Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

495new WordPress flaws this week

394,829entries in the database

12,553 results · page 229 of 252

May 19, 2023Groundhogg: Stored Cross-Site ScriptingCVE-2023-2735 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only works with legacy contact forms.
Product
Groundhogg
Affected
up to 2.7.9.8
What to do
Affects up to 2.7.9.8. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2023NetReviews SAS Verified Reviews: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23720 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NetReviews SAS Verified Reviews (Avis Vérifiés) plugin <= 2.3.13 versions.
Product
NetReviews SAS Verified Reviews
Affected
up to 2.3.13
What to do
Affects up to 2.3.13. Update NetReviews SAS Verified Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2023video carousel slider with lightbox: Reflected Cross-Site ScriptingCVE-2023-2710 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32797 may be a duplicate of this.
Product
video carousel slider with lightbox
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update video carousel slider with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
May 15, 2023Video Gallery: Reflected Cross-Site ScriptingCVE-2023-2708 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32597 may be a duplicate of this.
Product
Video Gallery
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
May 10, 2023Yatra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-47436 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Yatra allows Stored XSS.This issue affects Yatra: from n/a through 2.1.14.
Product
Yatra
Affected
up to 2.1.14
What to do
Affects up to 2.1.14. Update Yatra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 10, 2023Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76: Cross-site scriptingCVE-2023-27918 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.
Product
Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76
Fixed in
1.0.76
What to do
Update Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 to 1.0.76 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 9, 2023Sk: Auth. (author+) Stored Cross-Site Scripting (XSS)CVE-2023-23647 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Team Member – Team with Slider plugin <= 4.4 versions.
Product
Sk
Affected
up to 4.4
What to do
Affects up to 4.4. Update Sk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2023Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions.CVE-2023-28493 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions.
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2023Michael Pretty: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-25452 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Pretty (prettyboymp) CMS Press plugin <= 0.2.3 versions.
Product
Michael Pretty
Affected
up to 0.2.3
What to do
Affects up to 0.2.3. Update Michael Pretty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 4, 2023GMO Internet Group, Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-25458 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GMO Internet Group, Inc. TypeSquare Webfonts for ConoHa plugin <= 2.0.3 versions.
Product
GMO Internet Group, Inc
Fixed in
2.0.4
What to do
Update GMO Internet Group, Inc to 2.0.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2023Themis Solutions, Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-22683 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themis Solutions, Inc. Clio Grow plugin <= 1.0.0 versions.
Product
Themis Solutions, Inc
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Themis Solutions, Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.CVE-2023-22691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.
Affected
up to 2.1
What to do
Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2023miniOrange WordPress Social Login and Register: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23710 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.
Product
miniOrange WordPress Social Login and Register
Fixed in
7.6.0
What to do
Update miniOrange WordPress Social Login and Register to 7.6.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2023Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.CVE-2023-27619 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 25, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.CVE-2022-45837 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.
Affected
up to 6.0.1
What to do
Affects up to 6.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <= 2.0.0 versions.CVE-2023-24404 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in VryaSage Marketing Performance plugin <= 2.0.0 versions.
Affected
up to 2.0.0
What to do
Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions.CVE-2023-22718 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Jason Lau User Meta Manager plugin <= 3.4.9 versions.
Fixed in
3.5.0
What to do
Update the plugin to 3.5.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 19, 2023TaxoPress: Stored Cross-Site ScriptingCVE-2023-2170 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TaxoPress
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update TaxoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 19, 2023TaxoPress: Stored Cross-Site ScriptingCVE-2023-2169 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Related Posts functionality in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TaxoPress
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update TaxoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 19, 2023TaxoPress: Stored Cross-Site ScriptingCVE-2023-2168 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The TaxoPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Suggest Terms Title field in versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Editor+ permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
TaxoPress
Affected
up to 3.6.4
What to do
Affects up to 3.6.4. Update TaxoPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 18, 2023W3 Eden, Inc: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2022-45836 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions.
Product
W3 Eden, Inc
Fixed in
3.2.60
What to do
Update W3 Eden, Inc to 3.2.60 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2023Thumbnail carousel slider: Reflected Cross-Site ScriptingCVE-2023-2120 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Thumbnail carousel slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Thumbnail carousel slider
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Thumbnail carousel slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 17, 2023Responsive Filterable Portfolio: Reflected Cross-Site ScriptingCVE-2023-2119 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Responsive Filterable Portfolio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Responsive Filterable Portfolio
Affected
up to 1.0.19
What to do
Affects up to 1.0.19. Update Responsive Filterable Portfolio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 7, 2023Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions.CVE-2023-25716 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gqevu6bsiz Announce from the Dashboard plugin <= 1.5.1 versions.
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023Maps Widget for Google Maps: Stored Cross-Site ScriptingCVE-2023-1913 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Maps Widget for Google Maps for WordPress is vulnerable to Stored Cross-Site Scripting via widget settings in versions up to, and including, 4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Maps Widget for Google Maps
Affected
up to 4.24
What to do
Affects up to 4.24. Update Maps Widget for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 6, 2023Limit Login Attempts: Stored Cross-Site ScriptingCVE-2023-1912 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its lock logging feature in versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page. This only works when the plugin prioritizes use of the X-FORWARDED-FOR header, which can be configured in its settings.
Product
Limit Login Attempts
Affected
up to 1.7.1
What to do
Affects up to 1.7.1. Update Limit Login Attempts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org pluginvulnerabilities.com
Apr 6, 2023E4J s.R.L: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-24396 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.11 versions.
Product
E4J s.R.L
Fixed in
1.5.12
What to do
Update E4J s.R.L to 1.5.12 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023OceanWP Ocean Extra plugin <= 2.1.1 versions: Auth. (contributor+) Stored Cross-Site Scripting (XSS)CVE-2023-23891 · WordPress plugins & themes · reported by PatchstackMedium 5.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated.
Product
OceanWP Ocean Extra plugin <= 2.1.1 versions
Fixed in
2.1.2
What to do
Update OceanWP Ocean Extra plugin <= 2.1.1 versions to 2.1.2 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 6, 2023E4J s.R.L: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23998 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin <= 1.3.0 versions.
Product
E4J s.R.L
Fixed in
1.3.1
What to do
Update E4J s.R.L to 1.3.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 5, 2023YourChannel: Stored Cross-Site ScriptingCVE-2023-1869 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The YourChannel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
YourChannel
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update YourChannel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Apr 4, 2023Sp*tify Play Button for: Stored Cross-Site ScriptingCVE-2023-1840 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Sp*tify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.07 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Sp*tify Play Button for
Affected
up to 2.07
What to do
Affects up to 2.07. Update Sp*tify Play Button for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 30, 2023Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.CVE-2023-23677 · WordPress plugins & themes · reported by PatchstackLow 3.8
Reflected Cross-Site Scripting (XSS) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.5 versions.
Fixed in
0.4.6
What to do
Update the plugin to 0.4.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Collne Inc: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-22705 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Collne Inc. Welcart e-Commerce plugin <= 2.8.10 versions.
Product
Collne Inc
Affected
up to 2.8.10
What to do
Affects up to 2.8.10. Update Collne Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 29, 2023Mega Main Menu: Stored Cross-Site ScriptingCVE-2023-1575 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Mega Main Menu
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update Mega Main Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Mar 28, 2023Unlimited Elements Unlimited Elements For Elementor: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-47170 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.48 versions.
Product
Unlimited Elements Unlimited Elements For Elementor
Fixed in
1.5.49
What to do
Update Unlimited Elements Unlimited Elements For Elementor to 1.5.49 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Klaviyo, Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-25456 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Klaviyo, Inc. Klaviyo plugin <= 3.0.7 versions.
Product
Klaviyo, Inc
Affected
up to 3.0.7
What to do
Affects up to 3.0.7. Update Klaviyo, Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous TypeCVE-2023-23707 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.
Product
Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.CVE-2022-47145 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.
Fixed in
3.5.8
What to do
Update the plugin to 3.5.8 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6: Auth. (admin+) Stored Cross-site Scripting (XSS)CVE-2023-28422 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.
Product
MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6
Fixed in
3.8.7
What to do
Update MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6 to 3.8.7 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 8.1.8 versions.CVE-2023-22704 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 8.1.8 versions.
Affected
up to 8.1.8
What to do
Affects up to 8.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.CVE-2022-47431 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.
Fixed in
2.1.0
What to do
Update the plugin to 2.1.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 22, 2023The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpCVE-2023-28666 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.
Affected
up to 2.1.4.1
What to do
Affects up to 2.1.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the teCVE-2023-28665 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' parameter to the techno_get_products action, which can only be triggered by an authenticated user.
Fixed in
2.2.2
What to do
Update the plugin to 2.2.2 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Mar 22, 2023The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' paramCVE-2023-28664 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 5.4
The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'tax_name' parameter of the mdf_get_tax_options_in_widget action, which can only be triggered by an authenticated user.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tenable.com tenable.com
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.CVE-2022-47591 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.
Affected
up to 3.2.1
What to do
Affects up to 3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.CVE-2023-22682 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.
Affected
up to 1.4.0.1
What to do
Affects up to 1.4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions.CVE-2022-47592 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions.
Affected
up to 0.1
What to do
Affects up to 0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 17, 2023eCommerce Product Catalog: Stored Cross-Site ScriptingCVE-2023-1470 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
eCommerce Product Catalog
Affected
up to 3.3.8
What to do
Affects up to 3.3.8. Update eCommerce Product Catalog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 17, 2023Cross-Site Scripting (XSS) vulnerability in Erin Garscadden GC Testimonials plugin <= 1.3.2 versions.CVE-2022-45817 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Scripting (XSS) vulnerability in Erin Garscadden GC Testimonials plugin <= 1.3.2 versions.
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 17, 2023Stored Cross-Site Scripting (XSS) vulnerability in Fabian von Allmen WP Calendar plugin <= 1.5.3 versions.CVE-2022-45814 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) vulnerability in Fabian von Allmen WP Calendar plugin <= 1.5.3 versions.
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.