Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,520 results · page 117 of 391
Apr 2, 2023Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored crosCVE-2023-28678 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control report file contents.
- Product
- Jenkins Cppcheck Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with OvCVE-2023-28672 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowing attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
- Product
- Jenkins OctoPerf Load Testing Plugin Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stoCVE-2023-28670 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.
- Product
- Jenkins Pipeline Aggregator View Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability eCVE-2023-28669 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action.
- Product
- Jenkins JaCoCo Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data.CVE-2023-28877 · Other software · Vtex · reported by MITREHigh 7.5
The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data. (apps-graphql@3.x is unaffected by this issue.)
- Product
- Apps-graphql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevelopers.vtex.comdevelopers.vtex.com
Mar 30, 2023PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does CVE-2022-30351 · Other software · Pdfzorro · reported by MITREHigh 7.5
PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does not properly sanitize this information in all cases, causing redacted information, including images and text embedded in the PDF file, to be leaked unintentionally. In cases where PDF text objects are present it is possible to copy-paste redacted information into the system clipboard. Once a document is "locked" and marked for redaction once, all redactions performed after this feature is triggered are vulnerable.
- Product
- Pdfzorro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Modern Events Calendar Lite: Does not sanitise and escape some of its settingsCVE-2023-1400 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 6.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Modern Events Calendar Lite
- Fixed in
- 6.5.2
- What to do
- Update Modern Events Calendar Lite to 6.5.2 or newer.
Mar 27, 2023OAuth Single Sign On: Does not have CSRF checksCVE-2023-1093 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
- Product
- OAuth Single Sign On
- Fixed in
- 6.24.2
- What to do
- Update OAuth Single Sign On to 6.24.2 or newer.
Mar 27, 2023Coupon Zen: Does not have CSRF checkCVE-2023-1089 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coupon Zen WordPress plugin before 1.0.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Coupon Zen
- Fixed in
- 1.0.6
- What to do
- Update Coupon Zen to 1.0.6 or newer.
Mar 27, 2023WP Plugin Manager: Does not have CSRF checkCVE-2023-1088 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Plugin Manager
- Fixed in
- 1.1.8
- What to do
- Update WP Plugin Manager to 1.1.8 or newer.
Mar 27, 2023WC Sales Notification: Does not have CSRF checkCVE-2023-1087 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WC Sales Notification WordPress plugin before 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WC Sales Notification
- Fixed in
- 1.2.3
- What to do
- Update WC Sales Notification to 1.2.3 or newer.
Mar 27, 2023Preview Link Generator: Does not have CSRF checkCVE-2023-1086 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Preview Link Generator WordPress plugin before 1.0.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Preview Link Generator
- Fixed in
- 1.0.4
- What to do
- Update Preview Link Generator to 1.0.4 or newer.
Mar 27, 2023Simple File List: Does not sanitise and escape some of its settingsCVE-2023-1025 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple File List WordPress plugin before 6.0.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple File List
- Fixed in
- 6.0.10
- What to do
- Update Simple File List to 6.0.10 or newer.
Mar 27, 2023WP Statistics: Does not escape a parameterCVE-2023-0955 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
- Product
- WP Statistics
- Fixed in
- 14.0
- What to do
- Update WP Statistics to 14.0 or newer.
Mar 27, 2023Cookie Notice & Compliance for GDPR / CCPA: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0823 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Cookie Notice & Compliance for GDPR / CCPA
- Fixed in
- 2.4.7
- What to do
- Update Cookie Notice & Compliance for GDPR / CCPA to 2.4.7 or newer.
Mar 27, 2023Smart Slider 3: Does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0660 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Smart Slider 3
- Fixed in
- 3.5.1.14
- What to do
- Update Smart Slider 3 to 3.5.1.14 or newer.
Mar 27, 2023WP Image Carousel: Does not sanitise and escape some parametersCVE-2023-0589 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- WP Image Carousel
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WP Image Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023Ever Compare: Does not have CSRF checkCVE-2023-0505 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Ever Compare
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Ever Compare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023HT Politic: Does not have CSRF checkCVE-2023-0504 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Politic
- Fixed in
- 2.3.8
- What to do
- Update HT Politic to 2.3.8 or newer.
Mar 27, 2023Free WooCommerce Theme 99fy Extension: Does not have CSRF checkCVE-2023-0503 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Free WooCommerce Theme 99fy Extension
- Fixed in
- 1.2.8
- What to do
- Update Free WooCommerce Theme 99fy Extension to 1.2.8 or newer.
Mar 27, 2023WP News: Does not have CSRF checkCVE-2023-0502 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP News WordPress plugin through 1.1.9 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP News
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update WP News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023WP Insurance: Does not have CSRF checkCVE-2023-0501 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Insurance WordPress plugin before 2.1.4 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Insurance
- Fixed in
- 2.1.4
- What to do
- Update WP Insurance to 2.1.4 or newer.
Mar 27, 2023WP Film Studio: Does not have CSRF checkCVE-2023-0500 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Film Studio WordPress plugin before 1.3.5 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Film Studio
- Fixed in
- 1.3.5
- What to do
- Update WP Film Studio to 1.3.5 or newer.
Mar 27, 2023QuickSwish: Does not have CSRF checkCVE-2023-0499 · WordPress plugins & themes · reported by WPScanMedium 4.3
The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- QuickSwish
- Fixed in
- 1.1.0
- What to do
- Update QuickSwish to 1.1.0 or newer.
Mar 27, 2023WP Education: Does not have CSRF checkCVE-2023-0498 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Education
- Fixed in
- 1.2.7
- What to do
- Update WP Education to 1.2.7 or newer.
Mar 27, 2023HT Portfolio: Does not have CSRF checkCVE-2023-0497 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Portfolio
- Fixed in
- 1.1.6
- What to do
- Update HT Portfolio to 1.1.6 or newer.
Mar 27, 2023HT Event: Does not have CSRF checkCVE-2023-0496 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Event
- Fixed in
- 1.4.6
- What to do
- Update HT Event to 1.4.6 or newer.
Mar 27, 2023HT Slider For Elementor: Does not have CSRF checkCVE-2023-0495 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Slider For Elementor
- Fixed in
- 1.4.0
- What to do
- Update HT Slider For Elementor to 1.4.0 or newer.
Mar 27, 2023Schedulicity: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0491 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Schedulicity
- Affected
- up to 2.21
- What to do
- Affects up to 2.21. Update Schedulicity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks: Does not have CSRF checkCVE-2023-0484 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Fixed in
- 1.1.6
- What to do
- Update Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks to 1.1.6 or newer.
Mar 27, 2023WP Dark Mode: Does not properly sanitize the style parameter in shortcodes before using it to load a PHP templateCVE-2023-0467 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.
- Product
- WP Dark Mode
- Fixed in
- 4.0.8
- What to do
- Update WP Dark Mode to 4.0.8 or newer.
Mar 27, 2023menu shortcode: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0395 · WordPress plugins & themes · reported by WPScanMedium 5.4
The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- menu shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update menu shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023NEX-Forms: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0272 · WordPress plugins & themes · reported by WPScanMedium 5.4
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- NEX-Forms
- Fixed in
- 8.3.3
- What to do
- Update NEX-Forms to 8.3.3 or newer.
Mar 27, 2023HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type.CVE-2023-25909 · Other software · HGIGA INC. · reported by twcert@cert.org.twCritical 9.8
HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service.
- Product
- HGiga OAKlouds
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 22, 2023Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2023-28685 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 7.1
Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins AbsInt a³ Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2023ProfileGrid: Provides an AJAX endpoint for resetting a user password but does not implement proper authorizationCVE-2023-0940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
- Product
- ProfileGrid
- Fixed in
- 5.3.1
- What to do
- Update ProfileGrid to 5.3.1 or newer.
Mar 20, 2023VK All in One Expansion Unit: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2023-0937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- VK All in One Expansion Unit
- Fixed in
- 9.87.1.0
- What to do
- Update VK All in One Expansion Unit to 9.87.1.0 or newer.
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not validate the user meta to be retrieved via the user shortcodeCVE-2023-0911 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
- Product
- WordPress Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 5.12.8
- What to do
- Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the requestCVE-2023-0890 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
- Product
- WordPress Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 5.12.8
- What to do
- Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Mar 20, 2023WP Meta SEO: Does not authorize several ajax actionsCVE-2023-0876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability.
- Product
- WP Meta SEO
- Fixed in
- 4.5.3
- What to do
- Update WP Meta SEO to 4.5.3 or newer.
Mar 20, 2023WP Meta SEO: Does not properly sanitize and escape inputs into SQL queriesCVE-2023-0875 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.
- Product
- WP Meta SEO
- Fixed in
- 4.5.3
- What to do
- Update WP Meta SEO to 4.5.3 or newer.
Mar 20, 2023WooCommerce Multiple Customer Addresses & Shipping: Does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the requestCVE-2023-0865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.
- Product
- WooCommerce Multiple Customer Addresses & Shipping
- Fixed in
- 21.7
- What to do
- Update WooCommerce Multiple Customer Addresses & Shipping to 21.7 or newer.
Mar 20, 2023Paid Memberships Pro: Does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL queryCVE-2023-0631 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
- Product
- Paid Memberships Pro
- Fixed in
- 2.9.12
- What to do
- Update Paid Memberships Pro to 2.9.12 or newer.
Mar 20, 2023Slimstat Analytics: Does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL queryCVE-2023-0630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.
- Product
- Slimstat Analytics
- Fixed in
- 4.9.3.3
- What to do
- Update Slimstat Analytics to 4.9.3.3 or newer.
Mar 20, 2023WPB Advanced FAQ: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0370 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WPB Advanced FAQ
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WPB Advanced FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023GoToWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0369 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GoToWP
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update GoToWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023React Webcam: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0365 · WordPress plugins & themes · reported by WPScanMedium 5.4
The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- React Webcam
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update React Webcam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023real.Kit: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- real.Kit
- Fixed in
- 5.1.1
- What to do
- Update real.Kit to 5.1.1 or newer.
Mar 20, 2023Custom Content Shortcode: Does not validate one of its shortcode attributeCVE-2023-0340 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
- Product
- Custom Content Shortcode
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023Custom Content Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Custom Content Shortcode
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.