Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

517new WordPress flaws this week

397,455entries in the database

15,598 results · page 265 of 312

Jun 20, 2023Vadym K: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-35878 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.
Product
Vadym K
Affected
up to 0.5
What to do
Affects up to 0.5. Update Vadym K to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2023Google Map Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-2899 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Product
Google Map Shortcode
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Google Map Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2023-2812 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Ultimate Dashboard
Fixed in
3.7.6
What to do
Update Ultimate Dashboard to 3.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-2811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks to all admin when setting chatbot and all client when using chatbot
Product
AI ChatBot
Fixed in
4.5.6
What to do
Update AI ChatBot to 4.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023Social Share, Social Login and Social Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2779 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Social Share, Social Login and Social Comments
Fixed in
7.13.52
What to do
Update Social Share, Social Login and Social Comments to 7.13.52 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Jun 19, 2023AI ChatBot: Does not sanitize and escape its settingsCVE-2023-2742 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
AI ChatBot
Fixed in
4.5.5
What to do
Update AI ChatBot to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023File Renaming on Upload: Does not sanitise and escape some of its settingsCVE-2023-2684 · WordPress plugins & themes · reported by WPScanMedium 4.8
The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
File Renaming on Upload
Fixed in
2.5.2
What to do
Update File Renaming on Upload to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023Conditional Menus: Does not escape a parameter before outputting it back in an attributeCVE-2023-2654 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Conditional Menus
Fixed in
1.2.1
What to do
Update Conditional Menus to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023Custom Base Terms: Does not sanitize and escape some of its settingsCVE-2023-2600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Custom Base Terms
Fixed in
1.0.3
What to do
Update Custom Base Terms to 1.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023QuBot: Does not sanitise and escape some of its settingsCVE-2023-2401 · WordPress plugins & themes · reported by WPScanMedium 4.8
The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
QuBot
Fixed in
1.1.6
What to do
Update QuBot to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023SlideOnline: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0489 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
SlideOnline
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update SlideOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023Responsive Tabs For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0368 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.1
What to do
Affects up to 1.1. Update Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2023Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting: Cross-Site Request Forgery (CSRF)CVE-2022-42880 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability in Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting (XSS).
Product
Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting
Fixed in
3.3.1
What to do
Update Ali Irani Auto Upload Images plugin <= 3.3 versions allows Stored Cross-Site Scripting to 3.3.1 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 12, 2023Photo Gallery by Ays: Does not escape some parameters before outputting it back in attributesCVE-2023-2568 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Photo Gallery by Ays
Fixed in
5.1.7
What to do
Update Photo Gallery by Ays to 5.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2023Icegram Engage: Does not escape a parameter before outputting it back in an attributeCVE-2023-2398 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Icegram Engage
Fixed in
3.1.12
What to do
Update Icegram Engage to 3.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 9, 2023The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up toCVE-2023-2767 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WordPress File Upload and WordPress File Upload Pro plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.19.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected
up to 4.19.1
What to do
Affects up to 4.19.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Team Circle Image Slider With Lightbox: Reflected Cross-Site ScriptingCVE-2023-2604 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Team Circle Image Slider With Lightbox
Affected
up to 1.0.17
What to do
Affects up to 1.0.17. Update Team Circle Image Slider With Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023PixelYourSite: Stored Cross-Site ScriptingCVE-2023-2584 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.3.6 (9.6.1 in the Pro version) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
PixelYourSite
Affected
up to 9.3.6
What to do
Affects up to 9.3.6. Update PixelYourSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023WPCS – WordPress Currency Switcher Professional: Stored Cross-Site ScriptingCVE-2023-2558 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcs_current_currency shortcode in versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPCS – WordPress Currency Switcher Professional
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update WPCS – WordPress Currency Switcher Professional to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Advanced Woo Search: Stored Cross-Site ScriptingCVE-2023-2452 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Advanced Woo Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.77 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Advanced Woo Search
Affected
up to 2.77
What to do
Affects up to 2.77. Update Advanced Woo Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023FiboSearch - AJAX Search for WooCommerce: Stored Cross-Site ScriptingCVE-2023-2450 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.23.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
FiboSearch - AJAX Search for WooCommerce
Affected
up to 1.23.0
What to do
Affects up to 1.23.0. Update FiboSearch - AJAX Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Photo Gallery Slideshow & Masonry Tiled Gallery: Reflected Cross-Site ScriptingCVE-2023-2402 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-41658 appears to be a duplicate of this issue.
Product
Photo Gallery Slideshow & Masonry Tiled Gallery
Affected
up to 1.0.13
What to do
Affects up to 1.0.13. Update Photo Gallery Slideshow & Masonry Tiled Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Download Manager: Stored Cross-Site ScriptingCVE-2023-2305 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_members', 'wpdm_login_form', 'wpdm_reg_form' shortcodes in versions up to, and including, 3.2.70 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Download Manager
Affected
up to 3.2.70
What to do
Affects up to 3.2.70. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023wordpress vertical image slider: Reflected Cross-Site ScriptingCVE-2023-2289 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The wordpress vertical image slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
wordpress vertical image slider
Affected
up to 1.2.16
What to do
Affects up to 1.2.16. Update wordpress vertical image slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023WP Responsive Tabs horizontal vertical and accordion Tabs: Reflected Cross-Site ScriptingCVE-2023-2184 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.1.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Responsive Tabs horizontal vertical and accordion Tabs
Affected
up to 1.1.15
What to do
Affects up to 1.1.15. Update WP Responsive Tabs horizontal vertical and accordion Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Announcement & Notification Banner – Bulletin: Cross-Site Request ForgeryCVE-2023-2067 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce validation on the 'bulletinwp_update_bulletin_status', 'bulletinwp_update_bulletin', 'bulletinwp_update_settings', 'bulletinwp_update_status', 'bulletinwp_export_bulletins', and 'bulletinwp_import_bulletins' functions in versions up to, and including, 3.7.0. This makes it possible for unauthenticated attackers to modify the plugin's settings, modify bulletins, create new bulletins, and more, via a forged request granted they can trick a site's user into performing an action such as clicking on a link.
Product
Announcement & Notification Banner – Bulletin
Affected
up to 3.7.0
What to do
Affects up to 3.7.0. Update Announcement & Notification Banner – Bulletin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Announcement & Notification Banner – Bulletin: Unauthorized access and modification of dataCVE-2023-2066 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Announcement & Notification Banner – Bulletin plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'bulletinwp_update_bulletin_status', 'bulletinwp_update_bulletin', 'bulletinwp_update_settings', 'bulletinwp_update_status', 'bulletinwp_export_bulletins', and 'bulletinwp_import_bulletins' functions functions in versions up to, and including, 3.6.0. This makes it possible for authenticated attackers with subscriber-level access, and above, to modify the plugin's settings, modify bulletins, create new bulletins, and more.
Product
Announcement & Notification Banner – Bulletin
Affected
up to 3.6.0
What to do
Affects up to 3.6.0. Update Announcement & Notification Banner – Bulletin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Locatoraid Store Locator: Stored Cross-Site ScriptingCVE-2023-2031 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Locatoraid Store Locator
Affected
up to 3.9.14
What to do
Affects up to 3.9.14. Update Locatoraid Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023ShiftController Employee Shift Scheduling: Reflected Cross-Site ScriptingCVE-2023-1978 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in versions up to, and including, 4.9.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
ShiftController Employee Shift Scheduling
Affected
up to 4.9.25
What to do
Affects up to 4.9.25. Update ShiftController Employee Shift Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023PowerPress: Stored Cross-Site ScriptingCVE-2023-1917 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: A partial fix for the issue was introduced in version 10.0.1, and an additional patch (version 10.0.2) was released to address a workaround.
Product
PowerPress
Affected
up to 10.0
What to do
Affects up to 10.0. Update PowerPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023FluentCRM - Marketing Automation For WordPress: Unauthorized modification of dataCVE-2023-1430 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.
Product
FluentCRM - Marketing Automation For WordPress
Affected
up to 2.8.01
What to do
Affects up to 2.8.01. Update FluentCRM - Marketing Automation For WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Jun 9, 2023Weaver Show Posts: Stored Cross-Site ScriptingCVE-2023-1404 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Weaver Show Posts Plugin for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 1.6. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Weaver Show Posts
Affected
up to 1.6
What to do
Affects up to 1.6. Update Weaver Show Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Weaver Xtreme: Stored Cross-Site ScriptingCVE-2023-1403 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Weaver Xtreme Theme for WordPress is vulnerable to stored Cross-Site Scripting due to insufficient escaping of the profile display name in versions up to, and including, 5.0.7. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Weaver Xtreme
Affected
up to 5.0.7
What to do
Affects up to 5.0.7. Update Weaver Xtreme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordfence.com
Jun 9, 2023Shield Security: Stored Cross-Site ScriptingCVE-2023-0992 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Shield Security
Affected
up to 17.0.17
What to do
Affects up to 17.0.17. Update Shield Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissionsCVE-2023-0710 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attribute of the 'mf_thankyou' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database. Additionally this requires successful payment, increasing the complexity.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissionsCVE-2023-0709 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_last_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissionsCVE-2023-0708 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf_first_name' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a a page containing the shortcode when the submission id is present in the query string. Note that getting the JavaScript to execute requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Metform Elementor Contact Form Builder: Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissionsCVE-2023-0695 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'mf' shortcode to echo unescaped form submissions in versions up to, and including, 3.3.0. This allows authenticated attackers, with contributor-level permissions or above, to inject arbitrary web scripts in pages that will execute when the victim visits a specific link. Note that getting the JavaScript to execute still requires user interaction as the victim must visit a crafted link with the form entry id, but the script itself is stored in the site database.
Product
Metform Elementor Contact Form Builder
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Metform Elementor Contact Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 6, 2023uListing: Authorization bypassCVE-2021-4381 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database.
Product
uListing
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023WP Quick FrontEnd Editor: Stored Cross-Site ScriptingCVE-2021-4378 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with minimal permissions like subscribers, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Quick FrontEnd Editor
Affected
up to 5.5
What to do
Affects up to 5.5. Update WP Quick FrontEnd Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023WooCommerce Dynamic Pricing and Discounts: Stored Cross-Site ScriptingCVE-2021-4372 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.1. This is due to missing sanitization on the settings imported via the import() function. This makes it possible for unauthenticated attackers to import a settings file containing malicious JavaScript that would execute when an administrator accesses the settings area of the site.
Product
WooCommerce Dynamic Pricing and Discounts
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update WooCommerce Dynamic Pricing and Discounts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com
Jun 6, 2023WP Quick FrontEnd Editor: Setting ChangsCVE-2021-4371 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lacking both a security nonce and a capabilities check. This makes it possible for low-authenticated attackers to change plugin settings even when they do not have the capabilities to do so.
Product
WP Quick FrontEnd Editor
Affected
up to 5.5
What to do
Affects up to 5.5. Update WP Quick FrontEnd Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023uListing: Authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validatedCVE-2021-4370 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to conduct numerous administrative actions, including those less critical than the explicitly outlined ones in our detection.
Product
uListing
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Frontend File Manager: Authenticated Settings ChangeCVE-2021-4368 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfm_save_settings AJAX action. This makes it possible for subscriber-level attackers to edit the plugin settings, such as the allowed upload file types. This can lead to remote code execution through other vulnerabilities.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Flo Forms – Easy Drag & Drop Form Builder: Stored Cross-Site ScriptingCVE-2021-4367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using the flo_import_forms_options AJAX action in versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping along with missing capability checks. This makes it possible for authenticated attackers, like subscribers, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Flo Forms – Easy Drag & Drop Form Builder
Affected
up to 1.0.35
What to do
Affects up to 1.0.35. Update Flo Forms – Easy Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wpscan.com
Jun 6, 2023Frontend File Manager: Unauthenticated Stored Cross-Site ScriptingCVE-2021-4365 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfm_edit_file_title_desc AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Frontend File Manager
Affected
up to 18.2
What to do
Affects up to 18.2. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023WP Quick FrontEnd Editor: Reflected Cross-Site ScriptingCVE-2021-4363 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and output escaping on the 'save_content_front' function that uses print_r on the user-supplied $_REQUEST values . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Quick FrontEnd Editor
Affected
up to 5.5
What to do
Affects up to 5.5. Update WP Quick FrontEnd Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023WP DSGVO Tools (GDPR): Stored Cross-Site ScriptingCVE-2021-4358 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and including, 3.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP DSGVO Tools (GDPR)
Affected
up to 3.1.23
What to do
Affects up to 3.1.23. Update WP DSGVO Tools (GDPR) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordpress.org
Jun 6, 2023uListing: Authorization bypassCVE-2021-4357 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::save_role_api function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to arbitrarily delete site posts and pages.
Product
uListing
Affected
up to 1.6.6
What to do
Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 6, 2023Ultimate GDPR & CCPA: Unauthenticated settings import and exportCVE-2021-4348 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks such as redirecting visitors to malicious sites.
Product
Ultimate GDPR & CCPA
Affected
up to 2.4
What to do
Affects up to 2.4. Update Ultimate GDPR & CCPA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.