Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 20 of 39
Jan 16, 2024Contact Form 7 Connector: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Connector WordPress plugin before 1.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against administrators.
- Product
- Contact Form 7 Connector
- Fixed in
- 1.2.3
- What to do
- Update Contact Form 7 Connector to 1.2.3 or newer.
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Do not properly sanitise and escape a parameter before outputting it back in pagesCVE-2024-0233 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EventON WordPress plugin before 4.5.5, EventON
- Fixed in
- 4.5.5
- What to do
- Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Jan 16, 2024Community by PeepSo: Does not sanitise and escape various parameters and generated URLs before outputting them back attributesCVE-2024-0187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Community by PeepSo
- Fixed in
- 6.3.1.2
- What to do
- Update Community by PeepSo to 6.3.1.2 or newer.
Jan 16, 2024Hubbub Lite (formerly Grow Social): Does not sanitise and escape some of its settingsCVE-2023-7154 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Hubbub Lite (formerly Grow Social)
- Fixed in
- 1.32.0
- What to do
- Update Hubbub Lite (formerly Grow Social) to 1.32.0 or newer.
Jan 16, 2024Product Enquiry for WooCommerce: Does not sanitise and escape the page parameter before outputting it back in an attributeCVE-2023-7151 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.2
- What to do
- Update Product Enquiry for WooCommerce to 3.2 or newer.
Jan 16, 2024Voting Record: Is missing sanitisationCVE-2023-7084 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks
- Product
- Voting Record
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Voting Record to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordmagos-securitas.comwpscan.com
Jan 16, 2024Ultimate Maps by Supsystic: Does not sanitise and escape some of its settingsCVE-2023-6732 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Ultimate Maps by Supsystic
- Fixed in
- 1.2.16
- What to do
- Update Ultimate Maps by Supsystic to 1.2.16 or newer.
Jan 16, 2024EventON: Does not sanitise and escape some of its settingsCVE-2023-6046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfiltered_html capability is disallowed.
- Product
- EventON
- Fixed in
- 2.2
- What to do
- Update EventON to 2.2 or newer.
Jan 16, 2024LearnPress: Does not sanitise and escape user input before outputting it back in the pageCVE-2023-5558 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- LearnPress
- Fixed in
- 4.2.5.5
- What to do
- Update LearnPress to 4.2.5.5 or newer.
Jan 16, 2024IURNY by INDIGITALL: Does not sanitise and escape some of its settingsCVE-2023-3647 · WordPress plugins & themes · reported by WPScanMedium 4.8
The IURNY by INDIGITALL WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- IURNY by INDIGITALL
- Fixed in
- 3.2.3
- What to do
- Update IURNY by INDIGITALL to 3.2.3 or newer.
Jan 16, 2024WordPress Database Administrator: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2023-3211 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Database Administrator WordPress plugin through 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- WordPress Database Administrator
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update WordPress Database Administrator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Contact Form by WD: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2655 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Contact Form by WD WordPress plugin through 1.13.23 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Contact Form by WD
- Affected
- up to 1.13.23
- What to do
- Affects up to 1.13.23. Update Contact Form by WD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024hiWeb Migration Simple: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0769 · WordPress plugins & themes · reported by WPScanMedium 6.1
The hiWeb Migration Simple WordPress plugin through 2.0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins.
- Product
- hiWeb Migration Simple
- Affected
- up to 2.0.0.1
- What to do
- Affects up to 2.0.0.1. Update hiWeb Migration Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024Calculated Fields Form: Does not sanitise and escape some of its form settingsCVE-2023-0389 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Calculated Fields Form
- Fixed in
- 1.1.151
- What to do
- Update Calculated Fields Form to 1.1.151 or newer.
Jan 16, 2024Seed Social: Does not sanitise and escape some of its settingsCVE-2022-3836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Seed Social
- Fixed in
- 2.0.4
- What to do
- Update Seed Social to 2.0.4 or newer.
Jan 16, 2024Font Awesome 4 Menus: Does not sanitise and escape some of its settingsCVE-2022-3829 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Font Awesome 4 Menus
- Affected
- up to 4.7.0
- What to do
- Affects up to 4.7.0. Update Font Awesome 4 Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024ark-commenteditor: Does not properly sanitise or encode the commentsCVE-2021-4227 · WordPress plugins & themes · reported by WPScanMedium 5.3
The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page to the comment section
- Product
- ark-commenteditor
- Affected
- up to 2.15.6
- What to do
- Affects up to 2.15.6. Update ark-commenteditor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2024WP-PostRatings: Does not sanitise the postratings_image parameter from its options page (wp-admin/adminCVE-2021-25117 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php). Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfiltered_html capability is disabled.
- Product
- WP-PostRatings
- Fixed in
- 1.86.1
- What to do
- Update WP-PostRatings to 1.86.1 or newer.
Jan 16, 2024The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-SCVE-2021-24432 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced AJAX Product Filters WordPress plugin does not sanitise the 'term_id' POST parameter before outputting it in the page, leading to reflected Cross-Site Scripting issue.
- Fixed in
- 1.5.4.7
- What to do
- Update the plugin to 1.5.4.7 or newer.
Jan 16, 2024WP Editor: Did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameterCVE-2021-24151 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Editor WordPress plugin before 1.2.7 did not sanitise or validate its setting fields leading to an authenticated (admin+) blind SQL injection issue via an arbitrary parameter when making a request to save the settings.
- Product
- WP Editor
- Fixed in
- 1.2.7
- What to do
- Update WP Editor to 1.2.7 or newer.
Jan 15, 2024Keap Official Opt-in Forms: Does not sanitise and escape some of its settingsCVE-2023-6941 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Keap Official Opt-in Forms
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2024POST SMTP Mailer: Does not properly sanitise and escape several parameters before using them in SQL statementsCVE-2023-6620 · WordPress plugins & themes · reported by WPScanHigh 7.2
The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- POST SMTP Mailer
- Fixed in
- 2.8.7
- What to do
- Update POST SMTP Mailer to 2.8.7 or newer.
Jan 15, 2024WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-6163 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Crowdfunding
- Fixed in
- 2.1.10
- What to do
- Update WP Crowdfunding to 2.1.10 or newer.
Jan 15, 2024Estatik Real Estate: Does not sanitise and escape various parameters and generated URLs before outputting them back in attributesCVE-2023-6050 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Estatik Real Estate
- Fixed in
- 4.1.1
- What to do
- Update Estatik Real Estate to 4.1.1 or newer.
Jan 15, 2024Easy Forms for Mailchimp: Does not sanitise and escape some of its settingsCVE-2023-4925 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Easy Forms for Mailchimp
- Affected
- up to 6.8.10
- What to do
- Affects up to 6.8.10. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2024Email Subscription Popup: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-6555 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Email Subscription Popup
- Fixed in
- 1.2.20
- What to do
- Update Email Subscription Popup to 1.2.20 or newer.
Jan 8, 2024WP Crowdfunding: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-6161 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Crowdfunding
- Fixed in
- 2.1.9
- What to do
- Update WP Crowdfunding to 2.1.9 or newer.
Jan 8, 2024WP Custom Cursors | WordPress Cursor: Does not sanitise and escape some of its settingsCVE-2023-5911 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Custom Cursors | WordPress Cursor
- Affected
- up to 3.2
- What to do
- Affects up to 3.2. Update WP Custom Cursors | WordPress Cursor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 3, 2024POST SMTP: Does not sanitise and escape the msg parameter before outputting it back in the pageCVE-2023-6621 · WordPress plugins & themes · reported by WPScanMedium 6.1
The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- POST SMTP
- Fixed in
- 2.8.7
- What to do
- Update POST SMTP to 2.8.7 or newer.
Jan 1, 2024Html5 Video Player: Does not sanitise and escape some of its player settingsCVE-2023-6485 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins
- Product
- Html5 Video Player
- Fixed in
- 2.5.19
- What to do
- Update Html5 Video Player to 2.5.19 or newer.
Jan 1, 2024WP TripAdvisor Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6037 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP TripAdvisor Review Slider
- Fixed in
- 11.9
- What to do
- Update WP TripAdvisor Review Slider to 11.9 or newer.
Dec 26, 2023JSON Content Importer: Does not sanitise and escape the tab parameter before outputting it back in the pageCVE-2023-6268 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- JSON Content Importer
- Fixed in
- 1.5.4
- What to do
- Update JSON Content Importer to 1.5.4 or newer.
Dec 26, 2023BSK Forms Blacklist: Does not sanitise and escape some of its settingsCVE-2023-5980 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- BSK Forms Blacklist
- Fixed in
- 3.7
- What to do
- Update BSK Forms Blacklist to 3.7 or newer.
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5674 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
- Product
- WP Mail Log
- Fixed in
- 1.1.3
- What to do
- Update WP Mail Log to 1.1.3 or newer.
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5645 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
- Product
- WP Mail Log
- Fixed in
- 1.1.3
- What to do
- Update WP Mail Log to 1.1.3 or newer.
Dec 18, 2023Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro: Does not sanitise and escape some of its settingsCVE-2023-5005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro
- Fixed in
- 3.0
- What to do
- Update Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro to 3.0 or newer.
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not validate and sanitise the `wp_query` parameterCVE-2023-4724 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
- Product
- Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
- Fixed in
- 1.4.0
- What to do
- Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Dec 11, 2023Contact Form Email: Does not sanitise and escape some of its settingsCVE-2023-5955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Contact Form Email
- Fixed in
- 1.3.44
- What to do
- Update Contact Form Email to 1.3.44 or newer.
Dec 11, 2023WP Not Login Hide (WPNLH): Does not sanitise and escape some of its settingsCVE-2023-5940 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Not Login Hide (WPNLH)
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Not Login Hide (WPNLH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 11, 2023WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-5757 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Crowdfunding
- Fixed in
- 2.1.8
- What to do
- Update WP Crowdfunding to 2.1.8 or newer.
Dec 11, 2023EmbedPress: Does not sanitise and escape a parameter before outputting it back in the page containing a specific contentCVE-2023-5750 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EmbedPress
- Fixed in
- 3.9.2
- What to do
- Update EmbedPress to 3.9.2 or newer.
Dec 11, 2023EmbedPress: Does not sanitise and escape user input before outputting it back in the pageCVE-2023-5749 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- EmbedPress
- Fixed in
- 3.9.2
- What to do
- Update EmbedPress to 3.9.2 or newer.
Dec 6, 2023Burst Statistics – Privacy-Friendly Analytics for: SQL InjectionCVE-2023-5761 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 (free) and versions 1.4.0 to 1.5.0 (pro) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Burst Statistics – Privacy-Friendly Analytics for
- Affected
- 1.4.0 to 1.4.6.1
- What to do
- Affects 1.4.0 to 1.4.6.1. Update Burst Statistics – Privacy-Friendly Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 4, 2023WP Fastest Cache: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-6063 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- Product
- WP Fastest Cache
- Fixed in
- 1.2.2
- What to do
- Update WP Fastest Cache to 1.2.2 or newer.
Dec 4, 2023Welcart e-Commerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5951 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Welcart e-Commerce
- Fixed in
- 2.9.5
- What to do
- Update Welcart e-Commerce to 2.9.5 or newer.
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Popup box
- Fixed in
- 3.8.6
- What to do
- Update Popup box to 3.8.6 or newer.
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5809 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Popup box
- Fixed in
- 3.8.6
- What to do
- Update Popup box to 3.8.6 or newer.
Dec 4, 2023AMP+ Plus: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5210 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- AMP+ Plus
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update AMP+ Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 4, 2023BSK Contact Form 7 Blacklist: Does not sanitise and escape the inserted_count parameter before outputting it back in the pageCVE-2023-5141 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- BSK Contact Form 7 Blacklist
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update BSK Contact Form 7 Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 4, 2023Easy Newsletter Signups: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5108 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Easy Newsletter Signups
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Easy Newsletter Signups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.