Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,523 results · page 125 of 391
Jan 16, 2023Metricool: Does not sanitise and escape some of its settingsCVE-2022-4299 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Metricool
- Fixed in
- 1.18
- What to do
- Update Metricool to 1.18 or newer.
Jan 16, 2023Show All Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4295 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
- Product
- Show All Comments
- Fixed in
- 7.0.1
- What to do
- Update Show All Comments to 7.0.1 or newer.
Jan 16, 2023Link Library: Does not sanitise and escape some of its settingsCVE-2022-4199 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Link Library
- Fixed in
- 7.4.1
- What to do
- Update Link Library to 7.4.1 or newer.
Jan 16, 2023Images Optimize and Upload CF7: Does not validate the file to be deleted via an AJAX action available to unauthenticated usersCVE-2022-4101 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack.
- Product
- Images Optimize and Upload CF7
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Images Optimize and Upload CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023User Post Gallery: Does not limit what callback functions can be called by usersCVE-2022-4060 · WordPress plugins & themes · reported by WPScanCritical 9.8
The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run code on sites running it.
- Product
- User Post Gallery
- Affected
- up to 2.19
- What to do
- Affects up to 2.19. Update User Post Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023MonsterInsights: Does not sanitize or escape page titles in the top posts/pages sectionCVE-2022-3904 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
- Product
- MonsterInsights
- Fixed in
- 8.9.1
- What to do
- Update MonsterInsights to 8.9.1 or newer.
Jan 16, 2023WP Spell Check: Does not escape ignored wordsCVE-2022-2658 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Spell Check
- Fixed in
- 9.13
- What to do
- Update WP Spell Check to 9.13 or newer.
Jan 16, 2023Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticaCVE-2022-43717 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 9, 2023Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.CVE-2023-22899 · Other software · Zip4j Project · reported by MITREMedium 5.9
Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.
- Product
- Zip4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbreakingthe3ma.appbreakingthe3ma.app
Jan 9, 2023Jetpack CRM: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4497 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins
- Product
- Jetpack CRM
- Fixed in
- 5.5
- What to do
- Update Jetpack CRM to 5.5 or newer.
Jan 9, 2023WP-Table Reloaded: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4491 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admins.
- Product
- WP-Table Reloaded
- Affected
- up to 1.9.4
- What to do
- Affects up to 1.9.4. Update WP-Table Reloaded to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Table of Contents Plus: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4479 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Table of Contents Plus
- Fixed in
- 2212
- What to do
- Update Table of Contents Plus to 2212 or newer.
Jan 9, 2023WP Recipe Maker: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4468 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
- Product
- WP Recipe Maker
- Fixed in
- 8.6.1
- What to do
- Update WP Recipe Maker to 8.6.1 or newer.
Jan 9, 2023Mautic Integration for WooCommerce: Does not have proper CSRF checkCVE-2022-4426 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.
- Product
- Mautic Integration for WooCommerce
- Fixed in
- 1.0.3
- What to do
- Update Mautic Integration for WooCommerce to 1.0.3 or newer.
Jan 9, 2023iPages Flipbook For: Does not sanitise and escape some of its settingsCVE-2022-4394 · WordPress plugins & themes · reported by WPScanMedium 5.4
The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- iPages Flipbook For
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update iPages Flipbook For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023ImageLinks Interactive Image Builder for: Does not sanitise and escape some of its settingsCVE-2022-4393 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- ImageLinks Interactive Image Builder for
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update ImageLinks Interactive Image Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contriCVE-2022-4392 · WordPress plugins & themes · reported by WPScanMedium 5.4
The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- iPanorama 360 WordPress Virtual Tour Builder
- Affected
- up to 1.6.29
- What to do
- Affects up to 1.6.29. Update iPanorama 360 WordPress Virtual Tour Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Vision Interactive For: Does not sanitise and escape some of its settingsCVE-2022-4391 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Vision Interactive For
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update Vision Interactive For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Bg Bible References: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2022-4374 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- Bg Bible References
- Affected
- up to 3.8.14
- What to do
- Affects up to 3.8.14. Update Bg Bible References to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023WP CSV: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2022-4368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot have CSRF checks in place as well, leading to a Reflected Cross-Site Scripting.
- Product
- WP CSV
- Affected
- up to 1.8.0.0
- What to do
- Affects up to 1.8.0.0. Update WP CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023Post Status Notifier Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin.
- Product
- Post Status Notifier Lite
- Fixed in
- 1.10.1
- What to do
- Update Post Status Notifier Lite to 1.10.1 or newer.
Jan 9, 2023Slimstat Analytics: Does not sanitise and escape the URICVE-2022-4310 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logs
- Product
- Slimstat Analytics
- Fixed in
- 4.9.3
- What to do
- Update Slimstat Analytics to 4.9.3 or newer.
Jan 9, 2023Sunshine Photo Cart: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4301 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- Sunshine Photo Cart
- Fixed in
- 2.9.15
- What to do
- Update Sunshine Photo Cart to 2.9.15 or newer.
Jan 9, 2023Multi Step Form: Does not sanitise and escape some of its form fieldsCVE-2022-4196 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Multi Step Form
- Fixed in
- 1.7.8
- What to do
- Update Multi Step Form to 1.7.8 or newer.
Jan 9, 2023Royal Elementor Addons: Does not have authorisation and CSRF checksCVE-2022-4103 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title
- Product
- Royal Elementor Addons
- Fixed in
- 1.3.56
- What to do
- Update Royal Elementor Addons to 1.3.56 or newer.
Jan 9, 2023Royal Elementor Addons: Does not have authorization and CSRF checksCVE-2022-4102 · WordPress plugins & themes · reported by WPScanLow 3.1
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.
- Product
- Royal Elementor Addons
- Fixed in
- 1.3.56
- What to do
- Update Royal Elementor Addons to 1.3.56 or newer.
Jan 9, 2023ActiveCampaign for WooCommerce: Does not have authorisation checkCVE-2022-3923 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which could allow any authenticated users, such as subscriber to call it and remove error logs.
- Product
- ActiveCampaign for WooCommerce
- Fixed in
- 1.9.8
- What to do
- Update ActiveCampaign for WooCommerce to 1.9.8 or newer.
Jan 9, 2023404 to Start: Does not sanitise and escape some of its settingsCVE-2022-3855 · WordPress plugins & themes · reported by WPScanMedium 4.8
The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- 404 to Start
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update 404 to Start to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023WPtouch: Does not properly validate images to be uploadedCVE-2022-3416 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- WPtouch
- Fixed in
- 4.3.45
- What to do
- Update WPtouch to 4.3.45 or newer.
Jan 5, 2023IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated userCVE-2022-22371 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 221195.
- Product
- Sterling B2B Integrator Standard Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 2, 2023WP Cerber Security, Anti-spam & Malware Scan: Does not properly block access to the REST API users endpointCVE-2022-4417 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 9.3.3
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 9.3.3 or newer.
Jan 2, 2023Popup Maker: Does not validate and escape one of its shortcode attributesCVE-2022-4381 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Popup Maker
- Fixed in
- 1.16.9
- What to do
- Update Popup Maker to 1.16.9 or newer.
Jan 2, 2023Quote-O-Matic: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4373 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- Quote-O-Matic
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Quote-O-Matic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4371 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023multimedial images: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4370 · WordPress plugins & themes · reported by WPScanHigh 7.2
The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- multimedial images
- Affected
- up to 1.0b
- What to do
- Affects up to 1.0b. Update multimedial images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP-Lister Lite for Amazon: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4369 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin.
- Product
- WP-Lister Lite for Amazon
- Fixed in
- 2.4.4
- What to do
- Update WP-Lister Lite for Amazon to 2.4.4 or newer.
Jan 2, 2023Popup Maker: Does not validate and escape one of its shortcode attributesCVE-2022-4362 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Popup Maker
- Fixed in
- 1.16.9
- What to do
- Update Popup Maker to 1.16.9 or newer.
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4360 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4359 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4358 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4357 · WordPress plugins & themes · reported by WPScanCritical 9.8
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4356 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4355 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4351 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Product list Widget for Woocommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4329 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).
- Product
- Product list Widget for Woocommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Product list Widget for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Wholesale Market: Does not have authorisation checkCVE-2022-4298 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
- Product
- Wholesale Market
- Fixed in
- 2.2.1
- What to do
- Update Wholesale Market to 2.2.1 or newer.
Jan 2, 2023WP AutoComplete Search: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated usersCVE-2022-4297 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- WP AutoComplete Search
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP AutoComplete Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jan 2, 2023WP-Ban: Does not sanitise and escape some of its settingsCVE-2022-4260 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP-Ban
- Fixed in
- 1.69.1
- What to do
- Update WP-Ban to 1.69.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.