Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,523 results · page 124 of 391
Jan 23, 2023Page-list: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4485 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Page-list
- Fixed in
- 5.3
- What to do
- Update Page-list to 5.3 or newer.
Jan 23, 2023Collapse-O-Matic: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4475 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Collapse-O-Matic
- Fixed in
- 1.8.3
- What to do
- Update Collapse-O-Matic to 1.8.3 or newer.
Jan 23, 2023Easy Social Feed: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4474 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Easy Social Feed
- Fixed in
- 6.4.0
- What to do
- Update Easy Social Feed to 6.4.0 or newer.
Jan 23, 2023Search & Filter: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4467 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Search & Filter
- Fixed in
- 1.2.16
- What to do
- Update Search & Filter to 1.2.16 or newer.
Jan 23, 2023BruteBank: Does not have CSRF check in placeCVE-2022-4443 · WordPress plugins & themes · reported by WPScanMedium 6.5
The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- BruteBank
- Fixed in
- 1.9
- What to do
- Update BruteBank to 1.9 or newer.
Jan 23, 2023CBX Petition for: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4383 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- CBX Petition for
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update CBX Petition for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023پلاگین پرداخت دلخواه: Does not sanitise and escape some parametersCVE-2022-4307 · WordPress plugins & themes · reported by WPScanMedium 6.1
The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users such as admin visits a page from the plugin.
- Product
- پلاگین پرداخت دلخواه
- Fixed in
- 2.9.3
- What to do
- Update پلاگین پرداخت دلخواه to 2.9.3 or newer.
Jan 23, 2023WP Statistics: Does not escape a parameterCVE-2022-4230 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options capability (admin+), however the plugin has a settings to allow low privilege users to access it as well.
- Product
- WP Statistics
- Fixed in
- 13.2.9
- What to do
- Update WP Statistics to 13.2.9 or newer.
Jan 23, 2023EU Cookie Law for GDPR/CCPA: Does not sanitise and escape some of its settingsCVE-2022-3811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- EU Cookie Law for GDPR/CCPA
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update EU Cookie Law for GDPR/CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2023Passster: Does not properly check for passwordCVE-2021-24881 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin, and access arbitrary posts (such as private) content, by sending a specifically crafted request.
- Product
- Passster
- Fixed in
- 3.5.5.9
- What to do
- Update Passster to 3.5.5.9 or newer.
Jan 23, 2023Passster: Does not escape the area parameter of its shortcodeCVE-2021-24837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Passster
- Fixed in
- 3.5.5.8
- What to do
- Update Passster to 3.5.5.8 or newer.
Jan 22, 2023Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php.CVE-2023-24058 · Other software · Twinkletoessoftware · reported by MITREMedium 4.3
Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler (Sep 6, 2022 Feature Release) is affected.
- Product
- Booked
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup sCVE-2022-47911 · Other software · Sewio · reported by ics-cert@hq.dhs.govCritical 9.1
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.
- Product
- RTLS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor CVE-2022-43483 · Other software · Sewio · reported by ics-cert@hq.dhs.govCritical 9.1
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.
- Product
- RTLS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during commCVE-2022-41989 · Other software · Sewio · reported by ics-cert@hq.dhs.govCritical 9
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during communication. This allows an attacker to send an exceedingly long payload, resulting in an out-of-bounds write to cause a denial-of-service condition or code execution.
- Product
- RTLS Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files.CVE-2022-2893 · Other software · RONDS · reported by ics-cert@hq.dhs.govHigh 8.2
RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files.
- Product
- Equipment Predictive Maintenance Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023RSSImport: Does not validate and escape one of its shortcode attributesCVE-2022-4658 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- RSSImport
- Affected
- up to 4.6.1
- What to do
- Affects up to 4.6.1. Update RSSImport to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Welcart e-Commerce: Does not validate and escapes one of its shortcode attributesCVE-2022-4655 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.9
- What to do
- Update Welcart e-Commerce to 2.8.9 or newer.
Jan 16, 2023Greenshift: Does not validate and escape one of its shortcode attributesCVE-2022-4653 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Greenshift
- Fixed in
- 4.8.9
- What to do
- Update Greenshift to 4.8.9 or newer.
Jan 16, 2023Real Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4648 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Real Testimonials
- Fixed in
- 2.6.0
- What to do
- Update Real Testimonials to 2.6.0 or newer.
Jan 16, 2023Video Conferencing with Zoom: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4578 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Video Conferencing with Zoom
- Fixed in
- 4.0.10
- What to do
- Update Video Conferencing with Zoom to 4.0.10 or newer.
Jan 16, 2023Seriously Simple Podcasting: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4571 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Seriously Simple Podcasting
- Fixed in
- 2.19.1
- What to do
- Update Seriously Simple Podcasting to 2.19.1 or newer.
Jan 16, 2023Tickera: Does not have CSRF check in placeCVE-2022-4549 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
- Product
- Tickera
- Fixed in
- 3.5.1.0
- What to do
- Update Tickera to 3.5.1.0 or newer.
Jan 16, 2023Conditional Payment Methods for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4547 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege users such as admin|users with a role as low as admin.
- Product
- Conditional Payment Methods for WooCommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Conditional Payment Methods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 16, 2023MashShare: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4544 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- MashShare
- Fixed in
- 3.8.7
- What to do
- Update MashShare to 3.8.7 or newer.
Jan 16, 2023ConvertKit: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4508 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- ConvertKit
- Fixed in
- 2.0.5
- What to do
- Update ConvertKit to 2.0.5 or newer.
Jan 16, 2023Real Cookie Banner: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4507 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Real Cookie Banner
- Fixed in
- 3.4.10
- What to do
- Update Real Cookie Banner to 3.4.10 or newer.
Jan 16, 2023Easy Accordion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4487 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Easy Accordion
- Fixed in
- 2.2.0
- What to do
- Update Easy Accordion to 2.2.0 or newer.
Jan 16, 2023Meteor Slides: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4486 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Meteor Slides
- Fixed in
- 1.5.7
- What to do
- Update Meteor Slides to 1.5.7 or newer.
Jan 16, 2023Social Share, Social Login and Social Comments: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4484 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.44
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.44 or newer.
Jan 16, 2023Insert Pages: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4483 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Insert Pages
- Fixed in
- 3.7.5
- What to do
- Update Insert Pages to 3.7.5 or newer.
Jan 16, 2023Carousel, Slider, Gallery by WP Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4482 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Carousel, Slider, Gallery by WP Carousel
- Fixed in
- 2.5.3
- What to do
- Update Carousel, Slider, Gallery by WP Carousel to 2.5.3 or newer.
Jan 16, 2023Mesmerize Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4481 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Mesmerize Companion
- Fixed in
- 1.6.135
- What to do
- Update Mesmerize Companion to 1.6.135 or newer.
Jan 16, 2023Click to Chat: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4480 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Click to Chat
- Fixed in
- 3.18.1
- What to do
- Update Click to Chat to 3.18.1 or newer.
Jan 16, 2023Font Awesome: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4478 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Font Awesome
- Fixed in
- 4.3.2
- What to do
- Update Font Awesome to 4.3.2 or newer.
Jan 16, 2023Smash Balloon Social Post Feed: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 4.1.6
- What to do
- Update Smash Balloon Social Post Feed to 4.1.6 or newer.
Jan 16, 2023Download Manager: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4476 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks against logged-in admins.
- Product
- Download Manager
- Fixed in
- 3.2.62
- What to do
- Update Download Manager to 3.2.62 or newer.
Jan 16, 2023Simple Membership: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4469 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- Simple Membership
- Fixed in
- 4.2.2
- What to do
- Update Simple Membership to 4.2.2 or newer.
Jan 16, 2023WP Video Lightbox: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4465 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- WP Video Lightbox
- Fixed in
- 1.9.7
- What to do
- Update WP Video Lightbox to 1.9.7 or newer.
Jan 16, 2023Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, whiCVE-2022-4464 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.
- Fixed in
- 1.2.1
- What to do
- Update the plugin to 1.2.1 or newer.
Jan 16, 2023Sidebar Widgets by CodeLights: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4460 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- Sidebar Widgets by CodeLights
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 20233D FlipBook: Does not validate or escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4453 · WordPress plugins & themes · reported by WPScanMedium 5.4
The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against high privilege users like administrators.
- Product
- 3D FlipBook
- Affected
- up to 1.13.2
- What to do
- Affects up to 1.13.2. Update 3D FlipBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4451 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Sharing
- Fixed in
- 3.3.45
- What to do
- Update Social Sharing to 3.3.45 or newer.
Jan 16, 2023Page scroll to id: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4449 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Page scroll to id
- Fixed in
- 1.7.6
- What to do
- Update Page scroll to id to 1.7.6 or newer.
Jan 16, 2023Fontsy: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4447 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Fontsy
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update Fontsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Custom Post Types and Custom Fields creator: Does not sanitize and escape some of its settingsCVE-2022-4442 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Custom Post Types and Custom Fields creator
- Fixed in
- 2.3.3
- What to do
- Update Custom Post Types and Custom Fields creator to 2.3.3 or newer.
Jan 16, 2023WOOCS: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4431 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WOOCS
- Fixed in
- 1.3.9.4
- What to do
- Update WOOCS to 1.3.9.4 or newer.
Jan 16, 2023WP Attachments: Does not sanitise and escape some of its settingsCVE-2022-4330 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Attachments
- Fixed in
- 5.0.6
- What to do
- Update WP Attachments to 5.0.6 or newer.
Jan 16, 2023WordPress Events Calendar: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin).
- Product
- WordPress Events Calendar
- Fixed in
- 1.4.5
- What to do
- Update WordPress Events Calendar to 1.4.5 or newer.
Jan 16, 2023Subscribe2: Does not have CSRF checkCVE-2022-4309 · WordPress plugins & themes · reported by WPScanLow 3.1
The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
- Product
- Subscribe2
- Fixed in
- 10.38
- What to do
- Update Subscribe2 to 10.38 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.