Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,328 results · page 13 of 27
Apr 29, 2024Smart Forms: Does not sanitise and escape some of its settingsCVE-2024-1905 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Smart Forms
- Fixed in
- 2.6.96
- What to do
- Update Smart Forms to 2.6.96 or newer.
Apr 29, 2024Easy Set Favicon: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-33645 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eftakhairul Islam & Sirajus Salayhin Easy Set Favicon allows Reflected XSS.This issue affects Easy Set Favicon: from n/a through 1.1.
- Product
- Easy Set Favicon
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Easy Set Favicon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 26, 2024Call Now Button: Does not sanitise and escape some of its settingsCVE-2024-2908 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Call Now Button
- Fixed in
- 1.4.7
- What to do
- Update Call Now Button to 1.4.7 or newer.
Apr 26, 2024WP Chat App: Does not sanitise and escape some of its settingsCVE-2024-2837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WP Chat App
- Fixed in
- 3.6.4
- What to do
- Update WP Chat App to 3.6.4 or newer.
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2603 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2439 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2024-2310 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Google Review Slider
- Fixed in
- 13.6
- What to do
- Update WP Google Review Slider to 13.6 or newer.
Apr 25, 2024WP Setup Wizard: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-25917 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodeRevolution WP Setup Wizard.This issue affects WP Setup Wizard: from n/a through 1.0.8.1.
- Product
- WP Setup Wizard
- Affected
- up to 1.0.8.1
- What to do
- Affects up to 1.0.8.1. Update WP Setup Wizard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 25, 2024AGCA: Does not sanitise and escape some of its settingsCVE-2024-2907 · WordPress plugins & themes · reported by WPScanMedium 6.8
The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AGCA
- Fixed in
- 7.2.2
- What to do
- Update AGCA to 7.2.2 or newer.
Apr 24, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-2972 · WordPress plugins & themes · reported by WPScanLow 3.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
- Fixed in
- 3.1.9
- What to do
- Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.1.9 or newer.
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2404 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers to perform Stored Cross-Site Scripting attacks.
- Product
- Better Comments
- Fixed in
- 1.5.6
- What to do
- Update Better Comments to 1.5.6 or newer.
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2402 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Better Comments
- Fixed in
- 1.5.6
- What to do
- Update Better Comments to 1.5.6 or newer.
Apr 17, 2024WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro: Does not sanitise and escape some of its settingsCVE-2024-2309 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro
- Fixed in
- 3.4.0
- What to do
- Update WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro to 3.4.0 or newer.
Apr 17, 2024Social Media Share Buttons & Social Sharing Icons: Does not sanitise and escape some of its settingsCVE-2024-2118 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Media Share Buttons & Social Sharing Icons
- Fixed in
- 2.8.9
- What to do
- Update Social Media Share Buttons & Social Sharing Icons to 2.8.9 or newer.
Apr 15, 2024Social Share, Social Login and Social Comments: Does not sanitise and escape some of its settingsCVE-2024-2836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.64
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.64 or newer.
Apr 15, 2024NPS computy: Does not sanitise and escape some of its settingsCVE-2024-1754 · WordPress plugins & themes · reported by WPScanMedium 4.7
The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- NPS computy
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update NPS computy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024Testimonial Slider: Does not sanitise and escape some of its settingsCVE-2024-1746 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Testimonial Slider
- Fixed in
- 2.3.8
- What to do
- Update Testimonial Slider to 2.3.8 or newer.
Apr 15, 2024Carousel Slider: Does not sanitise and escape some of its settingsCVE-2024-1712 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Carousel Slider
- Fixed in
- 2.2.7
- What to do
- Update Carousel Slider to 2.2.7 or newer.
Apr 15, 2024Top Bar: Does not sanitise and escape some of its settingsCVE-2024-1660 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Top Bar
- Fixed in
- 3.0.5
- What to do
- Update Top Bar to 3.0.5 or newer.
Apr 15, 2024Fancy Product Designer: Does not sanitise and escape some of its settingsCVE-2024-0902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fancy Product Designer
- Fixed in
- 6.1.81
- What to do
- Update Fancy Product Designer to 6.1.81 or newer.
Apr 9, 2024WP Reset – Most Advanced WordPress Reset Tool: Sensitive Information ExposureCVE-2023-6799 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible for unauthenticated attackers to extract sensitive data including site backups by brute-forcing the snapshot filenames. Please note that the vendor does not plan to do any further hardening on this functionality.
- Product
- WP Reset – Most Advanced WordPress Reset Tool
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WP Reset – Most Advanced WordPress Reset Tool to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2024Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-1664 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.11
- What to do
- Update Responsive Gallery Grid to 2.3.11 or newer.
Apr 8, 2024Font Farsi: Does not sanitise and escape some of its settingsCVE-2024-1752 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Font Farsi
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Font Farsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024SendPress Newsletters: Does not sanitise and escape some of its settingsCVE-2024-1589 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SendPress Newsletters
- Affected
- up to 1.23.11.6
- What to do
- Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024SendPress Newsletters: Does not sanitise and escape some of its settingsCVE-2024-1588 · WordPress plugins & themes · reported by WPScanMedium 6.8
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SendPress Newsletters
- Affected
- up to 1.23.11.6
- What to do
- Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 6, 2024Inline Related Posts: Does not sanitise and escape some of its settingsCVE-2024-2444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Inline Related Posts
- Fixed in
- 3.5.0
- What to do
- Update Inline Related Posts to 3.5.0 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perforCVE-2024-2278 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Mar 28, 2024Pz-LinkCard: Does not sanitise and escape some of its settingsCVE-2024-0673 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Pz-LinkCard
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2024Profile Box Shortcode And Widget: Does not sanitise and escape some of its settingsCVE-2024-1401 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Profile Box Shortcode And Widget
- Fixed in
- 1.2.1
- What to do
- Update Profile Box Shortcode And Widget to 1.2.1 or newer.
Mar 18, 2024Widget for Social Page Feeds: Does not sanitise and escape some of its settingsCVE-2024-0973 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Widget for Social Page Feeds
- Fixed in
- 6.4
- What to do
- Update Widget for Social Page Feeds to 6.4 or newer.
Mar 18, 2024Advanced Social Feeds Widget & Shortcode: Does not sanitise and escape some of its settingsCVE-2024-0951 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Social Feeds Widget & Shortcode
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Advanced Social Feeds Widget & Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2024Shariff Wrapper: Does not sanitise and escape some of its settingsCVE-2024-1106 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Shariff Wrapper
- Fixed in
- 4.6.10
- What to do
- Update Shariff Wrapper to 4.6.10 or newer.
Feb 27, 2024Persian Fonts: Does not sanitise and escape some of its settingsCVE-2023-7167 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Persian Fonts
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Persian Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2024Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2023-7115 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.1
- What to do
- Update Page Builder: Pagelayer to 1.8.1 or newer.
Feb 20, 2024Database Reset: Cross-Site Request ForgeryCVE-2024-1501 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Database Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.22. This is due to missing or incorrect nonce validation on the install_wpr() function. This makes it possible for unauthenticated attackers to install the WP Reset Plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Database Reset
- Affected
- up to 3.22
- What to do
- Affects up to 3.22. Update Database Reset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2024GigPress: Does not sanitise and escape some of its settingsCVE-2023-7233 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GigPress
- Affected
- up to 2.3.29
- What to do
- Affects up to 2.3.29. Update GigPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024Popup Box: Does not sanitise and escape some of its settingsCVE-2023-6591 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Popup Box
- Fixed in
- 20.9.0
- What to do
- Update Popup Box to 20.9.0 or newer.
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6082 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- chartjs
- Affected
- up to 2023.2
- What to do
- Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6081 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- chartjs
- Affected
- up to 2023.2
- What to do
- Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2024Restrict Usernames Emails Characters: Does not sanitise and escape some of its settingsCVE-2023-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Restrict Usernames Emails Characters
- Fixed in
- 3.1.4
- What to do
- Update Restrict Usernames Emails Characters to 3.1.4 or newer.
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5956 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Wp-Adv-Quiz
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Wp-Adv-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5943 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Wp-Adv-Quiz
- Fixed in
- 1.0.3
- What to do
- Update Wp-Adv-Quiz to 1.0.3 or newer.
Jan 22, 2024Product Enquiry for WooCommerce: Does not sanitise and escape some of its settingsCVE-2023-6626 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.1
- What to do
- Update Product Enquiry for WooCommerce to 3.1 or newer.
Jan 22, 2024WP Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6456 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Review Slider
- Fixed in
- 13.0
- What to do
- Update WP Review Slider to 13.0 or newer.
Jan 22, 2024SEOPress: Does not sanitise and escape some of its settingsCVE-2023-6290 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- SEOPress
- Fixed in
- 7.3
- What to do
- Update SEOPress to 7.3 or newer.
Jan 16, 2024Hubbub Lite (formerly Grow Social): Does not sanitise and escape some of its settingsCVE-2023-7154 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Hubbub Lite (formerly Grow Social)
- Fixed in
- 1.32.0
- What to do
- Update Hubbub Lite (formerly Grow Social) to 1.32.0 or newer.
Jan 16, 2024Ultimate Maps by Supsystic: Does not sanitise and escape some of its settingsCVE-2023-6732 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Ultimate Maps by Supsystic
- Fixed in
- 1.2.16
- What to do
- Update Ultimate Maps by Supsystic to 1.2.16 or newer.
Jan 16, 2024EventON: Does not sanitise and escape some of its settingsCVE-2023-6046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfiltered_html capability is disallowed.
- Product
- EventON
- Fixed in
- 2.2
- What to do
- Update EventON to 2.2 or newer.
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Does not sanitize and escape some of its settingsCVE-2023-6005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- EventON WordPress plugin before 4.5.5, EventON
- Fixed in
- 4.5.5
- What to do
- Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Jan 16, 2024IURNY by INDIGITALL: Does not sanitise and escape some of its settingsCVE-2023-3647 · WordPress plugins & themes · reported by WPScanMedium 4.8
The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- IURNY by INDIGITALL
- Fixed in
- 3.2.3
- What to do
- Update IURNY by INDIGITALL to 3.2.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.