Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

511new WordPress flaws this week

397,455entries in the database

15,598 results · page 267 of 312

May 28, 2023André Bräkling WP-Matomo Integration: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-33211 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions.
Product
André Bräkling WP-Matomo Integration
Affected
up to 1.0.27
What to do
Affects up to 1.0.27. Update André Bräkling WP-Matomo Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 28, 2023WooDiscuz – WooCommerce Comments: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-33216 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments woodiscuz-woocommerce-comments allows Stored XSS.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.2.9.
Product
WooDiscuz – WooCommerce Comments
Affected
up to 2.2.9
What to do
Affects up to 2.2.9. Update WooDiscuz – WooCommerce Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.CVE-2022-38716 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.CVE-2022-47161 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 23, 2023Go Pricing - WordPress Responsive Pricing Tables: Stored Cross-Site ScriptingCVE-2023-2498 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.19 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Go Pricing - WordPress Responsive Pricing Tables
Affected
up to 3.3.19
What to do
Affects up to 3.3.19. Update Go Pricing - WordPress Responsive Pricing Tables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
May 22, 2023Newsletter versions prior to 7.6.9: Cross-site scriptingCVE-2023-27922 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Newsletter versions prior to 7.6.9 allows a remote unauthenticated attacker to inject an arbitrary script.
Product
Newsletter versions prior to 7.6.9
Fixed in
7.6.9
What to do
Update Newsletter versions prior to 7.6.9 to 7.6.9 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 19, 2023Groundhogg: Stored Cross-Site ScriptingCVE-2023-2735 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only works with legacy contact forms.
Product
Groundhogg
Affected
up to 2.7.9.8
What to do
Affects up to 2.7.9.8. Update Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 17, 2023Waiting: One-click countdowns: Authorization bypassCVE-2023-2757 · WordPress plugins & themes · reported by WordfenceHigh 7.4
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' functions in versions up to, and including, 0.6.2. This could lead to Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for subscriber-level attackers to access functions to save plugin data that can potentially lead to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Waiting: One-click countdowns
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update Waiting: One-click countdowns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 16, 2023NetReviews SAS Verified Reviews: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23720 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NetReviews SAS Verified Reviews (Avis Vérifiés) plugin <= 2.3.13 versions.
Product
NetReviews SAS Verified Reviews
Affected
up to 2.3.13
What to do
Affects up to 2.3.13. Update NetReviews SAS Verified Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2023video carousel slider with lightbox: Reflected Cross-Site ScriptingCVE-2023-2710 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32797 may be a duplicate of this.
Product
video carousel slider with lightbox
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update video carousel slider with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
May 15, 2023Video Gallery: Reflected Cross-Site ScriptingCVE-2023-2708 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32597 may be a duplicate of this.
Product
Video Gallery
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
May 15, 2023Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform SCVE-2023-2009 · WordPress plugins & themes · reported by WPScanMedium 4.8
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Pretty Url
Affected
up to 1.5.4
What to do
Affects up to 1.5.4. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Thumbnail carousel slider: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-1915 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Thumbnail carousel slider WordPress plugin before 1.1.10 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting vulnerability which could be used against high privilege users such as admin.
Product
Thumbnail carousel slider
Fixed in
1.1.10
What to do
Update Thumbnail carousel slider to 1.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some of its setting fieldsCVE-2023-1839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Product
Product Addons & Fields for WooCommerce
Fixed in
32.0.6
What to do
Update Product Addons & Fields for WooCommerce to 32.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Ninja Forms Contact Form: Does not properly escape user input before outputting it back in an admin pageCVE-2023-1835 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ninja Forms Contact Form
Fixed in
3.6.22
What to do
Update Ninja Forms Contact Form to 3.6.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023tagDiv Composer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-1596 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
tagDiv Composer
Fixed in
4.0
What to do
Update tagDiv Composer to 4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Ad Inserter: Unserializes user input provided via the settingsCVE-2023-1549 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ad Inserter WordPress plugin before 2.7.27 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Product
Ad Inserter
Fixed in
2.7.27
What to do
Update Ad Inserter to 2.7.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023BizLibrary: Does not sanitise and escape some of its settingsCVE-2023-0892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
BizLibrary
Affected
up to 1.1
What to do
Affects up to 1.1. Update BizLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023Push Notifications for WordPress by PushAssist: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-0644 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
Push Notifications for WordPress by PushAssist
Affected
up to 3.0.8
What to do
Affects up to 3.0.8. Update Push Notifications for WordPress by PushAssist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023RapidExpCart: Does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the pageCVE-2023-0520 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection means an attacker can trick a logged in admin to perform the attack by submitting a hidden form.
Product
RapidExpCart
Affected
up to 1.0
What to do
Affects up to 1.0. Update RapidExpCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023f(x) TOC: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0490 · WordPress plugins & themes · reported by WPScanMedium 5.4
The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
f(x) TOC
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update f(x) TOC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023ActiveCampaign: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0233 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
ActiveCampaign
Fixed in
8.1.12
What to do
Update ActiveCampaign to 8.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 10, 2023Yatra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-47436 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Yatra allows Stored XSS.This issue affects Yatra: from n/a through 2.1.14.
Product
Yatra
Affected
up to 2.1.14
What to do
Affects up to 2.1.14. Update Yatra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 10, 2023Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76: Cross-site scriptingCVE-2023-27918 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.
Product
Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76
Fixed in
1.0.76
What to do
Update Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 to 1.0.76 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
May 9, 2023Sk: Auth. (author+) Stored Cross-Site Scripting (XSS)CVE-2023-23647 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Team Member – Team with Slider plugin <= 4.4 versions.
Product
Sk
Affected
up to 4.4
What to do
Affects up to 4.4. Update Sk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2023The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password.CVE-2023-1979 · WordPress plugins & themes · reported by cve-coordination@google.comMedium 4.9
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can create stories, but don't have the ability to edit password protected stories. The vulnerability allowed users with said role to bypass this permission check when trying to duplicate the protected story in the plugin's own dashboard, giving them access to the seemingly protected content. We recommend upgrading to version 1.32 or beyond commit ad49781c2a35c5c92ef704d4b621ab4e5cb77d68 https://github.com/GoogleForCreators/web-stories-wp/commit/ad49781c2a35c5c92ef704d4b621ab4e5cb77d68
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record github.com github.com
May 8, 2023Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions.CVE-2023-28493 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions.
Affected
up to 2.4.4
What to do
Affects up to 2.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 8, 2023WP Popups: Does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embedCVE-2023-1905 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003
Product
WP Popups
Fixed in
2.1.5.1
What to do
Update WP Popups to 2.1.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023WP Inventory Manager: Does not sanitise and escape the message parameter before outputting it back in the pageCVE-2023-1806 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
Product
WP Inventory Manager
Fixed in
2.1.0.12
What to do
Update WP Inventory Manager to 2.1.0.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023AI ChatBot: Does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settingsCVE-2023-1651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS
Product
AI ChatBot
Fixed in
4.4.9
What to do
Update AI ChatBot to 4.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-1649 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
AI ChatBot
Fixed in
4.5.1
What to do
Update AI ChatBot to 4.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Customizer Export/Import: Unserializes user input provided via the settingsCVE-2023-1347 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Product
Customizer Export/Import
Fixed in
0.9.6
What to do
Update Customizer Export/Import to 0.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023AI ChatBot: Does not escape most of its settings before outputting them back in the dashboardCVE-2023-1011 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not have a proper CSRF check, allowing attackers to make a logged in admin set XSS payloads in them.
Product
AI ChatBot
Fixed in
4.4.5
What to do
Update AI ChatBot to 4.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Japanized For WooCommerce: Does not escape generated URLs before outputting them in attributesCVE-2023-0948 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Japanized For WooCommerce WordPress plugin before 2.5.8 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
Product
Japanized For WooCommerce
Fixed in
2.5.8
What to do
Update Japanized For WooCommerce to 2.5.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Pickup | Delivery | Dine-in date time: Does not sanitise and escape some of its settingsCVE-2023-0894 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pickup | Delivery | Dine-in date time WordPress plugin through 1.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Pickup | Delivery | Dine-in date time
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Pickup | Delivery | Dine-in date time to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023WP Login Box: Does not sanitise and escape some of its settingsCVE-2023-0544 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Login Box WordPress plugin through 2.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Login Box
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update WP Login Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Custom Post Type List Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0542 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Custom Post Type List Shortcode
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Custom Post Type List Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Product Slider For WooCommerce Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0537 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Product Slider For WooCommerce Lite
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Product Slider For WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Wp-D3: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wp-D3 WordPress plugin through 2.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Wp-D3
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Wp-D3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Post Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0526 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Post Shortcode
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Membership Database: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0514 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Membership Database
Affected
up to 1.0
What to do
Affects up to 1.0. Update Membership Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Cloud Manager: Does not sanitise and escape the query param ricerca before outputting it in an admin panelCVE-2023-0421 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cloud Manager WordPress plugin through 1.0 does not sanitise and escape the query param ricerca before outputting it in an admin panel, allowing unauthenticated attackers to trick a logged in admin to trigger a XSS payload by clicking a link.
Product
Cloud Manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update Cloud Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Ultimate Carousel For Elementor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0280 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Ultimate Carousel For Elementor
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Ultimate Carousel For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Mega Addons For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0268 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Mega Addons For WPBakery Page Builder
Fixed in
4.3.0
What to do
Update Mega Addons For WPBakery Page Builder to 4.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Ultimate Carousel For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0267 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Ultimate Carousel For WPBakery Page Builder
Affected
up to 2.6
What to do
Affects up to 2.6. Update Ultimate Carousel For WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Michael Pretty: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-25452 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Pretty (prettyboymp) CMS Press plugin <= 0.2.3 versions.
Product
Michael Pretty
Affected
up to 0.2.3
What to do
Affects up to 0.2.3. Update Michael Pretty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 4, 2023GMO Internet Group, Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-25458 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GMO Internet Group, Inc. TypeSquare Webfonts for ConoHa plugin <= 2.0.3 versions.
Product
GMO Internet Group, Inc
Fixed in
2.0.4
What to do
Update GMO Internet Group, Inc to 2.0.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 3, 2023Themis Solutions, Inc: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-22683 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themis Solutions, Inc. Clio Grow plugin <= 1.0.0 versions.
Product
Themis Solutions, Inc
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update Themis Solutions, Inc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the page parameter before outputting it back in an attributeCVE-2023-1805 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Product Catalog Feed by PixelYourSite
Fixed in
2.1.1
What to do
Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2023Product Catalog Feed by PixelYourSite: Does not sanitise and escape the edit parameter before outputting it back in an attributeCVE-2023-1804 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Feed by PixelYourSite WordPress plugin before 2.1.1 does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
Product
Product Catalog Feed by PixelYourSite
Fixed in
2.1.1
What to do
Update Product Catalog Feed by PixelYourSite to 2.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.