Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
742 results · page 14 of 15
May 8, 2023Product Slider For WooCommerce Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0537 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Product Slider For WooCommerce Lite
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Product Slider For WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the page parameter before outputting it back in an attributeCVE-2023-1805 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Product Catalog Feed by PixelYourSite
- Fixed in
- 2.1.1
- What to do
- Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the edit parameter before outputting it back in an attributeCVE-2023-1804 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
- Product
- Product Catalog Feed by PixelYourSite
- Fixed in
- 2.1.1
- What to do
- Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
Apr 6, 2023Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.CVE-2022-46793 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <= 12.4.4 versions.
- Fixed in
- 12.4.5
- What to do
- Update the plugin to 12.4.5 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2023WP Education: Does not have CSRF checkCVE-2023-0498 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Education
- Fixed in
- 1.2.7
- What to do
- Update WP Education to 1.2.7 or newer.
Mar 27, 2023The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through CVE-2020-36666 · WordPress plugins & themes · reported by WPScanHigh 8.8
The directory-pro WordPress plugin before 1.9.5, final-user-wp-frontend-user-profiles WordPress plugin before 1.2.2, producer-retailer WordPress plugin through TODO, photographer-directory WordPress plugin before 1.0.9, real-estate-pro WordPress plugin before 1.7.1, institutions-directory WordPress plugin before 1.3.1, lawyer-directory WordPress plugin before 1.2.9, doctor-listing WordPress plugin before 1.3.6, Hotel Listing WordPress plugin before 1.3.7, fitness-trainer WordPress plugin before 1.4.1, wp-membership WordPress plugin before 1.5.7, sold by the same developer (e-plugins), do not implementing any security measures in some AJAX calls. For example in the file plugin.php, the function iv_directories_update_profile_setting() uses update_user_meta with any data provided by the ajax call, which can be used to give the logged in user admin capabilities. Since the plugins allow user registration via a custom form (even if the blog does not allow users to register) it makes any site using it vulnerable.
- Product
- directory-pro
- Fixed in
- 1.9.5
- What to do
- Update directory-pro to 1.9.5 or newer.
Full record and what to do →NVD recordcodecanyon.netwpscan.com
Mar 17, 2023eCommerce Product Catalog: Stored Cross-Site ScriptingCVE-2023-1470 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- eCommerce Product Catalog
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 13, 2023Widgets for WooCommerce Products on Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4661 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Widgets for WooCommerce Products on Elementor
- Fixed in
- 1.0.8
- What to do
- Update Widgets for WooCommerce Products on Elementor to 1.0.8 or newer.
Mar 6, 2023Product GTIN (EAN, UPC, ISBN) for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0068 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Product GTIN (EAN, UPC, ISBN) for WooCommerce
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Product GTIN (EAN, UPC, ISBN) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 1, 2023Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leadsCVE-2022-46797 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leads to plugin settings change.
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 21, 2023GS Products Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0492 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GS Products Slider for WooCommerce
- Fixed in
- 1.5.9
- What to do
- Update GS Products Slider for WooCommerce to 1.5.9 or newer.
Feb 21, 2023ShopLentor: Unserializes user input from cookies in order to track viewed products and user dataCVE-2023-0232 · WordPress plugins & themes · reported by WPScanCritical 9.8
The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which could lead to PHP Object Injection.
- Product
- ShopLentor
- Fixed in
- 2.5.4
- What to do
- Update ShopLentor to 2.5.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2023Product Slider and Carousel with Category for WooCommerce: Does not validate and escape one of its shortcode attributesCVE-2022-4791 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Product Slider and Carousel with Category for WooCommerce
- Fixed in
- 2.8
- What to do
- Update Product Slider and Carousel with Category for WooCommerce to 2.8 or newer.
Feb 13, 2023GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training: Does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary postsCVE-2023-0405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.
- Product
- GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training
- Fixed in
- 1.4.38
- What to do
- Update GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training to 1.4.38 or newer.
Feb 13, 2023Product Slider for WooCommerce by PickPlugins: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0166 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Product Slider for WooCommerce by PickPlugins
- Fixed in
- 1.13.42
- What to do
- Update Product Slider for WooCommerce by PickPlugins to 1.13.42 or newer.
Feb 13, 2023Judge.me Product Reviews for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0061 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Judge.me Product Reviews for WooCommerce
- Fixed in
- 1.3.21
- What to do
- Update Judge.me Product Reviews for WooCommerce to 1.3.21 or newer.
Jan 30, 2023Chained Products: Does not have authorisation and CSRF checksCVE-2022-4872 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belong to the plugin, allowing unauthenticated attackers to set arbitrary options to 'no'
- Product
- Chained Products
- Fixed in
- 2.12.0
- What to do
- Update Chained Products to 2.12.0 or newer.
Jan 23, 2023Product Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4629 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Product Slider for WooCommerce
- Fixed in
- 2.6.4
- What to do
- Update Product Slider for WooCommerce to 2.6.4 or newer.
Jan 2, 2023Product list Widget for Woocommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4329 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).
- Product
- Product list Widget for Woocommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Product list Widget for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2022External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product CVE-2022-43468 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product accepts untrusted external inputs to update certain internal variables. As a result, the number of views for an article may be manipulated through a crafted input.
- Affected
- up to 6.0.5
- What to do
- Affects up to 6.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 7, 2022Product Stock Manager: Does not have authorisation and proper CSRF checks in multiple AJAX actionsCVE-2022-3451 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options
- Product
- Product Stock Manager
- Fixed in
- 1.0.5
- What to do
- Update Product Stock Manager to 1.0.5 or newer.
Aug 22, 2022Product Slider for WooCommerce: Has flawed CSRF checks and lack authorisation in some of its AJAX actionsCVE-2022-2382 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options.
- Product
- Product Slider for WooCommerce
- Fixed in
- 2.5.7
- What to do
- Update Product Slider for WooCommerce to 2.5.7 or newer.
Jul 22, 2022Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugiCVE-2022-30998 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin <= 1.1 at WordPress.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 11, 2022WooCommerce - Product Importer: Does not sanitise and escape the imported data before outputting it back in the pageCVE-2022-1546 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WooCommerce - Product Importer
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update WooCommerce - Product Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Product Configurator for WooCommerce: Suffers from an arbitrary file deletion vulnerability via an AJAX actionCVE-2022-1953 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first
- Product
- Product Configurator for WooCommerce
- Fixed in
- 1.2.32
- What to do
- Update Product Configurator for WooCommerce to 1.2.32 or newer.
Jun 27, 2022Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenCVE-2022-1916 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting
- Product
- Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
- Fixed in
- 1.0.5
- What to do
- Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to 1.0.5 or newer.
Jun 8, 2022Five Minute Webshop: Does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin pageCVE-2022-1685 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
- Product
- Five Minute Webshop
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Apr 19, 2022Fancy Product Designer: Cross-Site Request ForgeryCVE-2021-4096 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.
- Product
- Fancy Product Designer
- Affected
- up to 4.7.5
- What to do
- Affects up to 4.7.5. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com
Apr 18, 2022Product Table for WooCommerce (wooproducttable): Does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1020 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument
- Product
- Product Table for WooCommerce (wooproducttable)
- Fixed in
- 3.1.2
- What to do
- Update Product Table for WooCommerce (wooproducttable) to 3.1.2 or newer.
Apr 11, 2022Portfolio Gallery, Product Catalog: Does not have authorisation and CSRF checks in various functions related to AJAX actionsCVE-2021-25090 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Portfolio Gallery, Product Catalog WordPress plugin before 2.1.0 does not have authorisation and CSRF checks in various functions related to AJAX actions, allowing any authenticated users, such as subscriber, to call them. Due to the lack of sanitisation and escaping, it could also allows attackers to perform Cross-Site Scripting attacks on pages where a Portfolio is embed
- Product
- Portfolio Gallery, Product Catalog
- Fixed in
- 2.1.0
- What to do
- Update Portfolio Gallery, Product Catalog to 2.1.0 or newer.
Mar 28, 2022Sync WooCommerce Product feed to Google Shopping: Uses the 'feed_id' POST parameterCVE-2021-25068 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard
- Product
- Sync WooCommerce Product feed to Google Shopping
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Sync WooCommerce Product feed to Google Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Advanced Product Labels for WooCommerce: Does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's responseCVE-2022-0399 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting
- Product
- Advanced Product Labels for WooCommerce
- Fixed in
- 1.2.3.7
- What to do
- Update Advanced Product Labels for WooCommerce to 1.2.3.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 7, 2022Product Feed PRO for WooCommerce: Does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user)CVE-2022-0426 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- Product
- Product Feed PRO for WooCommerce
- Fixed in
- 11.2.3
- What to do
- Update Product Feed PRO for WooCommerce to 11.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 28, 2022TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro: Do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpointCVE-2022-0412 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks
- Product
- TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro
- Fixed in
- 1.40.1
- What to do
- Update TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro to 1.40.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022WOOCS: Does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the respCVE-2022-0234 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
- Product
- WOOCS
- Fixed in
- 1.3.7.5
- What to do
- Update WOOCS to 1.3.7.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022ExportFeed: Does not sanitise and escape the product_id POST parameter before using it in a SQL statementCVE-2021-4208 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users
- Product
- ExportFeed
- Affected
- up to 2.0.1.0
- What to do
- Affects up to 2.0.1.0. Update ExportFeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 16, 2022Fancy Product Designer: SQL InjectionCVE-2021-4134 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID parameter found in the ~/inc/api/class-view.php file which allows attackers with administrative level permissions to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 4.7.4.
- Product
- Fancy Product Designer
- Affected
- up to 4.7.4
- What to do
- Affects up to 4.7.4. Update Fancy Product Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsupport.fancyproductdesigner.comwordfence.com
Feb 7, 2022Ultimate Product Catalog: Does not have authorisation and CSRF checks in some AJAX actionsCVE-2021-24993 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
- Product
- Ultimate Product Catalog
- Fixed in
- 5.0.26
- What to do
- Update Ultimate Product Catalog to 5.0.26 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 7, 2022Rearrange Woocommerce Products: Does not have proper access controls in the save_all_order AJAX actionCVE-2021-24928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.
- Product
- Rearrange Woocommerce Products
- Fixed in
- 3.0.8
- What to do
- Update Rearrange Woocommerce Products to 3.0.8 or newer.
Jan 24, 2022Product Feed PRO for WooCommerce: Does not have authorisation and CSRF check in some of its AJAX actionsCVE-2021-24974 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.0.7 does not have authorisation and CSRF check in some of its AJAX actions, allowing any authenticated users to call then, which could lead to Stored Cross-Site Scripting issue (which will be triggered in the admin dashboard) due to the lack of escaping.
- Product
- Product Feed PRO for WooCommerce
- Fixed in
- 11.0.7
- What to do
- Update Product Feed PRO for WooCommerce to 11.0.7 or newer.
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboardCVE-2021-25001 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue
- Product
- Booster for WooCommerce
- Fixed in
- 5.4.9
- What to do
- Update Booster for WooCommerce to 5.4.9 or newer.
Nov 29, 2021Shop Page WP: Does not sanitise and escape some of the Product fieldsCVE-2021-24811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Shop Page WP
- Fixed in
- 1.2.8
- What to do
- Update Shop Page WP to 1.2.8 or newer.
Nov 23, 2021eCommerce Product Catalog Plugin for: Does not escape the ic-settings-search parameter before outputting it back in the page in an attributeCVE-2021-24875 · WordPress plugins & themes · reported by WPScanMedium 6.1
The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- eCommerce Product Catalog Plugin for
- Fixed in
- 3.0.39
- What to do
- Update eCommerce Product Catalog Plugin for to 3.0.39 or newer.
Nov 8, 2021Booking.com Product Helper: Does not sanitize and escape Product CodeCVE-2021-24645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Booking.com Product Helper
- Fixed in
- 1.0.2
- What to do
- Update Booking.com Product Helper to 1.0.2 or newer.
Oct 11, 2021A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX aCVE-2021-39317 · WordPress plugins & themes · reported by WordfenceHigh 8.8
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.
- Product
- affected products. The complete list of affected products and their versions are below:
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update affected products. The complete list of affected products and their versions are below: to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.complugins.trac.wordpress.org
Sep 20, 2021fetch_product_ajax functionality in the Product Feed on WooCommerce: Uses a `product_id` POST parameterCVE-2021-24511 · WordPress plugins & themes · reported by WPScanHigh 7.2
The fetch_product_ajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a `product_id` POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
- Product
- fetch_product_ajax functionality in the Product Feed on WooCommerce
- Fixed in
- 3.3.1.0
- What to do
- Update fetch_product_ajax functionality in the Product Feed on WooCommerce to 3.3.1.0 or newer.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
- Product
- WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 26, 2021woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks.CVE-2021-32789 · WordPress plugins & themes · reported by GitHubHigh 7.5
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.
- What to do
- Update the plugin to the newest version.
Jul 12, 2021The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request.CVE-2021-24385 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.
- Affected
- 4.7.3 to 4.7.3
- What to do
- Affects 4.7.3 to 4.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2021Fancy Product Designer: Allows unauthenticated attackers to upload arbitrary filesCVE-2021-24370 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
- Product
- Fancy Product Designer
- Fixed in
- 4.6.9
- What to do
- Update Fancy Product Designer to 4.6.9 or newer.
Full record and what to do →NVD recordlists.openwall.netseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.