Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7 results
Jul 4, 2023ND Shortcodes: Does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4623 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- ND Shortcodes
- Fixed in
- 7.0
- What to do
- Update ND Shortcodes to 7.0 or newer.
Jun 19, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-2811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks to all admin when setting chatbot and all client when using chatbot
- Product
- AI ChatBot
- Fixed in
- 4.5.6
- What to do
- Update AI ChatBot to 4.5.6 or newer.
May 8, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-1649 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- AI ChatBot
- Fixed in
- 4.5.1
- What to do
- Update AI ChatBot to 4.5.1 or newer.
Apr 3, 2023Solidres: Does not sanitise and escape numerous parameter before outputting them back in pagesCVE-2023-1377 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape numerous parameter before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Solidres
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2022Advanced Database Cleaner: Does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced Database Cleaner
- Fixed in
- 3.1.1
- What to do
- Update Advanced Database Cleaner to 3.1.1 or newer.
May 2, 2022Multiple Shipping Address Woocommerce: Does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated usersCVE-2022-0783 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
- Product
- Multiple Shipping Address Woocommerce
- Fixed in
- 2.0
- What to do
- Update Multiple Shipping Address Woocommerce to 2.0 or newer.
Feb 21, 2022Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised.CVE-2021-24867 · WordPress plugins & themes · reported by WPScanCritical 9.8
Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion
- What to do
- Update the plugin to the newest version.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.