Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

531new WordPress flaws this week

391,883entries in the database

4,962 results · page 91 of 100

Aug 15, 2023User Submitted Posts: Stored Cross-Site ScriptingCVE-2023-4308 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
User Submitted Posts
Affected
up to 20230809
What to do
Affects up to 20230809. Update User Submitted Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 10, 2023Sk: Auth. (editor+) Stored Cross-Site Scripting (XSS)CVE-2023-24393 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Animated Number Counters plugin <= 1.6 versions.
Product
Sk
Affected
up to 1.6
What to do
Affects up to 1.6. Update Sk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 10, 2023EmbedPress: Stored Cross-Site ScriptingCVE-2023-4283 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
EmbedPress
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 10, 2023brandiD Social Proof: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-24389 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in brandiD Social Proof (Testimonial) Slider plugin <= 2.2.3 versions.
Product
brandiD Social Proof
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update brandiD Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 18, 2023Repute InfoSystems ARMember: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-47421 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.
Product
Repute InfoSystems ARMember
What to do
Update Repute InfoSystems ARMember to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 18, 2023YARPP: Stored Cross-Site ScriptingCVE-2023-2433 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
YARPP
Affected
up to 5.30.3
What to do
Affects up to 5.30.3. Update YARPP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023About Me 3000 widget: Stored Cross-Site ScriptingCVE-2023-3369 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The About Me 3000 widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
About Me 3000 widget
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update About Me 3000 widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3202 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MStore API
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3199 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_title function. This makes it possible for unauthenticated attackers to update status order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MStore API
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023WP Reroute Email: Stored Cross-Site ScriptingCVE-2023-3168 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Reroute Email
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update WP Reroute Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023Mail Queue: Stored Cross-Site ScriptingCVE-2023-3167 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mail Queue
Affected
up to 1.1
What to do
Affects up to 1.1. Update Mail Queue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023Lana Email Logger: Stored Cross-Site ScriptingCVE-2023-3166 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Lana Email Logger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, Lana Email Logger due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lana Email Logger
Affected
up to Lana
What to do
Affects up to Lana. Update Lana Email Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023Mail Control: Stored Cross-Site ScriptingCVE-2023-3158 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mail Control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 0.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mail Control
Affected
up to 0.2.8
What to do
Affects up to 0.2.8. Update Mail Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023Mailtree Log Mail: Stored Cross-Site ScriptingCVE-2023-3135 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Mailtree Log Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Mailtree Log Mail
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Mailtree Log Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023GD Mail Queue: Stored Cross-Site ScriptingCVE-2023-3122 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
GD Mail Queue
Affected
up to 3.9.3
What to do
Affects up to 3.9.3. Update GD Mail Queue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023YaySMTP: Stored Cross-Site ScriptingCVE-2023-3093 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
YaySMTP
Affected
up to 2.4.5
What to do
Affects up to 2.4.5. Update YaySMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023SMTP Mail: Stored Cross-Site ScriptingCVE-2023-3092 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.3.46 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
SMTP Mail
Affected
up to 1.3.46
What to do
Affects up to 1.3.46. Update SMTP Mail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023WP Mail Log: Stored Cross-Site ScriptingCVE-2023-3088 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Mail Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Mail Log
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update WP Mail Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023FluentSMTP: Stored Cross-Site ScriptingCVE-2023-3087 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The FluentSMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
FluentSMTP
Affected
up to 2.2.4
What to do
Affects up to 2.2.4. Update FluentSMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023Post SMTP: Stored Cross-Site ScriptingCVE-2023-3082 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Post SMTP
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update Post SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 12, 2023WP Mail Logging: Stored Cross-Site ScriptingCVE-2023-3081 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1.11.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: An incomplete fix was released in 1.11.1.
Product
WP Mail Logging
Affected
up to 1.11.1
What to do
Affects up to 1.11.1. Update WP Mail Logging to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 12, 2023WP Mail Catcher: Stored Cross-Site ScriptingCVE-2023-3080 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Mail Catcher
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update WP Mail Catcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions.CVE-2023-35091 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in StoreApps Stock Manager for WooCommerce plugin <= 2.10.0 versions.
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3209 · WordPress plugins & themes · reported by WPScanLow 3.5
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Product
MStore API
Fixed in
3.9.7
What to do
Update MStore API to 3.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3131 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
Product
MStore API
Fixed in
3.9.7
What to do
Update MStore API to 3.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023MStore API: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-3077 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
Product
MStore API
Fixed in
3.9.8
What to do
Update MStore API to 3.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023MStore API: Does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpointCVE-2023-3076 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
Product
MStore API
Fixed in
3.9.9
What to do
Update MStore API to 3.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 28, 2023Short URL: Stored Cross-Site ScriptingCVE-2023-1602 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Short URL plugin for WordPress is vulnerable to stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Short URL
Affected
up to 1.6.4
What to do
Affects up to 1.6.4. Update Short URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 27, 2023Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite: Stored Cross-Site ScriptingCVE-2023-3412 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0. This is due to a missing capability check on the ajax_store_save() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify plugin settings and inject malicious web scripts.
Product
Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 26, 2023Eric Martin SimpleModal Contact Form: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-29438 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Martin SimpleModal Contact Form (SMCF) plugin <= 1.2.9 versions.
Product
Eric Martin SimpleModal Contact Form
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Eric Martin SimpleModal Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 26, 2023Steven A: Auth. (contributor+) Stored Cross-Site Scripting (XSS)CVE-2023-29437 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Steven A. Zahm Connections Business Directory plugin <= 10.4.36 versions.
Product
Steven A
Affected
up to 10.4.36
What to do
Affects up to 10.4.36. Update Steven A to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 23, 2023Beautiful Cookie Consent Banner: Stored Cross-Site ScriptingCVE-2023-3388 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A partial patch was made available in 2.10.1 and the issue was fully patched in 2.10.2.
Product
Beautiful Cookie Consent Banner
Affected
up to 2.10.1
What to do
Affects up to 2.10.1. Update Beautiful Cookie Consent Banner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 23, 2023Lana Text to Image: Stored Cross-Site ScriptingCVE-2023-3387 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Lana Text to Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lana_text_to_image' and 'lana_text_to_img' shortcode in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Lana Text to Image
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Lana Text to Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 23, 2023MStore API: Unauthenticated Blind SQL InjectionCVE-2023-3197 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
MStore API
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 22, 2023Grade Us, Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-28774 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Grade Us, Inc. Review Stream plugin <= 1.6.5 versions.
Product
Grade Us, Inc
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update Grade Us, Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2023The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple CVE-2019-25152 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in user input that will execute on the admin dashboard.
Affected
up to 5.1.3
What to do
Affects up to 5.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jun 20, 2023Vadym K: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-35878 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.
Product
Vadym K
Affected
up to 0.5
What to do
Affects up to 0.5. Update Vadym K to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 13, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3203 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function. This makes it possible for unauthenticated attackers to update limit the number of product per category to use cache data in home screen via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MStore API
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3201 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MStore API
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3200 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_message function. This makes it possible for unauthenticated attackers to update new order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MStore API
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2023MStore API: Cross-Site Request ForgeryCVE-2023-3198 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_status_order_message function. This makes it possible for unauthenticated attackers to update status order message via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
MStore API
Affected
up to 3.9.6
What to do
Affects up to 3.9.6. Update MStore API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2023Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting: Cross-Site Request Forgery (CSRF)CVE-2022-42880 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability in Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting (XSS).
Product
Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting
Fixed in
3.3.1
What to do
Update Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting to 3.3.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2023The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up toCVE-2023-2767 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected
up to 4.19.1
What to do
Affects up to 4.19.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023PixelYourSite: Stored Cross-Site ScriptingCVE-2023-2584 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
PixelYourSite
Affected
up to 9.3.6
What to do
Affects up to 9.3.6. Update PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023WPCS – WordPress Currency Switcher Professional: Stored Cross-Site ScriptingCVE-2023-2558 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_current_currency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Advanced Woo Search: Stored Cross-Site ScriptingCVE-2023-2452 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.77 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Advanced Woo Search
Affected
up to 2.77
What to do
Affects up to 2.77. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023FiboSearch - AJAX Search for WooCommerce: Stored Cross-Site ScriptingCVE-2023-2450 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.23.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
FiboSearch - AJAX Search for WooCommerce
Affected
up to 1.23.0
What to do
Affects up to 1.23.0. Update FiboSearch - AJAX Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Download Manager: Stored Cross-Site ScriptingCVE-2023-2305 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Manager
Affected
up to 3.2.70
What to do
Affects up to 3.2.70. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Locatoraid Store Locator: Stored Cross-Site ScriptingCVE-2023-2031 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Locatoraid Store Locator
Affected
up to 3.9.14
What to do
Affects up to 3.9.14. Update Locatoraid Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023PowerPress: Stored Cross-Site ScriptingCVE-2023-1917 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: A partial fix for the issue was introduced in version 10.0.1, and an additional patch (version 10.0.2) was released to address a workaround.
Product
PowerPress
Affected
up to 10.0
What to do
Affects up to 10.0. Update PowerPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.