Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,938 results · page 21 of 39

Dec 4, 2023Uploading SVG, WEBP and ICO files: Does not sanitise uploaded SVG filesCVE-2023-4460 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
Uploading SVG, WEBP and ICO files
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Uploading SVG, WEBP and ICO files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WordPress Backup & Migration: Does not sanitise and escape some parametersCVE-2023-5738 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
Product
WordPress Backup & Migration
Fixed in
1.4.4
What to do
Update WordPress Backup & Migration to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Martins Free & Easy SEO BackLink Link Building Network: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Martins Free & Easy SEO BackLink Link Building Network
Fixed in
1.2.30
What to do
Update Martins Free & Easy SEO BackLink Link Building Network to 1.2.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WP-UserOnline: Does not sanitise and escape the X-Forwarded-For header before outputting its content on the pageCVE-2023-5560 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.
Product
WP-UserOnline
Fixed in
2.88.3
What to do
Update WP-UserOnline to 2.88.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WordPress Online Booking and Scheduling: Does not sanitise and escape some of its settingsCVE-2023-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WordPress Online Booking and Scheduling
Fixed in
22.5
What to do
Update WordPress Online Booking and Scheduling to 22.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023gAppointments: Does not sanitise and escape some of its settingsCVE-2023-2707 · WordPress plugins & themes · reported by WPScanMedium 4.8
The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
gAppointments
Affected
up to 1.9.5.1
What to do
Affects up to 1.9.5.1. Update gAppointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in WattIsIt PayGreen – Ancienne version plugin <= 4.10.2 versions.CVE-2023-25986 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WattIsIt PayGreen – Ancienne version plugin <= 4.10.2 versions.
Affected
up to 4.10.2
What to do
Affects up to 4.10.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 20, 2023The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauCVE-2023-5640 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection vulnerability.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record devl00p.github.io wpscan.com
Nov 20, 2023Seraphinite Accelerator: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5609 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Seraphinite Accelerator
Fixed in
2.2.29
What to do
Update Seraphinite Accelerator to 2.2.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5343 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
Popup box
Fixed in
3.7.9
What to do
Update Popup box to 3.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023Bonus for Woo: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-5140 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Bonus for Woo
Fixed in
5.8.3
What to do
Update Bonus for Woo to 5.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023PubyDoc: Does not sanitise and escape some of its settingsCVE-2023-4970 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
PubyDoc
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update PubyDoc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023WP Post Popup: Does not sanitise and escape some of its inputsCVE-2023-4808 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Post Popup
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update WP Post Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 6, 2023URL Shortify: Does not sanitise and escape some of its settingsCVE-2023-5605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
URL Shortify
Fixed in
1.7.9.1
What to do
Update URL Shortify to 1.7.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 6, 2023Awesome Support: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5354 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Awesome Support
Fixed in
6.1.5
What to do
Update Awesome Support to 6.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 6, 2023WP Discord Invite: Does not sanitise and escape some of its settingsCVE-2023-5181 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Discord Invite
Fixed in
2.5.2
What to do
Update WP Discord Invite to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 6, 2023History Log by click5: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5082 · WordPress plugins & themes · reported by WPScanHigh 7.2
The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when using the Smash Balloon Social Photo Feed plugin alongside it.
Product
History Log by click5
Fixed in
1.0.13
What to do
Update History Log by click5 to 1.0.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 6, 2023Simple Table Manager: Does not sanitise and escape some of its settingsCVE-2023-4858 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Simple Table Manager
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update Simple Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wpscan.com
Nov 6, 2023Responsive Pricing Table: Does not sanitise and escape some of its settingsCVE-2023-4810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Responsive Pricing Table
Fixed in
5.1.8
What to do
Update Responsive Pricing Table to 5.1.8 or newer.
Full record and what to do →NVD record portswigger.net wpscan.com
Oct 31, 2023CITS Support svg, webp Media and TTF,OTF File Upload: Does not sanitise uploaded SVG filesCVE-2023-5458 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
CITS Support svg, webp Media and TTF,OTF File Upload
Fixed in
3.0
What to do
Update CITS Support svg, webp Media and TTF,OTF File Upload to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023Photos and Files Contest Gallery: Does not sanitise and escape some parametersCVE-2023-5307 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.
Product
Photos and Files Contest Gallery
Fixed in
21.2.8.1
What to do
Update Photos and Files Contest Gallery to 21.2.8.1 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Oct 31, 2023EventPrime: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5238 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.
Product
EventPrime
Fixed in
3.2.0
What to do
Update EventPrime to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 31, 2023EventPrime: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-4250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
EventPrime
Fixed in
3.2.0
What to do
Update EventPrime to 3.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Interactive Contact Form and Multi Step Form Builder: Does not sanitise and escape some parametersCVE-2023-4950 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Interactive Contact Form and Multi Step Form Builder WordPress plugin before 3.4 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks
Product
Interactive Contact Form and Multi Step Form Builder
Fixed in
3.4
What to do
Update Interactive Contact Form and Multi Step Form Builder to 3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023WordPress File Upload: Does not sanitise and escape some of its settingsCVE-2023-4811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks.
Product
WordPress File Upload
Fixed in
4.23.3
What to do
Update WordPress File Upload to 4.23.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Tutor LMS: Does not sanitise and escape some of its settingsCVE-2023-4805 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Tutor LMS
Fixed in
2.3.0
What to do
Update Tutor LMS to 2.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Simple Posts Ticker: Does not sanitise and escape some of its settingsCVE-2023-4725 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Simple Posts Ticker
Fixed in
1.1.6
What to do
Update Simple Posts Ticker to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023WordPress Online Booking and Scheduling: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-4691 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
WordPress Online Booking and Scheduling
Fixed in
22.4
What to do
Update WordPress Online Booking and Scheduling to 22.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023EventON: Does not sanitise and escape some of its settingsCVE-2023-4388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
EventON
Fixed in
2.2
What to do
Update EventON to 2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <= 4.1 versions.CVE-2023-45605 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <= 4.1 versions.
Affected
up to 4.1
What to do
Affects up to 4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 25, 2023Translate WordPress with GTranslate: Does not sanitise and escape some of its settingsCVE-2023-4502 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.
Product
Translate WordPress with GTranslate
Fixed in
3.0.4
What to do
Update Translate WordPress with GTranslate to 3.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023WP Job Portal: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-4490 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
Product
WP Job Portal
Fixed in
2.0.6
What to do
Update WP Job Portal to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023Locatoraid Store Locator: Does not sanitise and escape the lpr-search parameter before outputting it back in the pageCVE-2023-4476 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Locatoraid Store Locator
Fixed in
3.9.24
What to do
Update Locatoraid Store Locator to 3.9.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023Ditty: Does not sanitise and escape some parameters and generated URLs before outputting them back in attributesCVE-2023-4148 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Ditty
Fixed in
3.1.25
What to do
Update Ditty to 3.1.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023FileOrganizer: Does not restrict functionality on multisite instancesCVE-2023-3664 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.
Product
FileOrganizer
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update FileOrganizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023Popup Builder: Does not sanitise and escape some of its settingsCVE-2023-3226 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Popup Builder
Fixed in
4.2.0
What to do
Update Popup Builder to 4.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 19, 2023Serial Codes Generator and Validator with WooCommerce Support: Does not sanitise and escape some of its settingsCVE-2023-4376 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Serial Codes Generator and Validator with WooCommerce Support
Fixed in
2.4.15
What to do
Update Serial Codes Generator and Validator with WooCommerce Support to 2.4.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 19, 2023Leyka: Does not sanitise and escape some of its settingsCVE-2023-2995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Leyka
Fixed in
3.30.4
What to do
Update Leyka to 3.30.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023Min Max Control: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-4270 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Min Max Control
Fixed in
4.6
What to do
Update Min Max Control to 4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023WP Adminify: Does not sanitise and escape some of its settingsCVE-2023-4060 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Adminify
Fixed in
3.1.6
What to do
Update WP Adminify to 3.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023Herd Effects: Does not sanitise and escape some of its settingsCVE-2023-4022 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Herd Effects
Fixed in
5.2.3
What to do
Update Herd Effects to 5.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023gAppointments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2705 · WordPress plugins & themes · reported by WPScanMedium 6.1
The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin
Product
gAppointments
Fixed in
1.10.0
What to do
Update gAppointments to 1.10.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023123.chat: Does not sanitise and escape some of its settingsCVE-2023-4298 · WordPress plugins & themes · reported by WPScanMedium 4.8
The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
123.chat
Fixed in
1.3.1
What to do
Update 123.chat to 1.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Post Timeline: Does not sanitise and escape an invalid nonce before outputting it back in an AJAX responseCVE-2023-4284 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Post Timeline
Fixed in
2.2.6
What to do
Update Post Timeline to 2.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023AI ChatBot: Does not sanitise and escape some of its settingsCVE-2023-4254 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
AI ChatBot
Fixed in
4.7.8
What to do
Update AI ChatBot to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023AI ChatBot: Does not sanitise and escape some of its settingsCVE-2023-4253 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
AI ChatBot
Fixed in
4.7.8
What to do
Update AI ChatBot to 4.7.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Store Locator: Does not sanitise and escape an invalid nonce before outputting it back in an AJAX responseCVE-2023-4151 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Store Locator
Fixed in
1.4.13
What to do
Update Store Locator to 1.4.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Advanced File Manager: Does not adequately authorize its usage on multisite installationsCVE-2023-3814 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.
Product
Advanced File Manager
Fixed in
5.1.1
What to do
Update Advanced File Manager to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2023-3499 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Photo Gallery, Images, Slider in Rbs Image Gallery
Fixed in
3.2.16
What to do
Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023PostX: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3992 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
PostX
Fixed in
3.0.6
What to do
Update PostX to 3.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.