Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

279new WordPress flaws this week

393,576entries in the database

10,182 results · page 184 of 204

Apr 6, 2023Auth.CVE-2023-23982 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPGear.Pro WPFrom Email plugin <= 1.8.8 versions.
Fixed in
1.8.9
What to do
Update the plugin to 1.8.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-23981 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud Conversational Forms for ChatBot plugin <= 1.1.6 versions.
Affected
up to 1.1.6
What to do
Affects up to 1.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Auth.CVE-2023-23815 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Jackson Multi-column Tag Map plugin <= 17.0.24 versions.
Fixed in
17.0.25
What to do
Update the plugin to 17.0.25 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 5, 2023WCFM Membership: Unauthorized modification and access of dataCVE-2022-4940 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such as modifying membership details, changing renewal information, controlling membership approvals, and more.
Product
WCFM Membership
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update WCFM Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2023WCFM Frontend Manager: Unauthorized modification and access of dataCVE-2022-4937 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying knowledge bases, modifying notices, modifying payments, managing vendors, capabilities, and so much more. There were hundreds of AJAX endpoints affected.
Product
WCFM Frontend Manager
Affected
up to 6.6.0
What to do
Affects up to 6.6.0. Update WCFM Frontend Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2023WCFM Marketplace: Unauthorized modification and access of dataCVE-2022-4935 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying shipping method details, modifying products, deleting arbitrary posts, and privilege escalation (via the wp_ajax_wcfm_vendor_store_online AJAX action).
Product
WCFM Marketplace
Affected
up to 3.4.11
What to do
Affects up to 3.4.11. Update WCFM Marketplace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 5, 2023YourChannel: Unauthorized loss of dataCVE-2023-1868 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_clear_cache GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to clear the plugin's cache.
Product
YourChannel
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2023YourChannel: Unauthorized loss of dataCVE-2023-1865 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when resetting plugin settings via the yrc_nuke GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated attackers to delete YouTube channels from the plugin.
Product
YourChannel
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 5, 2023Auth.CVE-2023-26536 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.05 versions.
Fixed in
2.06
What to do
Update the plugin to 2.06 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23977 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor WordPress Social Comments Plugin for Vkontakte Comments and Disqus Comments plugin <= 1.6.1 versions.
Fixed in
1.6.2
What to do
Update the plugin to 1.6.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23870 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Responsive Vertical Icon Menu plugin <= 1.5.8 versions.
Fixed in
1.5.9
What to do
Update the plugin to 1.5.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23878 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS plugin <= 4.3.9 versions.
Fixed in
4.4.0
What to do
Update the plugin to 4.4.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23821 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marcin Pietrzak Interactive Polish Map plugin <= 1.2 versions.
Fixed in
1.2.1
What to do
Update the plugin to 1.2.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23686 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brett Shumaker Simple Staff List plugin <= 2.2.2 versions.
Fixed in
2.2.3
What to do
Update the plugin to 2.2.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 4, 2023Auth.CVE-2023-23685 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in RadiusTheme Portfolio – WordPress Portfolio plugin <= 2.8.10 versions.
Fixed in
2.8.11
What to do
Update the plugin to 2.8.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 3, 2023Auth.CVE-2023-26529 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DupeOff.Com DupeOff plugin <= 1.6 versions.
Affected
up to 1.6
What to do
Affects up to 1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-25040 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultimate plugin <= 5.12.6 versions.
Fixed in
5.12.7
What to do
Update the plugin to 5.12.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-24399 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions.
Fixed in
2.1.3
What to do
Update the plugin to 2.1.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-23681 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Labib Ahmed Image Hover Effects For WPBakery Page Builder plugin <= 4.0 versions.
Fixed in
5.0
What to do
Update the plugin to 5.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-23675 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catchsquare WP Smart Preloader plugin <= 1.15 versions.
Fixed in
1.15.1
What to do
Update the plugin to 1.15.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 30, 2023Auth.CVE-2023-23670 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Team Heateor Fancy Comments WordPress plugin <= 1.2.10 versions.
Fixed in
1.2.11
What to do
Update the plugin to 1.2.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Collne Inc: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-22705 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin <= 2.8.10 versions.
Product
Collne Inc
Affected
up to 2.8.10
What to do
Affects up to 2.8.10. Update Collne Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47602 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in JoomUnited WP Table Manager plugin <= 3.5.2 versions.
Affected
up to 3.5.2
What to do
Affects up to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47613 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud AI ChatBot plugin <= 4.3.0 versions.
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47610 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mr Digital Simple Image Popup plugin <= 1.3.6 versions.
Affected
up to 1.3.6
What to do
Affects up to 1.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47607 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Usersnap plugin <= 4.16 versions.
Affected
up to 4.16
What to do
Affects up to 4.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Unauth.CVE-2022-47603 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.1 versions.
Fixed in
2.0.2
What to do
Update the plugin to 2.0.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-45355 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Auth. (admin+) SQL Injection (SQLi) vulnerability in ThimPress WP Pipes plugin <= 1.33 versions.
Affected
up to 1.33
What to do
Affects up to 1.33. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47596 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 1.9.9 versions.
Affected
up to 1.9.9
What to do
Affects up to 1.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Unauth.CVE-2022-47444 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.5.3 versions.
Affected
up to 4.5.3
What to do
Affects up to 4.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Auth.CVE-2022-47438 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions.
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Unauth.CVE-2022-47433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.
Affected
up to 5.0.5
What to do
Affects up to 5.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Auth.CVE-2023-25704 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mehjabin Orthi Interactive SVG Image Map Builder plugin <= 1.0 versions.
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Unlimited Elements Unlimited Elements For Elementor: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-47170 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.48 versions.
Product
Unlimited Elements Unlimited Elements For Elementor
Fixed in
1.5.49
What to do
Update Unlimited Elements Unlimited Elements For Elementor to 1.5.49 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Auth.CVE-2022-46863 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.6.4 versions.
Fixed in
9.6.5
What to do
Update the plugin to 9.6.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Auth.CVE-2022-46855 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP Darko Responsive Pricing Table plugin <= 5.1.6 versions.
Fixed in
5.1.7
What to do
Update the plugin to 5.1.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Auth.CVE-2022-46848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <= 3.9.1 versions.
Fixed in
3.9.2
What to do
Update the plugin to 3.9.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Unauth.CVE-2022-45831 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in biplob018 Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 2.8 versions.
Affected
up to 2.8
What to do
Affects up to 2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 28, 2023Unauth.CVE-2022-45825 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in iThemes WPComplete plugin <= 2.9.2 versions.
Fixed in
2.9.5
What to do
Update the plugin to 2.9.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2023OAuth Single Sign On: Does not have CSRF checksCVE-2023-1093 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack
Product
OAuth Single Sign On
Fixed in
6.24.2
What to do
Update OAuth Single Sign On to 6.24.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPreCVE-2023-1092 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
Fixed in
6.24.2
What to do
Update the plugin to 6.24.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Gallery Blocks with Lightbox: Has an AJAX endpoint that can be accessed by any authenticated usersCVE-2023-0441 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as subscriber. The callback function allows numerous actions, the most serious one being reading and updating the WordPress options which could be used to enable registration with a default administrator user role.
Product
Gallery Blocks with Lightbox
Fixed in
3.0.8
What to do
Update Gallery Blocks with Lightbox to 3.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Auth.CVE-2023-22707 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (author+) Cross-Site Scripting (XSS) vulnerability in Wpsoul Greenshift – animation and page builder blocks plugin <= 4.9.9 versions.
Affected
up to 4.9.9
What to do
Affects up to 4.9.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2023Unauth.CVE-2022-47146 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions.
Fixed in
3.3.2
What to do
Update the plugin to 3.3.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 27, 2023Unauth.CVE-2022-46843 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Le Van Toan Woocommerce Vietnam Checkout plugin <= 2.0.4 versions.
Fixed in
2.0.5
What to do
Update the plugin to 2.0.5 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Auth.CVE-2023-26008 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin <= 3.2.4 versions.
Affected
up to 3.2.4
What to do
Affects up to 3.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Auth.CVE-2023-25992 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM Answers plugin <= 3.1.9 versions.
Affected
up to 3.1.9
What to do
Affects up to 3.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Klaviyo, Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-25456 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Klaviyo, Inc. Klaviyo plugin <= 3.0.7 versions.
Product
Klaviyo, Inc
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Klaviyo, Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Auth.CVE-2022-47173 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration plugin <= 1.62.0 versions.
Fixed in
1.63.0
What to do
Update the plugin to 1.63.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Auth.CVE-2023-23728 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Flipclock plugin <= 1.7.4 versions.
Fixed in
1.8
What to do
Update the plugin to 1.8 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.