Updated 6 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

460new WordPress flaws this week

394,717entries in the database

12,538 results · page 230 of 251

Mar 3, 2023Watu Quiz: Reflected Cross-Site ScriptingCVE-2023-0968 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Watu Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘dn’, 'email', 'points', and 'date' parameters in versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Watu Quiz
Affected
up to 3.3.9
What to do
Affects up to 3.3.9. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 2, 2023Metform Elementor Contact Form Builder: Stored Cross-Site ScriptingCVE-2023-0084 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Mar 2, 2023Cost Calculator: Stored Cross-Site ScriptingCVE-2023-1155 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cost Calculator
Affected
up to 1.8
What to do
Affects up to 1.8. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Feb 28, 2023GN Publisher: Reflected Cross-Site ScriptingCVE-2023-1080 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
GN Publisher
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update GN Publisher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 24, 2023All in One SEO Pack: Stored Cross-Site ScriptingCVE-2023-0586 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All in One SEO Pack
Affected
up to 4.2.9
What to do
Affects up to 4.2.9. Update All in One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 24, 2023All in One SEO Pack: Stored Cross-Site ScriptingCVE-2023-0585 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
All in One SEO Pack
Affected
up to 4.2.9
What to do
Affects up to 4.2.9. Update All in One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 21, 2023Japanized For WooCommerce: Reflected Cross-Site ScriptingCVE-2023-0942 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Japanized For WooCommerce
Affected
up to 2.5.4
What to do
Affects up to 2.5.4. Update Japanized For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 7, 2023Interactive Geo Maps: Stored Cross-Site ScriptingCVE-2023-0731 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Interactive Geo Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the action content parameter in versions up to, and including, 1.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Interactive Geo Maps
Affected
up to 1.5.9
What to do
Affects up to 1.5.9. Update Interactive Geo Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 27, 2023Quick Restaurant Menu: Stored Cross-Site ScriptingCVE-2023-0553 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Quick Restaurant Menu
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Quick Restaurant Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 26, 2023The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vuCVE-2023-0448 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.1
The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.
Fixed in
4.3
What to do
Update the plugin to 4.3 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Jan 23, 2023My YouTube Channel: Stored Cross-Site ScriptingCVE-2023-0446 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
My YouTube Channel
Affected
up to 3.0.12.1
What to do
Affects up to 3.0.12.1. Update My YouTube Channel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 20, 2023The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qemCVE-2023-23491 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.1
The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action.
Fixed in
9.7.5
What to do
Update the plugin to 9.7.5 or newer.
Full record and what to do →NVD record tenable.com tenable.com
Jan 14, 2023Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.CVE-2022-38467 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver.
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 13, 2023Launchpad: Stored Cross-Site ScriptingCVE-2023-0295 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Launchpad
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Launchpad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023CPO Companion: Stored Cross-Site ScriptingCVE-2023-0162 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its content type settings parameters in versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CPO Companion
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update CPO Companion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 10, 2023Royal Elementor Addons: Reflected Cross-Site ScriptingCVE-2022-4710 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the 'data_fetch' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is occurring because 'sanitize_text_field' is insufficient to prevent attribute-based Cross-Site Scripting
Product
Royal Elementor Addons
Affected
up to 1.3.59
What to do
Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 5, 2023Swifty Page Manager: Stored Cross-Site ScriptingCVE-2023-0087 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Swifty Page Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘spm_plugin_options_page_tree_max_width’ parameter in versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Swifty Page Manager
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Swifty Page Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 3, 2023Survey Maker – Best WordPress Survey: Stored Cross-Site ScriptingCVE-2023-0038 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The "Survey Maker – Best WordPress Survey Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via survey answers in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts when submitting quizzes that will execute whenever a user accesses the submissions page.
Product
Survey Maker – Best WordPress Survey
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update Survey Maker – Best WordPress Survey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 3, 2023Members Import: Self Cross-Site ScriptingCVE-2022-4663 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site's administrator into uploading a CSV file with the malicious payload.
Product
Members Import
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update Members Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 23, 2022ProfilePress: Stored Cross-Site ScriptingCVE-2022-4698 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ProfilePress
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 23, 2022ProfilePress: Stored Cross-Site ScriptingCVE-2022-4697 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ProfilePress
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 20, 2022Sidebar Widgets by CodeLights: Stored Cross-Site ScriptingCVE-2022-4619 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Sidebar Widgets by CodeLights
Affected
up to 1.4
What to do
Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 15, 2022WP User: Stored Cross-Site ScriptingCVE-2022-4519 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP User
Affected
up to 7.0
What to do
Affects up to 7.0. Update WP User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 14, 2022Permalink Manager Lite: Stored Cross-Site ScriptingCVE-2022-4410 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output escaping on post/page/media titles. This makes it possible for attackers to inject arbitrary web scripts on the permalink-manager page if another plugin or theme is installed on the site that allows lower privileged users with unfiltered_html the ability to modify post/page titles with malicious web scripts.
Product
Permalink Manager Lite
Affected
up to 2.2.20.3
What to do
Affects up to 2.2.20.3. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2022Image Hover Effects Ultimate: Stored Cross-Site ScriptingCVE-2022-4207 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.
Product
Image Hover Effects Ultimate
Affected
9.8.1 to 9.8.4
What to do
Affects 9.8.1 to 9.8.4. Update Image Hover Effects Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 12, 2022WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log: Does not have proper authorisation and CSRF in an AJAX actionCVE-2022-3881 · WordPress plugins & themes · reported by WPScanMedium 5.7
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org
Product
WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log
Fixed in
3.43
What to do
Update WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log to 3.43 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Cross-site Scripting (XSS) is a client-side code injection attack.CVE-2022-3853 · WordPress plugins & themes · reported by WPScanMedium 5.4
Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application.
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2022WordPress versions prior to 6.0.3: Cross-site scriptingCVE-2022-43500 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
Product
WordPress versions prior to 6.0.3
What to do
Update WordPress versions prior to 6.0.3 to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 4, 2022WordPress versions prior to 6.0.3: Cross-site scriptingCVE-2022-43497 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
Product
WordPress versions prior to 6.0.3
What to do
Update WordPress versions prior to 6.0.3 to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 4, 2022Salon booking system versions prior to 7.9: Cross-site scriptingCVE-2022-43487 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script.
Product
Salon booking system versions prior to 7.9
Fixed in
7.9
What to do
Update Salon booking system versions prior to 7.9 to 7.9 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 4, 2022Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress.CVE-2022-40968 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress.
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 2, 2022Chained Quiz: Stored Cross-Site ScriptingCVE-2022-4217 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Chained Quiz
Affected
up to 1.3.2.2
What to do
Affects up to 1.3.2.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Stored Cross-Site ScriptingCVE-2022-4216 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Chained Quiz
Affected
up to 1.3.2.2
What to do
Affects up to 1.3.2.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4215 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2.3
What to do
Affects up to 1.3.2.3. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4214 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2.3
What to do
Affects up to 1.3.2.3. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4213 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2.2
What to do
Affects up to 1.3.2.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4212 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4211 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4210 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4209 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4208 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Nov 29, 2022Simple:Press: Reflected Cross-Site ScriptingCVE-2022-4029 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This would be highly complex to exploit as it would require the attacker to set the cookie a cookie for the targeted user.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Simple:Press: Stored Cross-Site ScriptingCVE-2022-4028 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to inject arbitrary web scripts in pages when modifying a profile signature that will execute whenever a user accesses an injected page.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Simple:Press: Stored Cross-Site ScriptingCVE-2022-4027 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when responding to forum threads that will execute whenever a user accesses an injected page.
Product
Simple:Press
Affected
up to 6.8
What to do
Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022Photospace Gallery: Stored Cross-Site ScriptingCVE-2022-3991 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Photospace Gallery
Affected
up to 2.3.5
What to do
Affects up to 2.3.5. Update Photospace Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 29, 2022WP Affiliate Platform: Stored Cross-Site ScriptingCVE-2022-3897 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Affiliate Platform
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tipsandtricks-hq.com wordfence.com
Nov 29, 2022WP Affiliate Platform: Reflected Cross-Site ScriptingCVE-2022-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is unlikely to work in modern browsers.
Product
WP Affiliate Platform
Affected
up to 6.3.9
What to do
Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record tipsandtricks-hq.com wordfence.com
Nov 18, 2022Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.CVE-2022-41615 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.CVE-2022-40695 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.
Affected
up to 8.9
What to do
Affects up to 8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 18, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.CVE-2022-38075 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
Affected
up to 0.13
What to do
Affects up to 0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.