Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,366 results · page 216 of 228
Nov 28, 2022HTML Forms: Does not properly properly escape a parameter before using it in a SQL statementCVE-2022-3689 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
- Product
- HTML Forms
- Fixed in
- 1.3.25
- What to do
- Update HTML Forms to 1.3.25 or newer.
Nov 28, 2022Checkout Field Editor (Checkout Manager) for WooCommerce: Unserializes user input provided via the settingsCVE-2022-3490 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Checkout Field Editor (Checkout Manager) for WooCommerce
- Fixed in
- 1.8.0
- What to do
- Update Checkout Field Editor (Checkout Manager) for WooCommerce to 1.8.0 or newer.
Nov 28, 2022Download: Does not properly validate a user has the required privileges to access a backup's nonce identifierCVE-2021-25059 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.
- Product
- Download
- Fixed in
- 2.0.0
- What to do
- Update Download to 2.0.0 or newer.
Nov 21, 2022The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.CVE-2022-3750 · WordPress plugins & themes · reported by WPScanMedium 4.7
The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.
- Fixed in
- 6.8.7
- What to do
- Update the plugin to 6.8.7 or newer.
Nov 21, 2022DeepL Pro API translation: Discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an externalCVE-2022-3691 · WordPress plugins & themes · reported by WPScanHigh 7.5
The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.
- Product
- DeepL Pro API translation
- Fixed in
- 1.7.5
- What to do
- Update DeepL Pro API translation to 1.7.5 or newer.
Nov 14, 2022ProfileGrid: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-3578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- ProfileGrid
- Fixed in
- 5.1.1
- What to do
- Update ProfileGrid to 5.1.1 or newer.
Nov 14, 2022WPForms Pro: Does not validate its form dataCVE-2022-3574 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.
- Product
- WPForms Pro
- Fixed in
- 1.7.7
- What to do
- Update WPForms Pro to 1.7.7 or newer.
Nov 14, 2022Testimonials WordPress plugin before 2.7, super-testimonial-pro: Do not sanitize and escape its settingsCVE-2022-3539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Testimonials WordPress plugin before 2.7, super-testimonial-pro
- Fixed in
- 2.7
- What to do
- Update Testimonials WordPress plugin before 2.7, super-testimonial-pro to 2.7 or newer.
Nov 8, 2022Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.CVE-2022-42494 · WordPress plugins & themes · reported by PatchstackLow 3
Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress.
- Affected
- up to 4.2.5.1
- What to do
- Affects up to 4.2.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordaioseo.compatchstack.com
Nov 7, 2022Import and export users and customers: Does not properly escape dataCVE-2022-3558 · WordPress plugins & themes · reported by WPScanHigh 8
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
- Product
- Import and export users and customers
- Fixed in
- 1.20.5
- What to do
- Update Import and export users and customers to 1.20.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3537 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
- Product
- Role Based Pricing for WooCommerce
- Fixed in
- 1.6.2
- What to do
- Update Role Based Pricing for WooCommerce to 1.6.2 or newer.
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3536 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blog
- Product
- Role Based Pricing for WooCommerce
- Fixed in
- 1.6.3
- What to do
- Update Role Based Pricing for WooCommerce to 1.6.3 or newer.
Nov 7, 2022WooCommerce Dropshipping: Does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated usersCVE-2022-3481 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
- Product
- WooCommerce Dropshipping
- Fixed in
- 4.4
- What to do
- Update WooCommerce Dropshipping to 4.4 or newer.
Nov 7, 2022Product Stock Manager: Does not have authorisation and proper CSRF checks in multiple AJAX actionsCVE-2022-3451 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options
- Product
- Product Stock Manager
- Fixed in
- 1.0.5
- What to do
- Update Product Stock Manager to 1.0.5 or newer.
Nov 7, 2022Import any XML or CSV File to: Is not properly filteringCVE-2022-3418 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.9
- What to do
- Update Import any XML or CSV File to to 3.6.9 or newer.
Oct 31, 2022Automatic User Roles Switcher: Does not have authorisation and proper CSRF checksCVE-2022-3419 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator
- Product
- Automatic User Roles Switcher
- Fixed in
- 1.1.2
- What to do
- Update Automatic User Roles Switcher to 1.1.2 or newer.
Oct 31, 2022PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro: Unserializes the content of imported filesCVE-2022-3366 · WordPress plugins & themes · reported by WPScanHigh 7.2
The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site.
- Product
- PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro
- Fixed in
- 2.5.2
- What to do
- Update PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro to 2.5.2 or newer.
Oct 31, 2022WordPress Classifieds: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users andCVE-2022-3254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection
- Product
- WordPress Classifieds
- Fixed in
- 4.3
- What to do
- Update WordPress Classifieds to 4.3 or newer.
Oct 25, 2022WP All Export Pro: Uses the contents of the cc_sql POST parameter directlyCVE-2022-3395 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been given permission to run exports to execute arbitrary SQL statements, leading to a SQL Injection vulnerability. By default only users with the Administrator role can perform exports, but this can be delegated to lower privileged users as well.
- Product
- WP All Export Pro
- Fixed in
- 1.7.9
- What to do
- Update WP All Export Pro to 1.7.9 or newer.
Oct 25, 2022WP All Export Pro: Does not limit some functionality during exports only to users with the Administrator roleCVE-2022-3394 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
- Product
- WP All Export Pro
- Fixed in
- 1.7.9
- What to do
- Update WP All Export Pro to 1.7.9 or newer.
Oct 25, 2022Post to CSV by BestWebSoft: Does not properly escape fieldsCVE-2022-3393 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection
- Product
- Post to CSV by BestWebSoft
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Post to CSV by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2022Spam protection, AntiSpam, FireWall by CleanTalk: Does not validate ids before using them in a SQL statementCVE-2022-3302 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statement, which could lead to SQL injection exploitable by high privilege users such as admin
- Product
- Spam protection, AntiSpam, FireWall by CleanTalk
- Fixed in
- 5.185.1
- What to do
- Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.185.1 or newer.
Oct 25, 2022Form Maker by 10Web: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3300 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.6
- What to do
- Update Form Maker by 10Web to 1.15.6 or newer.
Oct 25, 2022Blog2Social: Social Media Auto Post & Scheduler: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3246 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers
- Product
- Blog2Social: Social Media Auto Post & Scheduler
- Fixed in
- 6.9.10
- What to do
- Update Blog2Social: Social Media Auto Post & Scheduler to 6.9.10 or newer.
Oct 17, 2022Drag and Drop Multiple File Upload: Does not properly check for the upload size limit set in formsCVE-2022-3282 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.5 does not properly check for the upload size limit set in forms, taking the value from user input sent when submitting the form. As a result, attackers could control the file length limit and bypass the limit set by admins in the contact form.
- Product
- Drag and Drop Multiple File Upload
- Fixed in
- 1.3.6.5
- What to do
- Update Drag and Drop Multiple File Upload to 1.3.6.5 or newer.
Oct 17, 2022Import all XML, CSV & TXT: Does not properly sanitise and escape imported data before using them back SQL statementsCVE-2022-3243 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
- Product
- Import all XML, CSV & TXT
- Fixed in
- 6.5.8
- What to do
- Update Import all XML, CSV & TXT to 6.5.8 or newer.
Oct 17, 2022WP Custom Cursors: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3150 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users such as admin
- Product
- WP Custom Cursors
- Fixed in
- 3.2
- What to do
- Update WP Custom Cursors to 3.2 or newer.
Oct 17, 2022Search Logger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3131 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Search Logger WordPress plugin through 0.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
- Product
- Search Logger
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Search Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2022Cozmoslabs Profile Builder plugin <= 3.6.0 at: Cross-Site Request Forgery (CSRF)CVE-2021-36915 · WordPress plugins & themes · reported by PatchstackMedium 4.2
Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file and updating the options. Requires Import and Export add-on.
- Product
- Cozmoslabs Profile Builder plugin <= 3.6.0 at
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update Cozmoslabs Profile Builder plugin <= 3.6.0 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Oct 3, 2022Zephyr Project Manager: Does not have any authorisationCVE-2022-2839 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.55
- What to do
- Update Zephyr Project Manager to 3.2.55 or newer.
Sep 30, 2022Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress.CVE-2021-36855 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 30, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress.CVE-2021-36854 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress.
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 26, 2022Post SMTP Mailer/Email Log: Does not have proper authorisation in some AJAX actionsCVE-2022-2352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.7
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.7 or newer.
Sep 26, 2022SVG Support: Does not properly handle SVG added via an URLCVE-2022-1755 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks
- Product
- SVG Support
- Fixed in
- 2.5
- What to do
- Update SVG Support to 2.5 or newer.
Sep 19, 2022NEX-Forms: Does not properly sanitise and escape user input before using it in SQL statementsCVE-2022-3142 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Product
- NEX-Forms
- Fixed in
- 7.9.7
- What to do
- Update NEX-Forms to 7.9.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.commedium.com
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.5
- What to do
- Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 16, 2022Login No Captcha reCAPTCHA: Doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screenCVE-2022-2913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.
- Product
- Login No Captcha reCAPTCHA
- Fixed in
- 1.7
- What to do
- Update Login No Captcha reCAPTCHA to 1.7 or newer.
Sep 16, 2022Titan Anti-spam & Security: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-2877 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- Titan Anti-spam & Security
- Fixed in
- 7.3.1
- What to do
- Update Titan Anti-spam & Security to 7.3.1 or newer.
Sep 16, 2022Classified Listing Pro: Does not escape a generated URL before outputting it back in an attribute in an admin pageCVE-2022-2655 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Classified Listing Pro
- Fixed in
- 2.0.20
- What to do
- Update Classified Listing Pro to 2.0.20 or newer.
Sep 16, 2022Mobile Events Manager: Does not properly escape the Enquiry source fieldCVE-2022-1194 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
- Product
- Mobile Events Manager
- Fixed in
- 1.4.8
- What to do
- Update Mobile Events Manager to 1.4.8 or newer.
Sep 6, 2022WP Cerber Security: Security protection bypassCVE-2022-2939 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author' parameter found in the ~/cerber-load.php file. In vulnerable versions, the plugin only blocks requests if the value supplied is numeric, making it possible for attackers to supply additional non-numeric characters to bypass the protection. The non-numeric characters are stripped and the user requested is displayed. This can be used by unauthenticated attackers to gather information about users that can targeted in further attacks.
- Product
- WP Cerber Security
- Affected
- up to 9.0
- What to do
- Affects up to 9.0. Update WP Cerber Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 5, 2022Visual Portfolio, Photo Gallery & Post Grid: Does not have proper authorisation checks in some of its REST endpointsCVE-2022-2597 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts
- Product
- Visual Portfolio, Photo Gallery & Post Grid
- Fixed in
- 2.19.0
- What to do
- Update Visual Portfolio, Photo Gallery & Post Grid to 2.19.0 or newer.
Sep 5, 2022Visual Portfolio, Photo Gallery & Post Grid: Does not have proper authorisation checks in some of its REST endpointsCVE-2022-2543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts
- Product
- Visual Portfolio, Photo Gallery & Post Grid
- Fixed in
- 2.18.0
- What to do
- Update Visual Portfolio, Photo Gallery & Post Grid to 2.18.0 or newer.
Aug 29, 2022Fluent Support: Does not properly sanitiseCVE-2022-2559 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection vulnerability exploitable by high privilege users
- Product
- Fluent Support
- Fixed in
- 1.5.8
- What to do
- Update Fluent Support to 1.5.8 or newer.
Aug 29, 2022Sensei LMS: Does not have proper permissions set in one of its REST endpointCVE-2022-2034 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
- Product
- Sensei LMS
- Fixed in
- 4.5.0
- What to do
- Update Sensei LMS to 4.5.0 or newer.
Full record and what to do →NVD recordhackerone.comwpscan.com
Aug 29, 2022Stop Spam Comments: Does not properly generate the Javascript access token for preventing abuse of comment sectionCVE-2022-1663 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request.
- Product
- Stop Spam Comments
- Affected
- up to 0.2.1.2
- What to do
- Affects up to 0.2.1.2. Update Stop Spam Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2022Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps): Does not properly sanitize some parameters before inserting them into SQL queriesCVE-2022-1123 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks.
- Product
- Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)
- Fixed in
- 3.12.5
- What to do
- Update Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) to 3.12.5 or newer.
Aug 23, 2022Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.CVE-2022-36282 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Roman Pronskiy's Search Exclude plugin <= 1.2.6 at WordPress.
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 22, 2022Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPressCVE-2022-34857 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in smartypants SP Project & Document Manager plugin <= 4.59 at WordPress
- Affected
- up to 4.59
- What to do
- Affects up to 4.59. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 22, 2022Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro: Allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form aCVE-2022-2594 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated users to upload files allowed in a default WP configuration (so PHP is not possible) if there is a frontend form available. This vulnerability was introduced in the 5.0 rewrite and did not exist prior to that release.
- Product
- Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro
- Fixed in
- 5.12.3
- What to do
- Update Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro to 5.12.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.