Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10,183 results · page 187 of 204
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated usersCVE-2022-4237 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.6
- What to do
- Update Welcart e-Commerce to 2.8.6 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated usersCVE-2022-4236 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Jan 2, 2023Joy Of Text Lite: Does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated usersCVE-2022-4099 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection
- Product
- Joy Of Text Lite
- Fixed in
- 2.3.1
- What to do
- Update Joy Of Text Lite to 2.3.1 or newer.
Jan 2, 2023Cryptocurrency Widgets Pack: Does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4059 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Cryptocurrency Widgets Pack
- Fixed in
- 2.0
- What to do
- Update Cryptocurrency Widgets Pack to 2.0 or newer.
Jan 2, 2023Authenticator: Does not prevent subscribers from updating a site's feed access tokenCVE-2022-3994 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the functionality in certain configurations.
- Product
- Authenticator
- Fixed in
- 1.3.1
- What to do
- Update Authenticator to 1.3.1 or newer.
Jan 2, 2023iubenda: Does does not have authorisation and CSRF in an AJAX actionCVE-2022-3911 · WordPress plugins & themes · reported by WPScanHigh 8.8
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc
- Product
- iubenda
- Fixed in
- 3.3.3
- What to do
- Update iubenda to 3.3.3 or newer.
Jan 2, 2023Build App Online: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-3241 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Build App Online
- Fixed in
- 1.0.19
- What to do
- Update Build App Online to 1.0.19 or newer.
Dec 26, 2022IWS: Does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4117 · WordPress plugins & themes · reported by WPScanCritical 9.8
The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.
- Product
- IWS
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update IWS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Return Refund and Exchange For WooCommerce: Does not validate attachment files to be uploaded via an AJAX action available to unauthenticated usersCVE-2022-4047 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE
- Product
- Return Refund and Exchange For WooCommerce
- Fixed in
- 4.0.9
- What to do
- Update Return Refund and Exchange For WooCommerce to 4.0.9 or newer.
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various functions used to update the plugin settingsCVE-2022-3805 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
- Product
- Jeg Elementor Kit
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various AJAX actionsCVE-2022-3794 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.
- Product
- Jeg Elementor Kit
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 19, 2022Popup Manager: Does not have authorisation and CSRF checkCVE-2022-4125 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well
- Product
- Popup Manager
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Popup Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2022Popup Manager: Does not have authorisation and CSRF checksCVE-2022-4124 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them
- Product
- Popup Manager
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Popup Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2022SMSA Shipping for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-4107 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server
- Product
- SMSA Shipping for WooCommerce
- Fixed in
- 1.0.5
- What to do
- Update SMSA Shipping for WooCommerce to 1.0.5 or newer.
Dec 19, 2022Wholesale Market for WooCommerce: Does not have authorisation checkCVE-2022-4106 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
- Product
- Wholesale Market for WooCommerce
- Fixed in
- 1.0.7
- What to do
- Update Wholesale Market for WooCommerce to 1.0.7 or newer.
Dec 19, 2022Registration Forms: Does not have authorisation and CSRFCVE-2022-4024 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenticated attackers to delete arbitrary users (along with their posts)
- Product
- Registration Forms
- Fixed in
- 3.8.1.3
- What to do
- Update Registration Forms to 3.8.1.3 or newer.
Dec 16, 2022WP Shamsi: Authorization bypassCVE-2022-4555 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to deactivate arbitrary plugins on the site. This can be used to deactivate security plugins that aids in exploiting other vulnerabilities.
- Product
- WP Shamsi
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update WP Shamsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 15, 2022Unauth.CVE-2022-44588 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress.
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 15, 2022Transposh WordPress Translation: Unauthorized setting changes by unauthenticated usersCVE-2022-2536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.9.6
- What to do
- Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Dec 14, 2022Mega Addons: Authorization bypassCVE-2022-4501 · WordPress plugins & themes · reported by WordfenceHigh 7.1
The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin's settings.
- Product
- Mega Addons
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update Mega Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 14, 2022WordPress is affected by an unauthenticated blind SSRF in the pingback feature.CVE-2022-3590 · WordPress plugins & themes · reported by WPScanMedium 5.9
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordblog.sonarsource.comwpscan.com
Dec 12, 2022DPD Baltic Shipping: Does not have authorisation and CSRF in an AJAX actionCVE-2022-3999 · WordPress plugins & themes · reported by WPScanHigh 8.1
The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.
- Product
- DPD Baltic Shipping
- Fixed in
- 1.2.57
- What to do
- Update DPD Baltic Shipping to 1.2.57 or newer.
Dec 12, 2022Welcart e-Commerce: Does not have authorisation and CSRF in an AJAX actionCVE-2022-3946 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.4
- What to do
- Update Welcart e-Commerce to 2.8.4 or newer.
Dec 12, 2022Listingo: Does not validate files to be uploaded via an AJAX action available to unauthenticated usersCVE-2022-3921 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
- Product
- Listingo
- Fixed in
- 3.2.7
- What to do
- Update Listingo to 3.2.7 or newer.
Dec 12, 2022User Registration: Does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-3912 · WordPress plugins & themes · reported by WPScanHigh 7.5
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.
- Product
- User Registration
- Fixed in
- 2.2.4.1
- What to do
- Update User Registration to 2.2.4.1 or newer.
Dec 12, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3883 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 7.24
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 7.24 or newer.
Dec 12, 2022Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3882 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix
- Fixed in
- 2.46
- What to do
- Update Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix to 2.46 or newer.
Dec 12, 2022WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3881 · WordPress plugins & themes · reported by WPScanMedium 5.7
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log
- Fixed in
- 3.43
- What to do
- Update WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log to 3.43 or newer.
Dec 12, 2022Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3880 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
- Fixed in
- 4.20
- What to do
- Update Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan to 4.20 or newer.
Dec 12, 2022Car Dealer (Dealership) and Vehicle sales: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3879 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
- Product
- Car Dealer (Dealership) and Vehicle sales
- Fixed in
- 3.05
- What to do
- Update Car Dealer (Dealership) and Vehicle sales to 3.05 or newer.
Dec 6, 2022Auth.CVE-2022-42699 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 6, 2022Auth.CVE-2022-45833 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 6, 2022Auth.CVE-2022-45829 · WordPress plugins & themes · reported by PatchstackHigh 8.7
Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress.
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 6, 2022Auth.CVE-2022-45816 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress.
- Affected
- up to 4.3.1
- What to do
- Affects up to 4.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 6, 2022Unauth.CVE-2022-45848 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress.
- Affected
- up to 13.1.0.9
- What to do
- Affects up to 13.1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 6, 2022Unauth.CVE-2022-45359 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.
- Affected
- up to 3.19.0
- What to do
- Affects up to 3.19.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 6, 2022Unauth.CVE-2022-42888 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.
- Affected
- up to 5.5.1
- What to do
- Affects up to 5.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 6, 2022Unauth.CVE-2022-40209 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3926 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 3.4.2
- What to do
- Update WP OAuth Server (OAuth Authentication) to 3.4.2 or newer.
Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not sanitize and escape Client IDsCVE-2022-3892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.2.2
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.2.2 or newer.
Dec 5, 2022Unauth.CVE-2022-45822 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 4, 2022WordPress versions prior to 6.0.3: Improper authenticationCVE-2022-43504 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.3
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.
- Product
- WordPress versions prior to 6.0.3
- What to do
- Update WordPress versions prior to 6.0.3 to the newest version.
Nov 30, 2022Unauth.CVE-2022-45842 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores.
- Affected
- up to 4.6.4
- What to do
- Affects up to 4.6.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 28, 2022Auth.CVE-2022-38140 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.
- Affected
- up to 12.1.10
- What to do
- Affects up to 12.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 28, 2022The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks inCVE-2022-4169 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.
- Affected
- up to 3.2.16
- What to do
- Affects up to 3.2.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 28, 2022Fancier Author Box by ThematoSoup: Does not sanitise and escape some of its settingsCVE-2022-3833 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Fancier Author Box by ThematoSoup
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Fancier Author Box by ThematoSoup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 22, 2022Auth.CVE-2022-45363 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress.
- Affected
- up to 26.6.1
- What to do
- Affects up to 26.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 21, 2022Five Star Restaurant Reservations: Does not have authorisationCVE-2022-0421 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.4.12
- What to do
- Update Five Star Restaurant Reservations to 2.4.12 or newer.
Nov 18, 2022Auth.CVE-2022-41609 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress.
- Fixed in
- 1.9.10.69
- What to do
- Update the plugin to 1.9.10.69 or newer.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Nov 18, 2022Auth.CVE-2022-45369 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress.
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.