Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

356new WordPress flaws this week

394,273entries in the database

8,969 results · page 172 of 180

Oct 31, 2023Contact Form to DB by BestWebSoft – Messages Database Plugin For: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-36508 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.1.
Product
Contact Form to DB by BestWebSoft – Messages Database Plugin For
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Contact Form to DB by BestWebSoft – Messages Database Plugin For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Product Vendors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-35879 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.
Product
Product Vendors
Affected
up to 2.1.78
What to do
Affects up to 2.1.78. Update Product Vendors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Multiple Page Generator Plugin – MPG: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33927 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.3.19.
Product
Multiple Page Generator Plugin – MPG
Affected
up to 3.3.19
What to do
Affects up to 3.3.19. Update Multiple Page Generator Plugin – MPG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Database for Contact Form 7, WPforms, Elementor forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-31212 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0.
Product
Database for Contact Form 7, WPforms, Elementor forms
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Database for Contact Form 7, WPforms, Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-24410 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25.
Product
Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
Affected
up to 4.3.25
What to do
Affects up to 4.3.25. Update Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Royal Elementor Addons and Templates: Does not properly validate uploaded filesCVE-2023-5360 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.
Product
Royal Elementor Addons and Templates
Fixed in
1.3.79
What to do
Update Royal Elementor Addons and Templates to 1.3.79 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Oct 31, 2023LearnDash LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28777 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue affects LearnDash LMS: from n/a through 4.5.3.
Product
LearnDash LMS
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023RSVPMaker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25047 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.
Product
RSVPMaker
Affected
up to 9.9.3
What to do
Affects up to 9.9.3. Update RSVPMaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023RSVPMaker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25045 · WordPress plugins & themes · reported by PatchstackMedium 6.7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 9.9.3.
Product
RSVPMaker
Affected
up to 9.9.3
What to do
Affects up to 9.9.3. Update RSVPMaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023GamiPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-24000 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7.
Product
GamiPress
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update GamiPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 25, 2023Easy Testimonial Slider and Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-45754 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form allows Stored XSS.This issue affects Easy Testimonial Slider and Form: from n/a through 1.0.18.
Product
Easy Testimonial Slider and Form
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update Easy Testimonial Slider and Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 16, 2023WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of useCVE-2023-5561 · WordPress plugins & themes · reported by WPScanMedium 5.3
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record lists.debian.org wpscan.com
Oct 16, 2023User Activity Log Pro: Does not properly escape recorded User-Agents in the user activity logs dashboardCVE-2023-5167 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks.
Product
User Activity Log Pro
Fixed in
2.3.4
What to do
Update User Activity Log Pro to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023User Avatar: Does not properly sanitize and escape certain of its shortcodes attributesCVE-2023-4798 · WordPress plugins & themes · reported by WPScanMedium 5.4
The User Avatar WordPress plugin before 1.2.2 does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks.
Product
User Avatar
Fixed in
1.2.2
What to do
Update User Avatar to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023WordPress Online Booking and Scheduling: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-4691 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
WordPress Online Booking and Scheduling
Fixed in
22.4
What to do
Update WordPress Online Booking and Scheduling to 22.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023File Manager Pro: Does not properly check the CSRF nonce in the `fs_connector` AJAX actionCVE-2023-4827 · WordPress plugins & themes · reported by WPScanHigh 8.8
The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.
Product
File Manager Pro
Fixed in
1.8
What to do
Update File Manager Pro to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 2, 2023Rescue Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-41728 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through 2.5.
Product
Rescue Shortcodes
Affected
up to 2.5
What to do
Affects up to 2.5. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 25, 2023DoLogin Security: Does not properly sanitize IP addresses coming from the X-Forwarded-For headerCVE-2023-4549 · WordPress plugins & themes · reported by WPScanMedium 6.1
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
Product
DoLogin Security
Fixed in
3.7
What to do
Update DoLogin Security to 3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023All in One B2B for WooCommerce: Does not properly check nonce values in several actionsCVE-2023-3547 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks.
Product
All in One B2B for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update All in One B2B for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023URL Shortify: Does not properly escape the value of the referer headerCVE-2023-4294 · WordPress plugins & themes · reported by WPScanMedium 6.1
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.
Product
URL Shortify
Fixed in
1.7.6
What to do
Update URL Shortify to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023MasterStudy LMS: Does not have proper checks in place during registration allowing anyone to register on the siteCVE-2023-4278 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
Product
MasterStudy LMS
Fixed in
3.0.18
What to do
Update MasterStudy LMS to 3.0.18 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Sep 4, 2023User Activity Log: Lacks proper authorisationCVE-2023-4269 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
Product
User Activity Log
Fixed in
1.6.6
What to do
Update User Activity Log to 1.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Media from FTP: Does not properly limit who can use the pluginCVE-2023-4019 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.
Product
Media from FTP
Fixed in
11.17
What to do
Update Media from FTP to 11.17 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023User Activity Tracking and Log: Does not have proper CSRF checksCVE-2023-4150 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
Product
User Activity Tracking and Log
Fixed in
4.0.9
What to do
Update User Activity Tracking and Log to 4.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent): Does not have proper CSRF checksCVE-2023-4013 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
Product
GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent)
Fixed in
4.12.5
What to do
Update GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) to 4.12.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2023Ko-fi Button: Does not properly some of its settingsCVE-2023-2254 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we consider it a low risk.
Product
Ko-fi Button
Fixed in
1.3.3
What to do
Update Ko-fi Button to 1.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 7, 2023Quiz And Survey Master: Does not properly sanitize and escape question titlesCVE-2023-3575 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Quiz And Survey Master
Fixed in
8.1.11
What to do
Update Quiz And Survey Master to 8.1.11 or newer.
Full record and what to do →NVD record wpscan.com onvio.nl
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not properly sanitize and escape a parameter before using it in an SQL statementCVE-2023-2843 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Product
MultiParcels Shipping For WooCommerce
Fixed in
1.14.15
What to do
Update MultiParcels Shipping For WooCommerce to 1.14.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 31, 2023LMS by Masteriyo: Does not have proper authorization in one some of its REST API endpointsCVE-2023-3345 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students
Product
LMS by Masteriyo
Fixed in
1.6.8
What to do
Update LMS by Masteriyo to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 31, 2023Forminator: Does not properly escape values that are being reflected inside form fields that use pre-populated query parametersCVE-2023-3134 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
Product
Forminator
Fixed in
1.24.4
What to do
Update Forminator to 1.24.4 or newer.
Full record and what to do →NVD record wpscan.com onvio.nl
Jul 31, 2023Twittee Text Tweet: Does not properly escape POST valuesCVE-2023-0602 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.
Product
Twittee Text Tweet
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Twittee Text Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions.CVE-2023-36502 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions.
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 24, 2023User Activity Log: Does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pagesCVE-2023-2761 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
Product
User Activity Log
Fixed in
1.6.3
What to do
Update User Activity Log to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 18, 2023OAuth Single Sign On – SSO (OAuth Client): Improper AuthenticationCVE-2022-34155 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.23.3
What to do
Affects up to 6.23.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes patchstack.com
Jul 17, 2023Popup by Supsystic: Has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into ObjectCVE-2023-3186 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.
Product
Popup by Supsystic
Fixed in
1.10.19
What to do
Update Popup by Supsystic to 1.10.19 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023POST SMTP Mailer: Does not have proper CSRF checks in some AJAX actionsCVE-2023-3179 · WordPress plugins & themes · reported by WPScanHigh 8.8
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
Product
POST SMTP Mailer
Fixed in
2.5.7
What to do
Update POST SMTP Mailer to 2.5.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023AN_GradeBook: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2636 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
Product
AN_GradeBook
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jul 17, 2023Login Configurator: Does not properly escape a URL parameter before outputting it to the pageCVE-2023-1893 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
Product
Login Configurator
Affected
up to 2.1
What to do
Affects up to 2.1. Update Login Configurator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jul 10, 2023Simple Iframe: Does not properly validate one of its WordPress block attribute's contentCVE-2023-2964 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks.
Product
Simple Iframe
Fixed in
1.2.0
What to do
Update Simple Iframe to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023All In One Redirection: Does not properly sanitise and escape multiple parameters before using them in an SQL statementCVE-2023-2493 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
All In One Redirection
Fixed in
2.2.0
What to do
Update All In One Redirection to 2.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023PrePost SEO: Does not properly sanitize some of its settingsCVE-2023-2029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
PrePost SEO
Affected
up to 3.0
What to do
Affects up to 3.0. Update PrePost SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jul 10, 2023Call Now Accessibility Button: Does not properly sanitize some of its settingsCVE-2023-2028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Call Now Accessibility Button
Fixed in
1.1
What to do
Update Call Now Accessibility Button to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 10, 2023Image Protector: Does not properly sanitize some of its settingsCVE-2023-2026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Image Protector
Affected
up to 1.1
What to do
Affects up to 1.1. Update Image Protector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 1, 2023Opal Estate: Featured property modificationsCVE-2021-4388 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties.
Product
Opal Estate
Affected
up to 1.6.11
What to do
Affects up to 1.6.11. Update Opal Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 27, 2023ERP: Does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statementCVE-2023-2744 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
ERP
Fixed in
1.12.4
What to do
Update ERP to 1.12.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 27, 2023KiviCare: Does not have proper CSRF and authorisation checks in various AJAX actionsCVE-2023-2627 · WordPress plugins & themes · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings
Product
KiviCare
Fixed in
3.2.1
What to do
Update KiviCare to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023wpbrutalai: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2601 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin via CSRF.
Product
wpbrutalai
Fixed in
2.0.0
What to do
Update wpbrutalai to 2.0.0 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 27, 2023FormCraft: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2592 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Product
FormCraft
Fixed in
3.9.7
What to do
Update FormCraft to 3.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023Responsive CSS EDITOR: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2482 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.
Product
Responsive CSS EDITOR
Affected
up to 1.0
What to do
Affects up to 1.0. Update Responsive CSS EDITOR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2023Custom 404 Pro: Does not properly sanitize database inputsCVE-2023-2032 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.
Product
Custom 404 Pro
Fixed in
3.8.1
What to do
Update Custom 404 Pro to 3.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.