Updated 7 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

35added in the last 30 days

357new WordPress flaws this week

394,273entries in the database

11,366 results · page 210 of 228

Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.CVE-2023-45048 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.
Affected
up to 5.00
What to do
Affects up to 5.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Moriyan Jay WP Site Protector plugin <= 2.0 versions.CVE-2023-44237 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Moriyan Jay WP Site Protector plugin <= 2.0 versions.
Affected
up to 2.0
What to do
Affects up to 2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 6, 2023Profile Extra Fields by BestWebSoft: Unauthorized access of dataCVE-2023-4469 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to expose potentially sensitive user data, including data entered into custom fields.
Product
Profile Extra Fields by BestWebSoft
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Profile Extra Fields by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 5, 2023A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress.CVE-2015-10125 · WordPress plugins & themes · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability.
Fixed in
3.7.3
What to do
Update the plugin to 3.7.3 or newer.
Full record and what to do →NVD record github.com github.com
Oct 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.CVE-2023-25025 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 4, 2023Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.CVE-2023-37995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Chetan Gole WP-CopyProtect [Protect your blog posts] plugin <= 3.1.0 versions.
Affected
up to 3.1.0
What to do
Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023WP Mail SMTP Pro: Unauthorized access of dataCVE-2023-3213 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to disclose potentially sensitive email information.
Product
WP Mail SMTP Pro
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update WP Mail SMTP Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpmailsmtp.com wordfence.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions.CVE-2023-40212 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions.
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <= 2.1.4 versions.CVE-2023-37990 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <= 2.1.4 versions.
Affected
up to 2.1.4
What to do
Affects up to 2.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 2, 2023Rescue Shortcodes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-41728 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through 2.5.
Product
Rescue Shortcodes
Affected
up to 2.5
What to do
Affects up to 2.5. Update Rescue Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 25, 2023Pepro Dev: Unauth. Stored Cross-Site Scripting (XSS)CVE-2023-41863 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Pepro Dev. Group PeproDev CF7 Database plugin <= 1.7.0 versions.
Product
Pepro Dev
Fixed in
1.8.0
What to do
Update Pepro Dev to 1.8.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 25, 2023DoLogin Security: Does not properly sanitize IP addresses coming from the X-Forwarded-For headerCVE-2023-4549 · WordPress plugins & themes · reported by WPScanMedium 6.1
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
Product
DoLogin Security
Fixed in
3.7
What to do
Update DoLogin Security to 3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 25, 2023All in One B2B for WooCommerce: Does not properly check nonce values in several actionsCVE-2023-3547 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks.
Product
All in One B2B for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update All in One B2B for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023URL Shortify: Does not properly escape the value of the referer headerCVE-2023-4294 · WordPress plugins & themes · reported by WPScanMedium 6.1
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.
Product
URL Shortify
Fixed in
1.7.6
What to do
Update URL Shortify to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 11, 2023MasterStudy LMS: Does not have proper checks in place during registration allowing anyone to register on the siteCVE-2023-4278 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
Product
MasterStudy LMS
Fixed in
3.0.18
What to do
Update MasterStudy LMS to 3.0.18 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Sep 4, 2023User Activity Log: Lacks proper authorisationCVE-2023-4269 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email addresses.
Product
User Activity Log
Fixed in
1.6.6
What to do
Update User Activity Log to 1.6.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Profile Builder: Lacks authorisation and CSRF in its page creation functionCVE-2023-4059 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
Product
Profile Builder
Fixed in
3.9.8
What to do
Update Profile Builder to 3.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 4, 2023Media from FTP: Does not properly limit who can use the pluginCVE-2023-4019 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.
Product
Media from FTP
Fixed in
11.17
What to do
Update Media from FTP to 11.17 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 31, 2023Order Tracking Pro: Stored Cross-Site ScriptingCVE-2023-4500 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers (admin or higher) to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Order Tracking Pro
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Order Tracking Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Aug 31, 2023Order Tracking Pro: Reflected Cross-Site ScriptingCVE-2023-4471 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Order Tracking Pro
Affected
up to 3.3.6
What to do
Affects up to 3.3.6. Update Order Tracking Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023WP Project Manager: Privilege escalationCVE-2023-3636 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'usernames' parameter.
Product
WP Project Manager
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 31, 2023ProfileGrid: Unauthorized decryption of private informationCVE-2023-3404 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to the passphrase and iv being hardcoded in the 'pm_encrypt_decrypt_pass' function and used across all sites running the plugin. This makes it possible for authenticated attackers, with administrator-level permissions or above to decrypt and view users' passwords. If combined with another vulnerability, this can potentially grant lower-privileged users access to users' passwords.
Product
ProfileGrid
Affected
up to 5.5.0
What to do
Affects up to 5.5.0. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2023User Activity Tracking and Log: Does not have proper CSRF checksCVE-2023-4150 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
Product
User Activity Tracking and Log
Fixed in
4.0.9
What to do
Update User Activity Tracking and Log to 4.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 30, 2023GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent): Does not have proper CSRF checksCVE-2023-4013 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) WordPress plugin before 4.12.5 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
Product
GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent)
Fixed in
4.12.5
What to do
Update GDPR Cookie Compliance (CCPA, DSGVO, Cookie Consent) to 4.12.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 21, 2023Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7: Cross-site scriptingCVE-2023-40068 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.4
Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.
Product
Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7
What to do
Update Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Aug 18, 2023Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager ProfesCVE-2023-31218 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.6 versions.
Fixed in
1.0.7
What to do
Update the plugin to 1.0.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 16, 2023Ko-fi Button: Does not properly some of its settingsCVE-2023-2254 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ko-fi Button WordPress plugin before 1.3.3 does not properly some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup), and we consider it a low risk.
Product
Ko-fi Button
Fixed in
1.3.3
What to do
Update Ko-fi Button to 1.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2023REST API TO MiniProgram: Does not have authorisation and CSRF checks in an AJAX actionCVE-2023-0551 · WordPress plugins & themes · reported by WPScanMedium 5.4
The REST API TO MiniProgram WordPress plugin through 4.6.1 does not have authorisation and CSRF checks in an AJAX action, allowing ay authenticated users, such as subscriber to call and delete arbitrary attachments
Product
REST API TO MiniProgram
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update REST API TO MiniProgram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 12, 2023Premium Packages - Sell Digital Products Securely: Privilege escalationCVE-2023-4293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
Product
Premium Packages - Sell Digital Products Securely
Affected
up to 5.7.4
What to do
Affects up to 5.7.4. Update Premium Packages - Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 10, 2023brandiD Social Proof: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-24389 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in brandiD Social Proof (Testimonial) Slider plugin <= 2.2.3 versions.
Product
brandiD Social Proof
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update brandiD Social Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 7, 2023Quiz And Survey Master: Does not properly sanitize and escape question titlesCVE-2023-3575 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quiz And Survey Master WordPress plugin before 8.1.11 does not properly sanitize and escape question titles, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Quiz And Survey Master
Fixed in
8.1.11
What to do
Update Quiz And Survey Master to 8.1.11 or newer.
Full record and what to do →NVD record wpscan.com onvio.nl
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not properly sanitize and escape a parameter before using it in an SQL statementCVE-2023-2843 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Product
MultiParcels Shipping For WooCommerce
Fixed in
1.14.15
What to do
Update MultiParcels Shipping For WooCommerce to 1.14.15 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 31, 2023LMS by Masteriyo: Does not have proper authorization in one some of its REST API endpointsCVE-2023-3345 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students
Product
LMS by Masteriyo
Fixed in
1.6.8
What to do
Update LMS by Masteriyo to 1.6.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 31, 2023Forminator: Does not properly escape values that are being reflected inside form fields that use pre-populated query parametersCVE-2023-3134 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
Product
Forminator
Fixed in
1.24.4
What to do
Update Forminator to 1.24.4 or newer.
Full record and what to do →NVD record wpscan.com onvio.nl
Jul 31, 2023Twittee Text Tweet: Does not properly escape POST valuesCVE-2023-0602 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.
Product
Twittee Text Tweet
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Twittee Text Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions.CVE-2023-36502 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cththemes Balkon plugin <= 1.3.2 versions.
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 24, 2023User Activity Log: Does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pagesCVE-2023-2761 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
Product
User Activity Log
Fixed in
1.6.3
What to do
Update User Activity Log to 1.6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 18, 2023A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic.CVE-2021-4428 · WordPress plugins & themes · reported by VulDBLow 2.7
A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.
Product
what3words Autosuggest
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update what3words Autosuggest to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Jul 18, 2023OAuth Single Sign On – SSO (OAuth Client): Improper AuthenticationCVE-2022-34155 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3.
Product
OAuth Single Sign On – SSO (OAuth Client)
Affected
up to 6.23.3
What to do
Affects up to 6.23.3. Update OAuth Single Sign On – SSO (OAuth Client) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes patchstack.com
Jul 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Smart YouTube PRO plugin <= 4.3 versions.CVE-2023-25475 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Smart YouTube PRO plugin <= 4.3 versions.
Affected
up to 4.3
What to do
Affects up to 4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 17, 2023ProfileGrid: Unauthorized modification of dataCVE-2023-3714 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attackers, with group ownership, to update group options, including the 'associate_role' parameter, which defines the member's role. This issue was partially patched in version 5.5.2 preventing privilege escalation, however, it was fully patched in 5.5.3.
Product
ProfileGrid
Affected
up to 5.5.2
What to do
Affects up to 5.5.2. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2023ProfileGrid: Unauthorized modification of dataCVE-2023-3713 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. This can be used by attackers to achieve privilege escalation.
Product
ProfileGrid
Affected
up to 5.5.1
What to do
Affects up to 5.5.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2023ProfileGrid: Unauthorized modification of dataCVE-2023-3403 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to import new users and update existing users.
Product
ProfileGrid
Affected
up to 5.5.1
What to do
Affects up to 5.5.1. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 17, 2023Popup by Supsystic: Has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into ObjectCVE-2023-3186 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.
Product
Popup by Supsystic
Fixed in
1.10.19
What to do
Update Popup by Supsystic to 1.10.19 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023POST SMTP Mailer: Does not have proper CSRF checks in some AJAX actionsCVE-2023-3179 · WordPress plugins & themes · reported by WPScanHigh 8.8
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
Product
POST SMTP Mailer
Fixed in
2.5.7
What to do
Update POST SMTP Mailer to 2.5.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2023AN_GradeBook: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2636 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
Product
AN_GradeBook
Affected
up to 5.0.1
What to do
Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jul 17, 2023Login Configurator: Does not properly escape a URL parameter before outputting it to the pageCVE-2023-1893 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
Product
Login Configurator
Affected
up to 2.1
What to do
Affects up to 2.1. Update Login Configurator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jul 17, 20233DPrint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-4023 · WordPress plugins & themes · reported by WPScanMedium 5.3
The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.
Product
3DPrint
Fixed in
3.5.6.9
What to do
Update 3DPrint to 3.5.6.9 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Jul 12, 2023Process Steps Template Designer: Cross-Site Request ForgeryCVE-2021-4413 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Process Steps Template Designer
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Process Steps Template Designer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <CVE-2023-37391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <= 3.4.1 versions.
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.