.16 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Feb 13, 2023Spotlight Social Feeds: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0379 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Spotlight Social Feeds
Fixed in
1.4.3
What to do
Update Spotlight Social Feeds to 1.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Lightweight Accordion: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0373 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Lightweight Accordion
Fixed in
1.5.15
What to do
Update Lightweight Accordion to 1.5.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Location Weather: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0360 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Location Weather
Fixed in
1.3.4
What to do
Update Location Weather to 1.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Contextual Related Posts: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0252 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Contextual Related Posts
Fixed in
3.3.1
What to do
Update Contextual Related Posts to 3.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Happyforms: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0096 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Happyforms
Fixed in
1.22.0
What to do
Update Happyforms to 1.22.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Page View Count: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0095 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Page View Count
Fixed in
2.6.1
What to do
Update Page View Count to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023ExactMetrics: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0082 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
ExactMetrics
Fixed in
7.12.1
What to do
Update ExactMetrics to 7.12.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.