Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

296new WordPress flaws this week

393,915entries in the database

10,183 results · page 188 of 204

Nov 18, 2022Multiple Auth.CVE-2022-45082 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin <= 2.0.3 on WordPress via &addons-style-name and &accordions_or_faqs_license_key.
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.CVE-2022-45073 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.
Affected
up to 2.4.0
What to do
Affects up to 2.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Auth.CVE-2022-44634 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress.
Affected
up to 1.1.12
What to do
Affects up to 1.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Unauth.CVE-2022-44584 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.
Affected
up to 3.6.15
What to do
Affects up to 3.6.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Unauth.CVE-2022-44583 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.
Affected
up to 3.6.15
What to do
Affects up to 3.6.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Auth.CVE-2022-43492 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress.
Affected
7.4.2 to 7.4.2
What to do
Affects 7.4.2 to 7.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Unauth.CVE-2022-42698 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Auth.CVE-2022-42459 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.
Affected
up to 9.7.1
What to do
Affects up to 9.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth: Broken Access ControlCVE-2022-41839 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.
Product
WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth
Affected
up to 1.6.2
What to do
Affects up to 1.6.2. Update WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Auth.CVE-2022-41788 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.
Affected
up to 8.2.5
What to do
Affects up to 8.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com themeforest.net
Nov 18, 2022Auth.CVE-2022-41655 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress.
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Auth.CVE-2022-41643 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.CVE-2022-41618 · WordPress plugins & themes · reported by PatchstackLow 3.7
Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.
Affected
up to 3.00
What to do
Affects up to 3.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Unauth.CVE-2022-41135 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.
Affected
up to 2.6.9
What to do
Affects up to 2.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Multiple Auth.CVE-2022-40963 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Auth.CVE-2022-40698 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
Affected
up to 7.3.10
What to do
Affects up to 7.3.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Auth.CVE-2022-40216 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.
Affected
up to 1.9.10.69
What to do
Affects up to 1.9.10.69. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Auth.CVE-2022-40130 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress.
Affected
up to 2.76.0
What to do
Affects up to 2.76.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.CVE-2022-43482 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.
Affected
up to 1.3.69
What to do
Affects up to 1.3.69. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.CVE-2022-42461 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.
Affected
up to 5.6.1
What to do
Affects up to 5.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Auth.CVE-2022-43463 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress.
Affected
up to 1.7.9
What to do
Affects up to 1.7.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Unauth.CVE-2022-41840 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.
Affected
up to 2.7.7
What to do
Affects up to 2.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2022Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.CVE-2022-41692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.
Affected
up to 1.3.71
What to do
Affects up to 1.3.71. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Auth.CVE-2022-45375 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress.
Affected
up to 1.2
What to do
Affects up to 1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Auth.CVE-2022-45077 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress.
Affected
up to 26.5.1.4
What to do
Affects up to 26.5.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com themeforest.net
Nov 17, 2022Auth.CVE-2022-45069 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress.
Affected
up to 3.0.9
What to do
Affects up to 3.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Auth.CVE-2022-45066 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress.
Affected
up to 2.0.1
What to do
Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Auth.CVE-2022-44736 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress.
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Auth.CVE-2022-44591 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin <= 0.8.0 on WordPress.
Affected
up to 0.8.0
What to do
Affects up to 0.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Auth.CVE-2022-41791 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.
Affected
up to 5.1.6
What to do
Affects up to 5.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Auth.CVE-2022-41315 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress.
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.CVE-2022-41132 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.
Affected
up to 2.8.8
What to do
Affects up to 2.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Auth.CVE-2022-40694 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress.
Affected
up to 8.8.8
What to do
Affects up to 8.8.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Auth.CVE-2022-40200 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 17, 2022Unauth.CVE-2022-36357 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webpsilon ULTIMATE TABLES plugin <= 1.6.5 versions.
Affected
up to 1.6.5
What to do
Affects up to 1.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2022Multiple Auth.CVE-2021-36905 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Quiz And Survey Master plugin <= 7.3.4 on WordPress.
Affected
up to 7.3.4
What to do
Affects up to 7.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 14, 2022OAuth Client by DigitialPixies: Does not have CSRF checks in some placesCVE-2022-3632 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions.
Product
OAuth Client by DigitialPixies
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 14, 2022OAuth Client by DigitialPixies: Does not sanitize and escapes some of its settingsCVE-2022-3631 · WordPress plugins & themes · reported by WPScanMedium 4.8
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Product
OAuth Client by DigitialPixies
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 14, 2022Webmaster Tools Verification: Does not have authorisation and CSRF checksCVE-2022-3538 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
Product
Webmaster Tools Verification
Affected
up to 1.2
What to do
Affects up to 1.2. Update Webmaster Tools Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 14, 2022reSmush.it : the only free Image Optimizer & compress: Lacks authorization in various AJAX actionsCVE-2022-2450 · WordPress plugins & themes · reported by WPScanMedium 4.3
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
Product
reSmush.it : the only free Image Optimizer & compress
Fixed in
0.4.4
What to do
Update reSmush.it : the only free Image Optimizer & compress to 0.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 9, 2022Auth.CVE-2022-44590 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress.
Affected
up to 2.2
What to do
Affects up to 2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 9, 2022Auth.CVE-2022-41978 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress.
Affected
up to 1.7.5.8
What to do
Affects up to 1.7.5.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 8, 2022Auth.CVE-2022-41980 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress.
Affected
up to 0.13
What to do
Affects up to 0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 8, 2022Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.CVE-2022-40223 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com searchwp.com
Nov 8, 2022Auth.CVE-2022-32776 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on WordPress.
Affected
up to 1.31.1
What to do
Affects up to 1.31.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 8, 2022Auth.CVE-2022-30545 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress.
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3537 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
Product
Role Based Pricing for WooCommerce
Fixed in
1.6.2
What to do
Update Role Based Pricing for WooCommerce to 1.6.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3536 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blog
Product
Role Based Pricing for WooCommerce
Fixed in
1.6.3
What to do
Update Role Based Pricing for WooCommerce to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 7, 2022WP Hide: Does not have authorisation and CSRF checks in placeCVE-2022-3489 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request
Product
WP Hide
Affected
up to 0.0.2
What to do
Affects up to 0.0.2. Update WP Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 7, 2022WooCommerce Dropshipping: Does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated usersCVE-2022-3481 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
Product
WooCommerce Dropshipping
Fixed in
4.4
What to do
Update WooCommerce Dropshipping to 4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.