Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

486new WordPress flaws this week

395,358entries in the database

15,572 results · page 250 of 312

Jan 31, 2024HD Quiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22161 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harmonic Design HD Quiz allows Stored XSS.This issue affects HD Quiz: from n/a through 1.8.11.
Product
HD Quiz
Affected
up to 1.8.11
What to do
Affects up to 1.8.11. Update HD Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Image Tag Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22160 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bradley B. Dalina Image Tag Manager allows Reflected XSS.This issue affects Image Tag Manager: from n/a through 1.5.
Product
Image Tag Manager
Affected
up to 1.5
What to do
Affects up to 1.5. Update Image Tag Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Formzu WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22310 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formzu Inc. Formzu WP allows Stored XSS.This issue affects Formzu WP: from n/a through 1.6.7.
Product
Formzu WP
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update Formzu WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024WP-Lister Lite for eBay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22307 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.5.7.
Product
WP-Lister Lite for eBay
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Mang Board WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22306 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hometory Mang Board WP allows Stored XSS.This issue affects Mang Board WP: from n/a through 1.7.7.
Product
Mang Board WP
Affected
up to 1.7.7
What to do
Affects up to 1.7.7. Update Mang Board WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Albo Pretorio On line: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22302 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignazio Scimone Albo Pretorio On line allows Stored XSS.This issue affects Albo Pretorio On line: from n/a through 4.6.6.
Product
Albo Pretorio On line
Affected
up to 4.6.6
What to do
Affects up to 4.6.6. Update Albo Pretorio On line to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024PDF Poster – PDF Embedder Plugin for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-23508 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17.
Product
PDF Poster – PDF Embedder Plugin for
Affected
up to 2.1.17
What to do
Affects up to 2.1.17. Update PDF Poster – PDF Embedder Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024PDF Viewer & 3D PDF Flipbook – DearPDF: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-23505 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive PDF Viewer & 3D PDF Flipbook – DearPDF allows Stored XSS.This issue affects PDF Viewer & 3D PDF Flipbook – DearPDF: from n/a through 2.0.38.
Product
PDF Viewer & 3D PDF Flipbook – DearPDF
Affected
up to 2.0.38
What to do
Affects up to 2.0.38. Update PDF Viewer & 3D PDF Flipbook – DearPDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Posts List Designer by Category – List Category Posts Or Recent Posts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-23502 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in InfornWeb Posts List Designer by Category – List Category Posts Or Recent Posts allows Stored XSS.This issue affects Posts List Designer by Category – List Category Posts Or Recent Posts: from n/a through 3.3.2.
Product
Posts List Designer by Category – List Category Posts Or Recent Posts
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update Posts List Designer by Category – List Category Posts Or Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 30, 2024UserPro: Stored Cross-Site ScriptingCVE-2023-2439 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
UserPro
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jan 30, 2024MapPress Maps for: Stored Cross-Site ScriptingCVE-2023-7225 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MapPress Maps for
Affected
up to 2.88.16
What to do
Affects up to 2.88.16. Update MapPress Maps for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Jan 29, 2024EventON: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-7200 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EventON
Fixed in
4.4.1
What to do
Update EventON to 4.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024TJ Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6530 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
TJ Shortcodes
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update TJ Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Jan 29, 2024Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: Does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the pageCVE-2023-6278 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
Fixed in
2.2.25
What to do
Update Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo to 2.2.25 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024Restrict Usernames Emails Characters: Does not sanitise and escape some of its settingsCVE-2023-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Restrict Usernames Emails Characters
Fixed in
3.1.4
What to do
Update Restrict Usernames Emails Characters to 3.1.4 or newer.
Full record and what to do →NVD record github.com wpscan.com
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5956 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Wp-Adv-Quiz
Affected
up to 1.0.2
What to do
Affects up to 1.0.2. Update Wp-Adv-Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024Wp-Adv-Quiz: Does not sanitise and escape some of its settingsCVE-2023-5943 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
Wp-Adv-Quiz
Fixed in
1.0.3
What to do
Update Wp-Adv-Quiz to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 29, 2024Page Builder: Pagelayer: Doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer codeCVE-2023-5124 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder: Pagelayer WordPress plugin before 1.8.0 doesn't prevent attackers with administrator privileges from inserting malicious JavaScript inside a post's header or footer code, even when unfiltered_html is disallowed, such as in multi-site WordPress configurations.
Product
Page Builder: Pagelayer
Fixed in
1.8.0
What to do
Update Page Builder: Pagelayer to 1.8.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 27, 2024Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: Stored Cross-Site ScriptingCVE-2024-0618 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via imported form titles in all versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms
Affected
up to 5.1.5
What to do
Affects up to 5.1.5. Update Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Jan 27, 2024Exclusive Addons for Elementor: Stored Cross-Site ScriptingCVE-2024-0824 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Anything functionality in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Exclusive Addons for Elementor
Affected
up to 2.6.8
What to do
Affects up to 2.6.8. Update Exclusive Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2024Meks Smart Social Widget: Stored Cross-Site ScriptingCVE-2024-0664 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Meks Smart Social Widget in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Meks Smart Social Widget
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update Meks Smart Social Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 26, 2024WordPress Simple Shopping Cart: Stored Cross-Site ScriptingCVE-2023-6497 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatic redirect URL setting in all versions up to and including 4.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WordPress Simple Shopping Cart
Affected
up to 4.7.1
What to do
Affects up to 4.7.1. Update WordPress Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2024WPFront Notification Bar: Stored Cross-Site ScriptingCVE-2024-0625 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WPFront Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpfront-notification-bar-options[custom_class]’ parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WPFront Notification Bar
Affected
up to 3.3.2
What to do
Affects up to 3.3.2. Update WPFront Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 24, 2024WebSub (FKA. PubSubHubbub): Stored Cross-Site ScriptingCVE-2024-0688 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The "WebSub (FKA. PubSubHubbub)" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WebSub (FKA. PubSubHubbub)
Affected
up to 3.1.4
What to do
Affects up to 3.1.4. Update WebSub (FKA. PubSubHubbub) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2024WP Go Maps (formerly WP Google Maps): Reflected Cross-Site ScriptingCVE-2023-6697 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the map id parameter in all versions up to, and including, 9.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Go Maps (formerly WP Google Maps)
Affected
up to 9.0.28
What to do
Affects up to 9.0.28. Update WP Go Maps (formerly WP Google Maps) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 24, 2024WP Customer Area: Reflected Cross-Site ScriptingCVE-2024-0665 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Customer Area plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Customer Area
Affected
up to 8.2.1
What to do
Affects up to 8.2.1. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 23, 2024Sticky Buttons – floating buttons builder: Stored Cross-Site ScriptingCVE-2024-0703 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Sticky Buttons – floating buttons builder
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Sticky Buttons – floating buttons builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 23, 2024AMP for WP – Accelerated Mobile Pages: Reflected Cross-Site ScriptingCVE-2024-0587 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' parameter in all versions up to, and including, 1.0.92.1 due to insufficient input sanitization and output escaping on the executed JS file. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
AMP for WP – Accelerated Mobile Pages
Affected
up to 1.0.92.1
What to do
Affects up to 1.0.92.1. Update AMP for WP – Accelerated Mobile Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 22, 2024Meris: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2023-7194 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Meris
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Meris to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 22, 2024EventON-RSVP: Does not sanitise and escape some parameters before outputting it back in the pageCVE-2023-7170 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EventON-RSVP
Fixed in
2.9.5
What to do
Update EventON-RSVP to 2.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 22, 2024Import any XML or CSV File to: Accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file typeCVE-2023-7082 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.
Product
Import any XML or CSV File to
Fixed in
3.7.3
What to do
Update Import any XML or CSV File to to 3.7.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 22, 2024Product Enquiry for WooCommerce: Does not sanitise and escape some of its settingsCVE-2023-6626 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Product Enquiry for WooCommerce
Fixed in
3.1
What to do
Update Product Enquiry for WooCommerce to 3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 22, 2024WP Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6456 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Review Slider
Fixed in
13.0
What to do
Update WP Review Slider to 13.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 22, 2024SEOPress: Does not sanitise and escape some of its settingsCVE-2023-6290 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
SEOPress
Fixed in
7.3
What to do
Update SEOPress to 7.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 20, 2024WPForms Pro: Stored Cross-Site ScriptingCVE-2023-7063 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPForms Pro
Affected
up to 1.8.5.3
What to do
Affects up to 1.8.5.3. Update WPForms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpforms.com wordfence.com
Jan 18, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2024-0381 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 18, 2024WP Recipe Maker: Reflected Cross-Site ScriptingCVE-2023-6970 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 18, 2024WP Recipe Maker: Stored Cross-Site ScriptingCVE-2023-6958 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Recipe Maker
Affected
up to 9.1.0
What to do
Affects up to 9.1.0. Update WP Recipe Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 16, 2024Contact Form 7 Connector: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0239 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Connector WordPress plugin before 1.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against administrators.
Product
Contact Form 7 Connector
Fixed in
1.2.3
What to do
Update Contact Form 7 Connector to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Do not properly sanitise and escape a parameter before outputting it back in pagesCVE-2024-0233 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EventON WordPress plugin before 4.5.5, EventON
Fixed in
4.5.5
What to do
Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Community by PeepSo: Does not sanitise and escape various parameters and generated URLs before outputting them back attributesCVE-2024-0187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Community by PeepSo
Fixed in
6.3.1.2
What to do
Update Community by PeepSo to 6.3.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Hubbub Lite (formerly Grow Social): Does not sanitise and escape some of its settingsCVE-2023-7154 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hubbub Lite (formerly Grow Social) WordPress plugin before 1.32.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Hubbub Lite (formerly Grow Social)
Fixed in
1.32.0
What to do
Update Hubbub Lite (formerly Grow Social) to 1.32.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Product Enquiry for WooCommerce: Does not sanitise and escape the page parameter before outputting it back in an attributeCVE-2023-7151 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Enquiry for WooCommerce WordPress plugin before 3.2 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Product Enquiry for WooCommerce
Fixed in
3.2
What to do
Update Product Enquiry for WooCommerce to 3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Voting Record: Is missing sanitisationCVE-2023-7084 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks
Product
Voting Record
Affected
up to 2.0
What to do
Affects up to 2.0. Update Voting Record to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 16, 2024Voting Record: Does not have CSRF check in some placesCVE-2023-7083 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Product
Voting Record
Affected
up to 2.0
What to do
Affects up to 2.0. Update Voting Record to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 16, 2024Ultimate Maps by Supsystic: Does not sanitise and escape some of its settingsCVE-2023-6732 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Maps by Supsystic WordPress plugin before 1.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Ultimate Maps by Supsystic
Fixed in
1.2.16
What to do
Update Ultimate Maps by Supsystic to 1.2.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024FastDup: Does not prevent directory listing in sensitive directories containing export filesCVE-2023-6592 · WordPress plugins & themes · reported by WPScanMedium 5.3
The FastDup WordPress plugin before 2.2 does not prevent directory listing in sensitive directories containing export files.
Product
FastDup
Fixed in
2.2
What to do
Update FastDup to 2.2 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Jan 16, 2024ArtPlacer Widget: Does not sanitize and escape the "id" parameter before submitting the queryCVE-2023-6373 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ArtPlacer Widget WordPress plugin before 2.20.7 does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor (or above)
Product
ArtPlacer Widget
Fixed in
2.20.7
What to do
Update ArtPlacer Widget to 2.20.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON: Does not sanitise and escape some of its settingsCVE-2023-6046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfiltered_html capability is disallowed.
Product
EventON
Fixed in
2.2
What to do
Update EventON to 2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024EventON WordPress plugin before 4.5.5, EventON: Does not sanitize and escape some of its settingsCVE-2023-6005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
EventON WordPress plugin before 4.5.5, EventON
Fixed in
4.5.5
What to do
Update EventON WordPress plugin before 4.5.5, EventON to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.