Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,767exploited flaws on CISA’s list

33added in the last 30 days

485new WordPress flaws this week

392,772entries in the database

6,287 results · page 122 of 126

Feb 28, 2023WP Meta SEO: Unauthorized sitemap generationCVE-2023-1027 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCategoryInSitemap function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to obtain post categories. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2023WP Meta SEO: Unauthorized access of dataCVE-2023-1026 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to get post listings by category as long as those posts are published. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2023WP Meta SEO: Unauthorized sitemap generationCVE-2023-1024 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSitemaps function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to generate sitemaps. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2023WP Meta SEO: Unauthorized plugin settings updateCVE-2023-1023 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitemapSettings function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to change sitemap-related settings of the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2023WP Meta SEO: Unauthorized options updateCVE-2023-1022 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to update google analytics options maintained by the plugin. This vulnerability occurred as a result of the plugin relying on nonce checks as a means of access control, and that nonce being accessible to all authenticated users regardless of role.
Product
WP Meta SEO
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update WP Meta SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 27, 2023Correos Oficial: Does not have an authorization check user input validationCVE-2023-0331 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.
Product
Correos Oficial
Affected
up to 1.2.0.2
What to do
Affects up to 1.2.0.2. Update Correos Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2023Intuitive Custom Post Order: Does not check for authorization in the update-menu-order ajax actionCVE-2022-4385 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order
Product
Intuitive Custom Post Order
Fixed in
3.1.4
What to do
Update Intuitive Custom Post Order to 3.1.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Enable Media Replace: Does not prevent authors from uploading arbitrary files to the siteCVE-2023-0255 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
Product
Enable Media Replace
Fixed in
4.0.2
What to do
Update Enable Media Replace to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0720 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0717 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_delete_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0716 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_edit_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0715 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_clone_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0711 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_state function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the view state of the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0684 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_unassign_folders function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as changing the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0718 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0719 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_save_sort_order function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0712 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_move_object function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Wicked Folders: Authorization bypassCVE-2023-0713 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Wicked Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the ajax_add_folder function in versions up to, and including, 2.18.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke this function and perform actions intended for administrators such as modifying the folder structure maintained by the plugin.
Product
Wicked Folders
Affected
up to 2.18.16
What to do
Affects up to 2.18.16. Update Wicked Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 1, 2023Kraken.io Image Optimizer: Authorization bypassCVE-2023-0619 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Kraken.io Image Optimizer plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset image optimizations.
Product
Kraken.io Image Optimizer
Affected
up to 2.6.8
What to do
Affects up to 2.6.8. Update Kraken.io Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 30, 2023Chained Products: Does not have authorisation and CSRF checksCVE-2022-4872 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belong to the plugin, allowing unauthenticated attackers to set arbitrary options to 'no'
Product
Chained Products
Fixed in
2.12.0
What to do
Update Chained Products to 2.12.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 27, 2023ContentStudio: Authorization bypassCVE-2023-0558 · WordPress plugins & themes · reported by WordfenceHigh 8.2
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys.
Product
ContentStudio
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 27, 2023ContentStudio: Authorization bypassCVE-2023-0556 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.
Product
ContentStudio
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update ContentStudio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 27, 2023Quick Restaurant Menu: Authorization bypassCVE-2023-0555 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those actions intended for administrator use. Actions include menu item creation, update and deletion and other menu management functions. Since the plugin does not verify that a post ID passed to one of its AJAX actions belongs to a menu item, this can lead to arbitrary post deletion/alteration.
Product
Quick Restaurant Menu
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Quick Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2023My YouTube Channel: Authorization bypassCVE-2023-0447 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The My YouTube Channel plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the clear_all_cache function in versions up to, and including, 3.0.12.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to clear the plugin's cache.
Product
My YouTube Channel
Affected
up to 3.0.12.1
What to do
Affects up to 3.0.12.1. Update My YouTube Channel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2023Login as User or Customer: Lacks authorization checks to ensure that users are allowed to log inCVE-2022-4305 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
Product
Login as User or Customer
Fixed in
3.3
What to do
Update Login as User or Customer to 3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 19, 2023Events Made Easy: Authorization bypassCVE-2023-0404 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those functions intended for administrator use. While the plugin is still pending review from the WordPress repository, site owners can download a copy of the patched version directly from the developer's Github at https://github.com/liedekef/events-made-easy
Product
Events Made Easy
Affected
up to 2.3.16
What to do
Affects up to 2.3.16. Update Events Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 19, 2023Social Warfare: Authorization bypassCVE-2023-0402 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete post meta information and reset network access tokens.
Product
Social Warfare
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update Social Warfare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 13, 2023Mediamatic – Media Library Folders: Authorization bypassCVE-2023-0293 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change image categories, which it uses to arrange them in folder views.
Product
Mediamatic – Media Library Folders
Affected
up to 2.8.1
What to do
Affects up to 2.8.1. Update Mediamatic – Media Library Folders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 9, 2023Royal Elementor Addons: Does not have authorisation and CSRF checksCVE-2022-4103 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title
Product
Royal Elementor Addons
Fixed in
1.3.56
What to do
Update Royal Elementor Addons to 1.3.56 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 9, 2023Royal Elementor Addons: Does not have authorization and CSRF checksCVE-2022-4102 · WordPress plugins & themes · reported by WPScanLow 3.1
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.
Product
Royal Elementor Addons
Fixed in
1.3.56
What to do
Update Royal Elementor Addons to 1.3.56 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 9, 2023ActiveCampaign for WooCommerce: Does not have authorisation checkCVE-2022-3923 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs.
Product
ActiveCampaign for WooCommerce
Fixed in
1.9.8
What to do
Update ActiveCampaign for WooCommerce to 1.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023Wholesale Market: Does not have authorisation checkCVE-2022-4298 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
Product
Wholesale Market
Fixed in
2.2.1
What to do
Update Wholesale Market to 2.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 2, 2023iubenda: Does does not have authorisation and CSRF in an AJAX actionCVE-2022-3911 · WordPress plugins & themes · reported by WPScanHigh 8.8
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc
Product
iubenda
Fixed in
3.3.3
What to do
Update iubenda to 3.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various functions used to update the plugin settingsCVE-2022-3805 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
Product
Jeg Elementor Kit
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various AJAX actionsCVE-2022-3794 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.
Product
Jeg Elementor Kit
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 19, 2022Popup Manager: Does not have authorisation and CSRF checkCVE-2022-4125 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well
Product
Popup Manager
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Popup Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Popup Manager: Does not have authorisation and CSRF checksCVE-2022-4124 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them
Product
Popup Manager
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update Popup Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022SMSA Shipping for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-4107 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server
Product
SMSA Shipping for WooCommerce
Fixed in
1.0.5
What to do
Update SMSA Shipping for WooCommerce to 1.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Wholesale Market for WooCommerce: Does not have authorisation checkCVE-2022-4106 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
Product
Wholesale Market for WooCommerce
Fixed in
1.0.7
What to do
Update Wholesale Market for WooCommerce to 1.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Registration Forms: Does not have authorisation and CSRFCVE-2022-4024 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)
Product
Registration Forms
Fixed in
3.8.1.3
What to do
Update Registration Forms to 3.8.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 16, 2022WP Shamsi: Authorization bypassCVE-2022-4555 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.
Product
WP Shamsi
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update WP Shamsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 15, 2022Transposh WordPress Translation: Unauthorized setting changes by unauthenticated usersCVE-2022-2536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."
Product
Transposh WordPress Translation
Affected
up to 1.0.9.6
What to do
Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Dec 14, 2022Mega Addons: Authorization bypassCVE-2022-4501 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's settings.
Product
Mega Addons
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update Mega Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 12, 2022DPD Baltic Shipping: Does not have authorisation and CSRF in an AJAX actionCVE-2022-3999 · WordPress plugins & themes · reported by WPScanHigh 8.1
The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.
Product
DPD Baltic Shipping
Fixed in
1.2.57
What to do
Update DPD Baltic Shipping to 1.2.57 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Welcart e-Commerce: Does not have authorisation and CSRF in an AJAX actionCVE-2022-3946 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.
Product
Welcart e-Commerce
Fixed in
2.8.4
What to do
Update Welcart e-Commerce to 2.8.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3883 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Product
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
Fixed in
7.24
What to do
Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 7.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3882 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Product
Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix
Fixed in
2.46
What to do
Update Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix to 2.46 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3881 · WordPress plugins & themes · reported by WPScanMedium 5.7
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Product
WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log
Fixed in
3.43
What to do
Update WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log to 3.43 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3880 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Product
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
Fixed in
4.20
What to do
Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to 4.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Car Dealer (Dealership) and Vehicle sales: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3879 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Product
Car Dealer (Dealership) and Vehicle sales
Fixed in
3.05
What to do
Update Car Dealer (Dealership) and Vehicle sales to 3.05 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.