Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,598 results · page 271 of 312
Feb 27, 2023Galleries by Angie Makes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4795 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Galleries by Angie Makes WordPress plugin through 1.67 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Galleries by Angie Makes
- Affected
- up to 1.67
- What to do
- Affects up to 1.67. Update Galleries by Angie Makes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Embed PDF: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4788 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Embed PDF
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Embed PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023List Pages Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- List Pages Shortcode
- Fixed in
- 1.7.6
- What to do
- Update List Pages Shortcode to 1.7.6 or newer.
Feb 27, 2023Wufoo Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4679 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wufoo Shortcode WordPress plugin before 1.52 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Wufoo Shortcode
- Fixed in
- 1.52
- What to do
- Update Wufoo Shortcode to 1.52 or newer.
Feb 24, 2023All in One SEO Pack: Stored Cross-Site ScriptingCVE-2023-0586 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor+ role to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- All in One SEO Pack
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update All in One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 24, 2023All in One SEO Pack: Stored Cross-Site ScriptingCVE-2023-0585 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The All in One SEO Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 4.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Administrator role or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- All in One SEO Pack
- Affected
- up to 4.2.9
- What to do
- Affects up to 4.2.9. Update All in One SEO Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 21, 2023Japanized For WooCommerce: Reflected Cross-Site ScriptingCVE-2023-0942 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Japanized For WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Japanized For WooCommerce
- Affected
- up to 2.5.4
- What to do
- Affects up to 2.5.4. Update Japanized For WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 21, 2023GS Portfolio for Envato: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0559 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GS Portfolio for Envato
- Fixed in
- 1.4.0
- What to do
- Update GS Portfolio for Envato to 1.4.0 or newer.
Feb 21, 2023GS Books Showcase: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0541 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GS Books Showcase
- Fixed in
- 1.3.1
- What to do
- Update GS Books Showcase to 1.3.1 or newer.
Feb 21, 2023GS Filterable Portfolio: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0540 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GS Filterable Portfolio
- Fixed in
- 1.6.1
- What to do
- Update GS Filterable Portfolio to 1.6.1 or newer.
Feb 21, 2023GS Products Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0492 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GS Products Slider for WooCommerce
- Fixed in
- 1.5.9
- What to do
- Update GS Products Slider for WooCommerce to 1.5.9 or newer.
Feb 21, 2023Loan Comparison: Does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcodeCVE-2023-0442 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.
- Product
- Loan Comparison
- Fixed in
- 1.5.3
- What to do
- Update Loan Comparison to 1.5.3 or newer.
Feb 21, 2023Watu Quiz: Does not sanitise and escape some of its settingsCVE-2023-0429 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Watu Quiz
- Fixed in
- 3.3.8.2
- What to do
- Update Watu Quiz to 3.3.8.2 or newer.
Feb 21, 2023Watu Quiz: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Watu Quiz
- Fixed in
- 3.3.8.2
- What to do
- Update Watu Quiz to 3.3.8.2 or newer.
Feb 21, 2023Shortcode for Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0419 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Shortcode for Font Awesome
- Fixed in
- 1.4.1
- What to do
- Update Shortcode for Font Awesome to 1.4.1 or newer.
Feb 21, 2023Easy Digital Downloads: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0380 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Digital Downloads
- Fixed in
- 3.1.0.5
- What to do
- Update Easy Digital Downloads to 3.1.0.5 or newer.
Feb 21, 2023Greenshift: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0378 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Greenshift
- Fixed in
- 5.0
- What to do
- Update Greenshift to 5.0 or newer.
Feb 21, 2023Easy Affiliate Links: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embeddedCVE-2023-0375 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Affiliate Links
- Fixed in
- 3.7.1
- What to do
- Update Easy Affiliate Links to 3.7.1 or newer.
Feb 21, 2023EmbedStories: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0372 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EmbedStories WordPress plugin before 0.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- EmbedStories
- Fixed in
- 0.7.5
- What to do
- Update EmbedStories to 0.7.5 or newer.
Feb 21, 2023EmbedSocial: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0371 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- EmbedSocial
- Fixed in
- 1.1.28
- What to do
- Update EmbedSocial to 1.1.28 or newer.
Feb 21, 2023Loan Comparison: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0366 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Loan Comparison
- Fixed in
- 1.5.3
- What to do
- Update Loan Comparison to 1.5.3 or newer.
Feb 21, 2023WP Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Font Awesome
- Fixed in
- 1.7.9
- What to do
- Update WP Font Awesome to 1.7.9 or newer.
Feb 21, 2023ShopLentor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0231 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ShopLentor
- Fixed in
- 2.5.4
- What to do
- Update ShopLentor to 2.5.4 or newer.
Feb 21, 2023Timed Content: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Timed Content
- Fixed in
- 2.73
- What to do
- Update Timed Content to 2.73 or newer.
Feb 21, 2023Youzify: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0059 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Youzify
- Fixed in
- 1.2.2
- What to do
- Update Youzify to 1.2.2 or newer.
Feb 21, 2023BackupBuddy: Does not sanitise and escape some parameters before outputting them back in various placesCVE-2022-4897 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting
- Product
- BackupBuddy
- Fixed in
- 8.8.3
- What to do
- Update BackupBuddy to 8.8.3 or newer.
Feb 21, 2023Video.js: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4786 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video.js
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update Video.js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Video Sidebar Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4785 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video Sidebar Widgets
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Video Sidebar Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Hueman Addons: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4784 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Hueman Addons
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Hueman Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Bootstrap Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4777 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Bootstrap Shortcodes
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Bootstrap Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Simple File Downloader: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Simple File Downloader
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Simple File Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Post Views Count: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4761 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Post Views Count
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Post Views Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Easy Social Box / Page: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4754 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Easy Social Box / Page
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update Easy Social Box / Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Opening Hours: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4752 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Opening Hours
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Opening Hours to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023WP Responsive Testimonials Slider And Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4750 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Responsive Testimonials Slider And Widget
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update WP Responsive Testimonials Slider And Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Page Builder: Live Composer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4669 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Page Builder: Live Composer
- Fixed in
- 1.5.23
- What to do
- Update Page Builder: Live Composer to 1.5.23 or newer.
Feb 21, 2023Markup (JSON-LD) structured in schema.org: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4666 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Markup (JSON-LD) structured in schema.org
- Affected
- up to 4.8.1
- What to do
- Affects up to 4.8.1. Update Markup (JSON-LD) structured in schema.org to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Login Logout Menu: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4622 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Login Logout Menu
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Login Logout Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.CVE-2022-41134 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions.
- Fixed in
- 1.0.16
- What to do
- Update the plugin to 1.0.16 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 13, 2023GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training: Does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary postsCVE-2023-0405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts.
- Product
- GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training
- Fixed in
- 1.4.38
- What to do
- Update GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training to 1.4.38 or newer.
Feb 13, 2023Spotlight Social Feeds: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0379 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Spotlight Social Feeds WordPress plugin before 1.4.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Spotlight Social Feeds
- Fixed in
- 1.4.3
- What to do
- Update Spotlight Social Feeds to 1.4.3 or newer.
Feb 13, 2023Lightweight Accordion: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0373 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lightweight Accordion WordPress plugin before 1.5.15 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Lightweight Accordion
- Fixed in
- 1.5.15
- What to do
- Update Lightweight Accordion to 1.5.15 or newer.
Feb 13, 2023Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post whCVE-2023-0362 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Fixed in
- 1.2.2
- What to do
- Update the plugin to 1.2.2 or newer.
Feb 13, 2023Location Weather: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0360 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Location Weather WordPress plugin before 1.3.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Location Weather
- Fixed in
- 1.3.4
- What to do
- Update Location Weather to 1.3.4 or newer.
Feb 13, 2023Easy Accept Payments for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0275 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accept Payments for PayPal WordPress plugin before 4.9.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Accept Payments for PayPal
- Fixed in
- 4.9.10
- What to do
- Update Easy Accept Payments for PayPal to 4.9.10 or newer.
Feb 13, 2023YaMaps for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0270 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YaMaps for WordPress Plugin WordPress plugin before 0.6.26 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- YaMaps for
- Fixed in
- 0.6.26
- What to do
- Update YaMaps for to 0.6.26 or newer.
Feb 13, 2023Social Like Box and Page by WpDevArt: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0177 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Like Box and Page by WpDevArt WordPress plugin before 0.8.41 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Social Like Box and Page by WpDevArt
- Fixed in
- 0.8.41
- What to do
- Update Social Like Box and Page by WpDevArt to 0.8.41 or newer.
Feb 13, 2023Zoho Forms: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0169 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zoho Forms WordPress plugin before 3.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Zoho Forms
- Fixed in
- 3.0.1
- What to do
- Update Zoho Forms to 3.0.1 or newer.
Feb 13, 2023Product Slider for WooCommerce by PickPlugins: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0166 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Product Slider for WooCommerce by PickPlugins
- Fixed in
- 1.13.42
- What to do
- Update Product Slider for WooCommerce by PickPlugins to 1.13.42 or newer.
Feb 13, 2023uTubeVideo Gallery: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0151 · WordPress plugins & themes · reported by WPScanMedium 5.4
The uTubeVideo Gallery WordPress plugin before 2.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- uTubeVideo Gallery
- Fixed in
- 2.0.8
- What to do
- Update uTubeVideo Gallery to 2.0.8 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.