Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

505new WordPress flaws this week

397,455entries in the database

15,598 results · page 276 of 312

Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backendCVE-2022-4156 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4155 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery Pro: Does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
Product
Contest Gallery Pro
Fixed in
19.1.5
What to do
Update Contest Gallery Pro to 19.1.5 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the upload[] POST parameter before concatenating it to an SQL query in get-data-create-upload-v10CVE-2022-4153 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload[] POST parameter before concatenating it to an SQL query in get-data-create-upload-v10.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro: Do not escape the option_id POST parameter before concatenating it to an SQL query in edit-optionsCVE-2022-4152 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro WordPress plugin before 19.1.5 do not escape the option_id POST parameter before concatenating it to an SQL query in edit-options.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro
Fixed in
19.1.5
What to do
Update Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro to 19.1.5 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-dataCVE-2022-4151 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET parameter before concatenating it to an SQL query in export-images-data.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro: Do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-searchCVE-2022-4150 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before concatenating it to an SQL query in order-custom-fields-with-and-without-search.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Product
Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro
Fixed in
19.1.5.1
What to do
Update Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro to 19.1.5.1 or newer.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Dec 26, 2022Eventify™: Does not sanitise and escape some of its settingsCVE-2022-4110 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Eventify™
Affected
up to 2.1
What to do
Affects up to 2.1. Update Eventify™ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2022Paytium: Mollie payment forms & donations: Does not sanitise and escape some of its settingsCVE-2022-4042 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Paytium: Mollie payment forms & donations
Fixed in
4.3.7
What to do
Update Paytium: Mollie payment forms & donations to 4.3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2022Login for Google Apps: Does not sanitise and escape some of its settingsCVE-2022-3840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login for Google Apps WordPress plugin before 3.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Login for Google Apps
Fixed in
3.4.5
What to do
Update Login for Google Apps to 3.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2022Kwayy HTML Sitemap: Does not sanitise and escape some of its settingsCVE-2022-3835 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Kwayy HTML Sitemap
Fixed in
4.0
What to do
Update Kwayy HTML Sitemap to 4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 23, 2022ProfilePress: Stored Cross-Site ScriptingCVE-2022-4698 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ProfilePress
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 23, 2022ProfilePress: Stored Cross-Site ScriptingCVE-2022-4697 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ProfilePress
Affected
up to 4.5.0
What to do
Affects up to 4.5.0. Update ProfilePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various functions used to update the plugin settingsCVE-2022-3805 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
Product
Jeg Elementor Kit
Affected
up to 2.5.6
What to do
Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Dec 20, 2022Sidebar Widgets by CodeLights: Stored Cross-Site ScriptingCVE-2022-4619 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Sidebar Widgets by CodeLights
Affected
up to 1.4
What to do
Affects up to 1.4. Update Sidebar Widgets by CodeLights to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 19, 2022Quizlord: Does not sanitise and escape some of its settingsCVE-2022-4112 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Quizlord
Affected
up to 2.0
What to do
Affects up to 2.0. Update Quizlord to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Photo Gallery by 10Web: Does not validate and escape some parameters before outputting them back in in JS code later on in another pageCVE-2022-4058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.
Product
Photo Gallery by 10Web
Fixed in
1.8.3
What to do
Update Photo Gallery by 10Web to 1.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Responsive Lightbox2: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3987 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Product
Responsive Lightbox2
Fixed in
1.0.4
What to do
Update Responsive Lightbox2 to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022WP Stripe Checkout: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3986 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Product
WP Stripe Checkout
Fixed in
1.2.2.21
What to do
Update WP Stripe Checkout to 1.2.2.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Videojs HTML5 Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3985 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Product
Videojs HTML5 Player
Fixed in
1.1.9
What to do
Update Videojs HTML5 Player to 1.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Flowplayer Video Player: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3984 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Product
Flowplayer Video Player
Fixed in
1.0.5
What to do
Update Flowplayer Video Player to 1.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022Checkout for PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-3983 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Product
Checkout for PayPal
Fixed in
1.0.14
What to do
Update Checkout for PayPal to 1.0.14 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 19, 2022External Media: Does not sanitise and escape some of its settingsCVE-2022-3832 · WordPress plugins & themes · reported by WPScanMedium 4.8
The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
External Media
Fixed in
1.0.36
What to do
Update External Media to 1.0.36 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2022WP User: Stored Cross-Site ScriptingCVE-2022-4519 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP User
Affected
up to 7.0
What to do
Affects up to 7.0. Update WP User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 15, 2022Transposh WordPress Translation: Unauthorized setting changes by unauthenticated usersCVE-2022-2536 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."
Product
Transposh WordPress Translation
Affected
up to 1.0.9.6
What to do
Affects up to 1.0.9.6. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com packetstormsecurity.com
Dec 14, 2022Permalink Manager Lite: Stored Cross-Site ScriptingCVE-2022-4410 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output escaping on post/page/media titles. This makes it possible for attackers to inject arbitrary web scripts on the permalink-manager page if another plugin or theme is installed on the site that allows lower privileged users with unfiltered_html the ability to modify post/page titles with malicious web scripts.
Product
Permalink Manager Lite
Affected
up to 2.2.20.3
What to do
Affects up to 2.2.20.3. Update Permalink Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 13, 2022Image Hover Effects Ultimate: Stored Cross-Site ScriptingCVE-2022-4207 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in versions 9.8.1 to 9.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.
Product
Image Hover Effects Ultimate
Affected
9.8.1 to 9.8.4
What to do
Affects 9.8.1 to 9.8.4. Update Image Hover Effects Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Dec 12, 2022Image Hover Effects: Does not sanitise and escape some of its settingsCVE-2022-4010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Image Hover Effects
Fixed in
5.5
What to do
Update Image Hover Effects to 5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022WooCommerce Shipping: Does not sanitise and escape some of its settingsCVE-2022-4000 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WooCommerce Shipping
Affected
up to 1.2.11
What to do
Affects up to 1.2.11. Update WooCommerce Shipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022FlatPM: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2022-3934 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
FlatPM
Fixed in
3.0.13
What to do
Update FlatPM to 3.0.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Listingo: Does not validate files to be uploaded via an AJAX action available to unauthenticated usersCVE-2022-3921 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
Product
Listingo
Fixed in
3.2.7
What to do
Update Listingo to 3.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Jetpack CRM: Does not sanitise and escape its settingsCVE-2022-3919 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Jetpack CRM
Fixed in
5.4.3
What to do
Update Jetpack CRM to 5.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Helloprint: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-3908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Helloprint
Fixed in
1.4.7
What to do
Update Helloprint to 1.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Easy Form Builder: Does not sanitise and escape some of its settingsCVE-2022-3906 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Easy Form Builder
Fixed in
3.4.0
What to do
Update Easy Form Builder to 3.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Livemesh Addons for Elementor: Does not sanitise and escape some of its settingsCVE-2022-3862 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Livemesh Addons for Elementor
Fixed in
7.2.4
What to do
Update Livemesh Addons for Elementor to 7.2.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022Cross-site Scripting (XSS) is a client-side code injection attack.CVE-2022-3853 · WordPress plugins & themes · reported by WPScanMedium 5.4
Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application.
Affected
up to 4.0.3
What to do
Affects up to 4.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 12, 2022GetYourGuide Ticketing: Does not sanitise and escape some parametersCVE-2022-3609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
GetYourGuide Ticketing
Fixed in
1.0.4
What to do
Update GetYourGuide Ticketing to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022Add Comments: Does not sanitise and escape some of its settingsCVE-2022-3909 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Add Comments
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Add Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3858 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin.
Product
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button
Fixed in
3.0.3
What to do
Update Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button to 3.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022WPUpper Share Buttons: Does not sanitise and escape some of its settingsCVE-2022-3838 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WPUpper Share Buttons
Affected
up to 3.42
What to do
Affects up to 3.42. Update WPUpper Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022Uji Countdown: Does not sanitise and escape some of its settingsCVE-2022-3837 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Uji Countdown
Fixed in
2.3.1
What to do
Update Uji Countdown to 2.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022WP Page Builder: Does not sanitise and escape some of its settingsCVE-2022-3830 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
WP Page Builder
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update WP Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 5, 2022Advanced WP Columns: Does not sanitise and escape some of its settingsCVE-2022-3426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Advanced WP Columns
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update Advanced WP Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2022WordPress versions prior to 6.0.3: Cross-site scriptingCVE-2022-43500 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
Product
WordPress versions prior to 6.0.3
What to do
Update WordPress versions prior to 6.0.3 to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 4, 2022WordPress versions prior to 6.0.3: Cross-site scriptingCVE-2022-43497 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
Product
WordPress versions prior to 6.0.3
What to do
Update WordPress versions prior to 6.0.3 to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 4, 2022Salon booking system versions prior to 7.9: Cross-site scriptingCVE-2022-43487 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script.
Product
Salon booking system versions prior to 7.9
Fixed in
7.9
What to do
Update Salon booking system versions prior to 7.9 to 7.9 or newer.
Full record and what to do →NVD record jvn.jp wordpress.org
Dec 4, 2022Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress.CVE-2022-40968 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress.
Affected
up to 2.1.5
What to do
Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 2, 2022Chained Quiz: Stored Cross-Site ScriptingCVE-2022-4217 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Chained Quiz
Affected
up to 1.3.2.2
What to do
Affects up to 1.3.2.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Stored Cross-Site ScriptingCVE-2022-4216 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Chained Quiz
Affected
up to 1.3.2.2
What to do
Affects up to 1.3.2.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4215 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Chained Quiz
Affected
up to 1.3.2.3
What to do
Affects up to 1.3.2.3. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.