Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

481 results · page 9 of 10

Feb 13, 2023Amazon JS: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0075 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Amazon JS
Affected
up to 0.10
What to do
Affects up to 0.10. Update Amazon JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Judge.me Product Reviews for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0061 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Judge.me Product Reviews for WooCommerce
Fixed in
1.3.21
What to do
Update Judge.me Product Reviews for WooCommerce to 1.3.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Responsive Gallery Grid: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Gallery Grid WordPress plugin before 2.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive Gallery Grid
Fixed in
2.3.9
What to do
Update Responsive Gallery Grid to 2.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023JetWidgets For Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0034 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JetWidgets For Elementor WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
JetWidgets For Elementor
Fixed in
1.0.14
What to do
Update JetWidgets For Elementor to 1.0.14 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Youtube Channel Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4783 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Youtube Channel Gallery
Affected
up to 2.4
What to do
Affects up to 2.4. Update Youtube Channel Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023GigPress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4759 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
GigPress
Fixed in
2.3.28
What to do
Update GigPress to 2.3.28 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Lightbox Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4682 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Lightbox Gallery
Fixed in
0.9.5
What to do
Update Lightbox Gallery to 0.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023TemplatesNext ToolKit: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
TemplatesNext ToolKit
Fixed in
3.2.8
What to do
Update TemplatesNext ToolKit to 3.2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Easy PayPal Buy Now Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4628 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Easy PayPal Buy Now Button
Fixed in
1.7.4
What to do
Update Easy PayPal Buy Now Button to 1.7.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Twenty20 Image Before-After: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4580 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Twenty20 Image Before-After
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Twenty20 Image Before-After to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Rich Table of Contents: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4551 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rich Table of Contents WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Rich Table of Contents
Fixed in
1.3.9
What to do
Update Rich Table of Contents to 1.3.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Better Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4512 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Better Font Awesome
Fixed in
2.0.4
What to do
Update Better Font Awesome to 2.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023YARPP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4471 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
YARPP
Fixed in
5.30.3
What to do
Update YARPP to 5.30.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023GiveWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4448 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
GiveWP
Fixed in
2.24.0
What to do
Update GiveWP to 2.24.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Contextual Related Posts: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0252 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Contextual Related Posts
Fixed in
3.3.1
What to do
Update Contextual Related Posts to 3.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Annual Archive: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0178 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Annual Archive
Fixed in
1.6.0
What to do
Update Annual Archive to 1.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Giveaways and Contests by RafflePress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0176 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Giveaways and Contests by RafflePress
Fixed in
1.11.3
What to do
Update Giveaways and Contests by RafflePress to 1.11.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023WP VR: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0174 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WP VR
Fixed in
8.2.7
What to do
Update WP VR to 8.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Drag & Drop Sales Funnel Builder for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0173 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Drag & Drop Sales Funnel Builder for
Fixed in
2.6.9
What to do
Update Drag & Drop Sales Funnel Builder for to 2.6.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023jQuery T(-) Countdown Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0171 · WordPress plugins & themes · reported by WPScanMedium 5.4
The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
jQuery T(-) Countdown Widget
Fixed in
2.3.24
What to do
Update jQuery T(-) Countdown Widget to 2.3.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Html5 Audio Player: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0170 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Html5 Audio Player
Fixed in
2.1.12
What to do
Update Html5 Audio Player to 2.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023GamiPress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0154 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
GamiPress
Fixed in
1.0.9
What to do
Update GamiPress to 1.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Vimeo Video Autoplay Automute: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0153 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Vimeo Video Autoplay Automute
Affected
up to 1.0
What to do
Affects up to 1.0. Update Vimeo Video Autoplay Automute to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Cloak Front End Email: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Cloak Front End Email
Fixed in
1.9.2
What to do
Update Cloak Front End Email to 1.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023WordPrezi: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0149 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WordPrezi
Fixed in
0.9
What to do
Update WordPrezi to 0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Gallery Factory Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Gallery Factory Lite
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update Gallery Factory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Flexible Captcha: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0147 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Flexible Captcha
Affected
up to 4.1
What to do
Affects up to 4.1. Update Flexible Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Naver Map: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0146 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Naver Map
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Naver Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Happyforms: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0096 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Happyforms
Fixed in
1.22.0
What to do
Update Happyforms to 1.22.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Page View Count: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0095 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Page View Count
Fixed in
2.6.1
What to do
Update Page View Count to 2.6.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023ExactMetrics: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0082 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
ExactMetrics
Fixed in
7.12.1
What to do
Update ExactMetrics to 7.12.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023MonsterInsights: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0081 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
MonsterInsights
Fixed in
8.12.1
What to do
Update MonsterInsights to 8.12.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023WC Vendors Marketplace: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0072 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WC Vendors Marketplace
Fixed in
2.4.5
What to do
Update WC Vendors Marketplace to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023ResponsiveVoice Text To Speech: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0070 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
ResponsiveVoice Text To Speech
Fixed in
1.7.7
What to do
Update ResponsiveVoice Text To Speech to 1.7.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023EAN for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0062 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
EAN for WooCommerce
Fixed in
4.4.3
What to do
Update EAN for WooCommerce to 4.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Simple Tooltips: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Simple Tooltips
Fixed in
2.1.4
What to do
Update Simple Tooltips to 2.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023PDF.js Viewer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
PDF.js Viewer
Fixed in
2.1.8
What to do
Update PDF.js Viewer to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4664 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Logo Slider
Fixed in
3.6.0
What to do
Update Logo Slider to 3.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Restaurant Menu: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4657 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Restaurant Menu
Fixed in
2.3.6
What to do
Update Restaurant Menu to 2.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023Post Grid, Post Carousel, & List Category Posts: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0097 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Post Carousel, & List Category Posts WordPress plugin before 2.4.19 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Post Grid, Post Carousel, & List Category Posts
Fixed in
2.4.19
What to do
Update Post Grid, Post Carousel, & List Category Posts to 2.4.19 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023WP Social Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0074 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Social Widget WordPress plugin before 2.2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WP Social Widget
Fixed in
2.2.4
What to do
Update WP Social Widget to 2.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023WP Tabs: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0071 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Tabs WordPress plugin before 2.1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WP Tabs
Fixed in
2.1.17
What to do
Update WP Tabs to 2.1.17 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 10, 2022Cryptocurrency Pricing list and Ticker: Does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embedCVE-2021-25044 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue
Product
Cryptocurrency Pricing list and Ticker
Affected
up to 1.5
What to do
Affects up to 1.5. Update Cryptocurrency Pricing list and Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022CP Image Store with Slideshow: Does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embedCVE-2022-1692 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack
Product
CP Image Store with Slideshow
Fixed in
1.0.68
What to do
Update CP Image Store with Slideshow to 1.0.68 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
May 16, 2022Gmedia Photo Gallery: Does not sanitise and escape the Album's name before outputting it in pages/posts with a media embedCVE-2022-0873 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed
Product
Gmedia Photo Gallery
Fixed in
1.20.0
What to do
Update Gmedia Photo Gallery to 1.20.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embedCVE-2021-24878 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 4, 2022Embed Swagger: Reflected Cross-Site ScriptingCVE-2022-0381 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.
Product
Embed Swagger
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Embed Swagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Feb 1, 2022Document Embedder: Contains a AJAX action endpointCVE-2021-24868 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts.
Product
Document Embedder
Fixed in
1.7.9
What to do
Update Document Embedder to 1.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Document Embedder: Contains a REST endpointCVE-2021-24775 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to enumerate the title of arbitrary private and draft posts.
Product
Document Embedder
Fixed in
1.7.5
What to do
Update Document Embedder to 1.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Availability Calendar: Does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embedCVE-2021-24604 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Availability Calendar WordPress plugin before 1.2.2 does not sanitise or escape its Category Names before outputting them in page/post where the associated shortcode is embed, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
Availability Calendar
Fixed in
1.2.2
What to do
Update Availability Calendar to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.