Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,988 results · page 176 of 180
Aug 15, 2022The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unaCVE-2022-2180 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE).
- Fixed in
- 1.2.7
- What to do
- Update the plugin to 1.2.7 or newer.
Aug 8, 2022WPDating: Does not properly escape user input before concatenating it to certain SQL queriesCVE-2022-2460 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users
- Product
- WPDating
- Fixed in
- 7.4.0
- What to do
- Update WPDating to 7.4.0 or newer.
Aug 8, 2022Rough Chart: Does not properly escape chart data labelCVE-2022-2409 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Rough Chart
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Rough Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022YaySMTP: Does not have proper authorisationCVE-2022-2371 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 5, 2022Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.CVE-2022-25649 · WordPress plugins & themes · reported by PatchstackMedium 5
Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress.
- Affected
- up to 4.7.0
- What to do
- Affects up to 4.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddzv365zjfbd8v.cloudfront.netpatchstack.com
Aug 1, 2022Simple Membership: Does not properly validate the membership_level parameterCVE-2022-2273 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.
- Product
- Simple Membership
- Fixed in
- 4.1.3
- What to do
- Update Simple Membership to 4.1.3 or newer.
Aug 1, 2022GiveWP: Does not properly sanitise and escape the currency settingsCVE-2022-2215 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GiveWP
- Fixed in
- 2.21.3
- What to do
- Update GiveWP to 2.21.3 or newer.
Jul 25, 2022Professional Social Sharing Buttons, Icons & Related Posts: Does not have proper authorisation check in one of the AJAX actionCVE-2022-0594 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
- Product
- Professional Social Sharing Buttons, Icons & Related Posts
- Fixed in
- 9.7.6
- What to do
- Update Professional Social Sharing Buttons, Icons & Related Posts to 9.7.6 or newer.
Jul 18, 2022The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly cCVE-2022-2224 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly check for the existence of a nonce in the function gifeed_duplicate_feed. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected
- up to 1.0.0.27
- What to do
- Affects up to 1.0.0.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 18, 2022The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the CVE-2022-2223 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the existence of a nonce in the function ewic_duplicate_slider. This make it possible for unauthenticated attackers to duplicate existing posts or pages granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected
- up to 1.1.121
- What to do
- Affects up to 1.1.121. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 11, 2022Pricing Deals for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1057 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- Pricing Deals for WooCommerce
- Affected
- up to 2.0.2.02
- What to do
- Affects up to 2.0.2.02. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2022Allow svg files: Does not properly validate uploaded filesCVE-2022-1939 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to
- Product
- Allow svg files
- Fixed in
- 1.1
- What to do
- Update Allow svg files to 1.1 or newer.
Jun 20, 2022Events Made Easy: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1905 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Events Made Easy
- Fixed in
- 2.2.81
- What to do
- Update Events Made Easy to 2.2.81 or newer.
Jun 20, 2022Better Find and Replace: Does not properly sanitiseCVE-2022-1472 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
- Product
- Better Find and Replace
- Fixed in
- 1.3.6
- What to do
- Update Better Find and Replace to 1.3.6 or newer.
Jun 15, 2022Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in MCVE-2022-28612 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Muneeb's Custom Popup Builder plugin <= 1.3.1 at WordPress.
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 13, 2022Google Places Reviews: Does not properly escape its Google API key settingCVE-2022-1772 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.
- Product
- Google Places Reviews
- Fixed in
- 2.0.0
- What to do
- Update Google Places Reviews to 2.0.0 or newer.
Jun 13, 2022iQ Block Country: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-1762 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- iQ Block Country
- Fixed in
- 1.2.20
- What to do
- Update iQ Block Country to 1.2.20 or newer.
Jun 13, 2022Simple Membership: Does not properly sanitise and escape parameters before outputting them back in AJAX actionsCVE-2022-1724 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
- Product
- Simple Membership
- Fixed in
- 4.1.1
- What to do
- Update Simple Membership to 4.1.1 or newer.
Jun 13, 2022WP SVG Icons: Does not properly validate uploaded custom icon packsCVE-2022-0863 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
- Product
- WP SVG Icons
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update WP SVG Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter.CVE-2022-27231 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.
- Fixed in
- 13.2.0
- What to do
- Update the plugin to 13.2.0 or newer.
Jun 8, 2022Five Minute Webshop: Does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin pageCVE-2022-1685 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection
- Product
- Five Minute Webshop
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Five Minute Webshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Photo Gallery by 10Web: Does not properly validate and escape some of its settingsCVE-2022-1394 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.4
- What to do
- Update Photo Gallery by 10Web to 1.6.4 or newer.
Jun 8, 2022Ask me: Does not properly sanitise and escape several of the fields in the Edit Profile pageCVE-2022-1241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues
- Product
- Ask me
- Fixed in
- 6.8.2
- What to do
- Update Ask me to 6.8.2 or newer.
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 30, 2022External Links in New Window / New Tab: Does not properly escape URLs it concatenates to onclick event handlersCVE-2022-1582 · WordPress plugins & themes · reported by WPScanMedium 6.1
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
- Product
- External Links in New Window / New Tab
- Fixed in
- 1.43
- What to do
- Update External Links in New Window / New Tab to 1.43 or newer.
May 30, 2022StaffList: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-1556 · WordPress plugins & themes · reported by WPScanCritical 9.8
The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection
- Product
- StaffList
- Fixed in
- 3.1.5
- What to do
- Update StaffList to 3.1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
- Product
- JivoChat Live Chat
- Fixed in
- 1.3.5.4
- What to do
- Update JivoChat Live Chat to 1.3.5.4 or newer.
May 23, 2022Sliderby10Web: Does not properly sanitize and escape some of its settingsCVE-2022-1320 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Sliderby10Web
- Fixed in
- 1.2.52
- What to do
- Update Sliderby10Web to 1.2.52 or newer.
May 23, 2022WP Contacts Manager: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1014 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.
- Product
- WP Contacts Manager
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update WP Contacts Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not properly validate imagesCVE-2022-1409 · WordPress plugins & themes · reported by WPScanHigh 7.2
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 16, 2022The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statemenCVE-2022-0867 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users
- Product
- Pricing Table
- Fixed in
- 3.6.1
- What to do
- Update Pricing Table to 3.6.1 or newer.
May 9, 2022Themify Post Type Builder Search Addon: Does not properly escape the current page URL before reusing it in a HTML attributeCVE-2022-1047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability.
- Product
- Themify Post Type Builder Search Addon
- Fixed in
- 1.4.0
- What to do
- Update Themify Post Type Builder Search Addon to 1.4.0 or newer.
May 9, 2022Personal Dictionary: Fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executedCVE-2022-1013 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability.
- Product
- Personal Dictionary
- Fixed in
- 1.3.4
- What to do
- Update Personal Dictionary to 1.3.4 or newer.
May 9, 2022SEMA API: Does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX actionCVE-2022-0836 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users
- Product
- SEMA API
- Fixed in
- 4.02
- What to do
- Update SEMA API to 4.02 or newer.
May 9, 2022Ubigeo de Perú para Woocommerce: Does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actionsCVE-2022-0814 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections
- Product
- Ubigeo de Perú para Woocommerce
- Fixed in
- 3.6.4
- What to do
- Update Ubigeo de Perú para Woocommerce to 3.6.4 or newer.
May 9, 2022WPGraphQL: Doesn't properly restrict access to information about other users' roles on the affected siteCVE-2019-25060 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
- Product
- WPGraphQL
- Fixed in
- 0.3.5
- What to do
- Update WPGraphQL to 0.3.5 or newer.
May 6, 2022Countdown & Clock (WordPress plugin): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2022-29420 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Adam Skaat Countdown & Clock (WordPress plugin) countdown-builder allows Stored XSS.This issue affects Countdown & Clock (WordPress plugin): from n/a through 2.3.2.
- Product
- Countdown & Clock (WordPress plugin)
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Countdown & Clock (WordPress plugin) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2022Photo Gallery by 10Web: Does not properly sanitize the $_GET['image_url'] variableCVE-2022-1282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.3
- What to do
- Update Photo Gallery by 10Web to 1.6.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022Photo Gallery: Does not properly escape the $_POST['filter_tag'] parameterCVE-2022-1281 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
- Product
- Photo Gallery
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022Multiple Shipping Address Woocommerce: Does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated usersCVE-2022-0783 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
- Product
- Multiple Shipping Address Woocommerce
- Fixed in
- 2.0
- What to do
- Update Multiple Shipping Address Woocommerce to 2.0 or newer.
Apr 25, 2022Users Ultra: Fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and auCVE-2022-0769 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.
- Product
- Users Ultra
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Users Ultra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 20225 Stars Rating Funnel WordPress Plugin | RRatingg: Does not properly sanitiseCVE-2022-0657 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections.
- Product
- 5 Stars Rating Funnel WordPress Plugin | RRatingg
- Fixed in
- 1.2.54
- What to do
- Update 5 Stars Rating Funnel WordPress Plugin | RRatingg to 1.2.54 or newer.
Apr 25, 2022DW Question & Answer Pro: Does not properly check for CSRF in some of its functionsCVE-2021-24805 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.
- Product
- DW Question & Answer Pro
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update DW Question & Answer Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Loco Translate: Does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panelCVE-2022-0765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
- Product
- Loco Translate
- Fixed in
- 2.6.1
- What to do
- Update Loco Translate to 2.6.1 or newer.
Apr 18, 2022Ad Injection: Does not properly sanitize the body of the adverts injected into the pagesCVE-2022-0661 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
- Product
- Ad Injection
- Affected
- up to 1.2.0.19
- What to do
- Affects up to 1.2.0.19. Update Ad Injection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts.CVE-2011-1762 · WordPress plugins & themes · reported by Red HatMedium 6.5
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Apr 11, 2022Podcast Importer SecondLine: Does not sanitise and properly escape some imported dataCVE-2022-1023 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file
- Product
- Podcast Importer SecondLine
- Fixed in
- 1.3.8
- What to do
- Update Podcast Importer SecondLine to 1.3.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 11, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJACVE-2022-0949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 6.930
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 6.930 or newer.
Apr 11, 2022The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to aCVE-2022-0920 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data
- Fixed in
- 7.6.3
- What to do
- Update the plugin to 7.6.3 or newer.
Apr 11, 2022The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated userCVE-2022-0919 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.
- Fixed in
- 7.6.3
- What to do
- Update the plugin to 7.6.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.