Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 19 of 39
Apr 15, 2024Testimonial Slider: Does not sanitise and escape some of its settingsCVE-2024-1746 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Testimonial Slider
- Fixed in
- 2.3.8
- What to do
- Update Testimonial Slider to 2.3.8 or newer.
Apr 15, 2024Carousel Slider: Does not sanitise and escape some of its settingsCVE-2024-1712 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Carousel Slider
- Fixed in
- 2.2.7
- What to do
- Update Carousel Slider to 2.2.7 or newer.
Apr 15, 2024Top Bar: Does not sanitise and escape some of its settingsCVE-2024-1660 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Top Bar
- Fixed in
- 3.0.5
- What to do
- Update Top Bar to 3.0.5 or newer.
Apr 15, 2024Fancy Product Designer: Does not sanitise and escape some of its settingsCVE-2024-0902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fancy Product Designer
- Fixed in
- 6.1.81
- What to do
- Update Fancy Product Designer to 6.1.81 or newer.
Apr 15, 2024WooCommerce Customers Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0399 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.7
- What to do
- Update WooCommerce Customers Manager to 29.7 or newer.
Apr 9, 2024Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-1664 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.11
- What to do
- Update Responsive Gallery Grid to 2.3.11 or newer.
Apr 8, 2024WPB Show Core: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-1958 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Apr 8, 2024wpb-show-core: Does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated requestCVE-2024-1956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated request, leading to a Reflected Cross-Site Scripting
- Product
- wpb-show-core
- Fixed in
- 2.7
- What to do
- Update wpb-show-core to 2.7 or newer.
Apr 8, 2024Font Farsi: Does not sanitise and escape some of its settingsCVE-2024-1752 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Font Farsi
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Font Farsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024SendPress Newsletters: Does not sanitise and escape some of its settingsCVE-2024-1589 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SendPress Newsletters
- Affected
- up to 1.23.11.6
- What to do
- Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024SendPress Newsletters: Does not sanitise and escape some of its settingsCVE-2024-1588 · WordPress plugins & themes · reported by WPScanMedium 6.8
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SendPress Newsletters
- Affected
- up to 1.23.11.6
- What to do
- Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024WPB Show Core: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2024-1292 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Apr 6, 2024Inline Related Posts: Does not sanitise and escape some of its settingsCVE-2024-2444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Inline Related Posts
- Fixed in
- 3.5.0
- What to do
- Update Inline Related Posts to 3.5.0 or newer.
Apr 2, 2024My Calendar: Does not sanitise and escape some parametersCVE-2024-1274 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)
- Product
- My Calendar
- Fixed in
- 3.4.24
- What to do
- Update My Calendar to 3.4.24 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perforCVE-2024-2278 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site ScriptiCVE-2024-2263 · WordPress plugins & themes · reported by WPScanMedium 4.8
Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Mar 28, 2024Pz-LinkCard: Does not sanitise and escape some of its settingsCVE-2024-0673 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Pz-LinkCard
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2024Pz-LinkCard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0672 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Pz-LinkCard
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2024Gratisfaction: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29798 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Appsmav Gratisfaction allows Stored XSS.This issue affects Gratisfaction: from n/a through 4.3.4.
- Product
- Gratisfaction
- Affected
- up to 4.3.4
- What to do
- Affects up to 4.3.4. Update Gratisfaction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 27, 2024Dropdown Multisite selector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29910 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alordiel Dropdown Multisite selector allows Stored XSS.This issue affects Dropdown Multisite selector: from n/a through 0.9.2.
- Product
- Dropdown Multisite selector
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Dropdown Multisite selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 19, 2024Profile Box Shortcode And Widget: Does not sanitise and escape some of its settingsCVE-2024-1401 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Profile Box Shortcode And Widget
- Fixed in
- 1.2.1
- What to do
- Update Profile Box Shortcode And Widget to 1.2.1 or newer.
Mar 18, 2024Widget for Social Page Feeds: Does not sanitise and escape some of its settingsCVE-2024-0973 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Widget for Social Page Feeds
- Fixed in
- 6.4
- What to do
- Update Widget for Social Page Feeds to 6.4 or newer.
Mar 18, 2024Advanced Social Feeds Widget & Shortcode: Does not sanitise and escape some of its settingsCVE-2024-0951 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Social Feeds Widget & Shortcode
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Advanced Social Feeds Widget & Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Jobs for: Does not sanitise and escape some parametersCVE-2024-0820 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Jobs for WordPress plugin before 2.7.4 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Jobs for
- Fixed in
- 2.7.4
- What to do
- Update Jobs for to 2.7.4 or newer.
Mar 18, 2024Fancy Product Designer: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0365 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators.
- Product
- Fancy Product Designer
- Fixed in
- 6.1.5
- What to do
- Update Fancy Product Designer to 6.1.5 or newer.
Mar 17, 2024AntiSpam for Contact Form 7: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27961 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codekraft AntiSpam for Contact Form 7 allows Reflected XSS.This issue affects AntiSpam for Contact Form 7: from n/a through 0.6.0.
- Product
- AntiSpam for Contact Form 7
- Affected
- up to 0.6.0
- What to do
- Affects up to 0.6.0. Update AntiSpam for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 17, 2024WP Visitor Statistics (Real Time Traffic): Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-24867 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Osamaesh WP Visitor Statistics (Real Time Traffic).This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through 6.9.4.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Affected
- up to 6.9.4
- What to do
- Affects up to 6.9.4. Update WP Visitor Statistics (Real Time Traffic) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2024WP Statistics: Stored Cross-Site ScriptingCVE-2024-2194 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Statistics
- Affected
- up to 14.5
- What to do
- Affects up to 14.5. Update WP Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 13, 2024Burst Statistics – Privacy-Friendly Analytics for: Stored Cross-Site ScriptingCVE-2024-1894 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'burst_total_pageviews_count' custom meta field in all versions up to, and including, 1.5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that this exploit only functions if the victim has the 'Show Toolbar when viewing site' option enabled in their profile.
- Product
- Burst Statistics – Privacy-Friendly Analytics for
- Affected
- up to 1.5.6.1
- What to do
- Affects up to 1.5.6.1. Update Burst Statistics – Privacy-Friendly Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2024Starbox: Does not sanitise and escape some parametersCVE-2024-1273 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Starbox
- Fixed in
- 3.5.0
- What to do
- Update Starbox to 3.5.0 or newer.
Mar 11, 2024404 Solution: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-1068 · WordPress plugins & themes · reported by WPScanHigh 7.2
The 404 Solution WordPress plugin before 2.35.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins.
- Product
- 404 Solution
- Fixed in
- 2.35.8
- What to do
- Update 404 Solution to 2.35.8 or newer.
Feb 27, 2024Shariff Wrapper: Does not sanitise and escape some of its settingsCVE-2024-1106 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Shariff Wrapper
- Fixed in
- 4.6.10
- What to do
- Update Shariff Wrapper to 4.6.10 or newer.
Feb 27, 2024Persian Fonts: Does not sanitise and escape some of its settingsCVE-2023-7167 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Persian Fonts
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Persian Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2024Page Builder: Pagelayer: Does not sanitise and escape some of its settingsCVE-2023-7115 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.8.1
- What to do
- Update Page Builder: Pagelayer to 1.8.1 or newer.
Feb 12, 2024Smart Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0566 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- Smart Manager
- Fixed in
- 8.28.0
- What to do
- Update Smart Manager to 8.28.0 or newer.
Feb 12, 2024GigPress: Does not sanitise and escape some of its settingsCVE-2023-7233 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GigPress WordPress plugin through 2.3.29 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GigPress
- Affected
- up to 2.3.29
- What to do
- Affects up to 2.3.29. Update GigPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024Popup Box: Does not sanitise and escape some of its settingsCVE-2023-6591 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Box WordPress plugin before 20.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Popup Box
- Fixed in
- 20.9.0
- What to do
- Update Popup Box to 20.9.0 or newer.
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6082 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- chartjs
- Affected
- up to 2023.2
- What to do
- Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2024chartjs: Does not sanitise and escape some of its settingsCVE-2023-6081 · WordPress plugins & themes · reported by WPScanMedium 5.4
The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- chartjs
- Affected
- up to 2023.2
- What to do
- Affects up to 2023.2. Update chartjs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2024EventON: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-7200 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EventON
- Fixed in
- 4.4.1
- What to do
- Update EventON to 4.4.1 or newer.
Jan 29, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the pageCVE-2023-6278 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
- Fixed in
- 2.2.25
- What to do
- Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to 2.2.25 or newer.
Jan 29, 2024Restrict Usernames Emails Characters: Does not sanitise and escape some of its settingsCVE-2023-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Restrict Usernames Emails Characters
- Fixed in
- 3.1.4
- What to do
- Update Restrict Usernames Emails Characters to 3.1.4 or newer.
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5956 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Wp-Adv-Quiz
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Wp-Adv-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5943 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Wp-Adv-Quiz
- Fixed in
- 1.0.3
- What to do
- Update Wp-Adv-Quiz to 1.0.3 or newer.
Jan 22, 2024Meris: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-7194 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Meris
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Meris to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2024EventON-RSVP: Does not sanitise and escape some parameters before outputting it back in the pageCVE-2023-7170 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EventON-RSVP
- Fixed in
- 2.9.5
- What to do
- Update EventON-RSVP to 2.9.5 or newer.
Jan 22, 2024Product Enquiry for WooCommerce: Does not sanitise and escape some of its settingsCVE-2023-6626 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.1
- What to do
- Update Product Enquiry for WooCommerce to 3.1 or newer.
Jan 22, 2024WP Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6456 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Review Slider
- Fixed in
- 13.0
- What to do
- Update WP Review Slider to 13.0 or newer.
Jan 22, 2024SEOPress: Does not sanitise and escape some of its settingsCVE-2023-6290 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- SEOPress
- Fixed in
- 7.3
- What to do
- Update SEOPress to 7.3 or newer.
Jan 17, 2024The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON paramCVE-2024-0405 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'page_id', 'page_url', 'platform', and 'referrer'. This vulnerability arises due to insufficient escaping of user-supplied parameters and the lack of adequate preparation in SQL queries. As a result, authenticated attackers with editor access or higher can append additional SQL queries into existing ones, potentially leading to unauthorized access to sensitive information from the database.
- Fixed in
- 1.5.3
- What to do
- Update the plugin to 1.5.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.