Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,619 results · page 277 of 313
Dec 12, 2022FlatPM: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2022-3934 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- FlatPM
- Fixed in
- 3.0.13
- What to do
- Update FlatPM to 3.0.13 or newer.
Dec 12, 2022Listingo: Does not validate files to be uploaded via an AJAX action available to unauthenticated usersCVE-2022-3921 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
- Product
- Listingo
- Fixed in
- 3.2.7
- What to do
- Update Listingo to 3.2.7 or newer.
Dec 12, 2022Jetpack CRM: Does not sanitise and escape its settingsCVE-2022-3919 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Jetpack CRM
- Fixed in
- 5.4.3
- What to do
- Update Jetpack CRM to 5.4.3 or newer.
Dec 12, 2022Helloprint: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-3908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Helloprint
- Fixed in
- 1.4.7
- What to do
- Update Helloprint to 1.4.7 or newer.
Dec 12, 2022Easy Form Builder: Does not sanitise and escape some of its settingsCVE-2022-3906 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Easy Form Builder
- Fixed in
- 3.4.0
- What to do
- Update Easy Form Builder to 3.4.0 or newer.
Dec 12, 2022Livemesh Addons for Elementor: Does not sanitise and escape some of its settingsCVE-2022-3862 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Livemesh Addons for Elementor
- Fixed in
- 7.2.4
- What to do
- Update Livemesh Addons for Elementor to 7.2.4 or newer.
Dec 12, 2022Cross-site Scripting (XSS) is a client-side code injection attack.CVE-2022-3853 · WordPress plugins & themes · reported by WPScanMedium 5.4
Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application.
- Affected
- up to 4.0.3
- What to do
- Affects up to 4.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2022GetYourGuide Ticketing: Does not sanitise and escape some parametersCVE-2022-3609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GetYourGuide Ticketing
- Fixed in
- 1.0.4
- What to do
- Update GetYourGuide Ticketing to 1.0.4 or newer.
Dec 5, 2022Add Comments: Does not sanitise and escape some of its settingsCVE-2022-3909 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Add Comments
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Add Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3858 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin.
- Product
- Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button
- Fixed in
- 3.0.3
- What to do
- Update Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button to 3.0.3 or newer.
Dec 5, 2022WPUpper Share Buttons: Does not sanitise and escape some of its settingsCVE-2022-3838 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WPUpper Share Buttons
- Affected
- up to 3.42
- What to do
- Affects up to 3.42. Update WPUpper Share Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022Uji Countdown: Does not sanitise and escape some of its settingsCVE-2022-3837 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Uji Countdown
- Fixed in
- 2.3.1
- What to do
- Update Uji Countdown to 2.3.1 or newer.
Dec 5, 2022WP Page Builder: Does not sanitise and escape some of its settingsCVE-2022-3830 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Page Builder
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update WP Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 5, 2022Advanced WP Columns: Does not sanitise and escape some of its settingsCVE-2022-3426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Advanced WP Columns
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Advanced WP Columns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 4, 2022WordPress versions prior to 6.0.3: Cross-site scriptingCVE-2022-43500 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
- Product
- WordPress versions prior to 6.0.3
- What to do
- Update WordPress versions prior to 6.0.3 to the newest version.
Dec 4, 2022WordPress versions prior to 6.0.3: Cross-site scriptingCVE-2022-43497 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
- Product
- WordPress versions prior to 6.0.3
- What to do
- Update WordPress versions prior to 6.0.3 to the newest version.
Dec 4, 2022Salon booking system versions prior to 7.9: Cross-site scriptingCVE-2022-43487 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script.
- Product
- Salon booking system versions prior to 7.9
- Fixed in
- 7.9
- What to do
- Update Salon booking system versions prior to 7.9 to 7.9 or newer.
Dec 4, 2022Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress.CVE-2022-40968 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress.
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 2, 2022Chained Quiz: Stored Cross-Site ScriptingCVE-2022-4217 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Chained Quiz
- Affected
- up to 1.3.2.2
- What to do
- Affects up to 1.3.2.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Stored Cross-Site ScriptingCVE-2022-4216 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Chained Quiz
- Affected
- up to 1.3.2.2
- What to do
- Affects up to 1.3.2.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4215 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Chained Quiz
- Affected
- up to 1.3.2.3
- What to do
- Affects up to 1.3.2.3. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4214 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Chained Quiz
- Affected
- up to 1.3.2.3
- What to do
- Affects up to 1.3.2.3. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4213 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Chained Quiz
- Affected
- up to 1.3.2.2
- What to do
- Affects up to 1.3.2.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4212 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Chained Quiz
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4211 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Chained Quiz
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4210 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Chained Quiz
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4209 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Chained Quiz
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Dec 2, 2022Chained Quiz: Reflected Cross-Site ScriptingCVE-2022-4208 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Chained Quiz
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Chained Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Nov 29, 2022Simple:Press: Reflected Cross-Site ScriptingCVE-2022-4029 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This would be highly complex to exploit as it would require the attacker to set the cookie a cookie for the targeted user.
- Product
- Simple:Press
- Affected
- up to 6.8
- What to do
- Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 29, 2022Simple:Press: Stored Cross-Site ScriptingCVE-2022-4028 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for authenticated attackers, with minimal permissions, such as a subscriber to inject arbitrary web scripts in pages when modifying a profile signature that will execute whenever a user accesses an injected page.
- Product
- Simple:Press
- Affected
- up to 6.8
- What to do
- Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 29, 2022Simple:Press: Stored Cross-Site ScriptingCVE-2022-4027 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes injecting object and embed tags possible. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages when responding to forum threads that will execute whenever a user accesses an injected page.
- Product
- Simple:Press
- Affected
- up to 6.8
- What to do
- Affects up to 6.8. Update Simple:Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 29, 2022Photospace Gallery: Stored Cross-Site ScriptingCVE-2022-3991 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Photospace Gallery
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Photospace Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 29, 2022WP Affiliate Platform: Stored Cross-Site ScriptingCVE-2022-3897 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Affiliate Platform
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtipsandtricks-hq.comwordfence.com
Nov 29, 2022WP Affiliate Platform: Reflected Cross-Site ScriptingCVE-2022-3896 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is unlikely to work in modern browsers.
- Product
- WP Affiliate Platform
- Affected
- up to 6.3.9
- What to do
- Affects up to 6.3.9. Update WP Affiliate Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordtipsandtricks-hq.comwordfence.com
Nov 28, 2022Analytics for WP: Does not sanitise and escape some of its settingsCVE-2022-3839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Analytics for WP WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Analytics for WP
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Analytics for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Google Forms: Does not sanitise and escape some of its settingsCVE-2022-3834 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Google Forms
- Affected
- up to 0.95
- What to do
- Affects up to 0.95. Update Google Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Fancier Author Box by ThematoSoup: Does not sanitise and escape some of its settingsCVE-2022-3833 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Fancier Author Box by ThematoSoup
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Fancier Author Box by ThematoSoup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022reCAPTCHA: Does not sanitise and escape some of its settingsCVE-2022-3831 · WordPress plugins & themes · reported by WPScanMedium 4.8
The reCAPTCHA WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- reCAPTCHA
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Video Thumbnails: Does not sanitise and escape some of its settingsCVE-2022-3828 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Video Thumbnails
- Affected
- up to 2.12.3
- What to do
- Affects up to 2.12.3. Update Video Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022WP Admin UI Customize: Does not sanitise and escape some of its settingsCVE-2022-3824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Admin UI Customize
- Fixed in
- 1.5.13
- What to do
- Update WP Admin UI Customize to 1.5.13 or newer.
Nov 28, 2022Beautiful Cookie Consent Banner: Does not sanitise and escape some of its settingsCVE-2022-3823 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Beautiful Cookie Consent Banner
- Fixed in
- 2.9.1
- What to do
- Update Beautiful Cookie Consent Banner to 2.9.1 or newer.
Nov 28, 2022Donations via PayPal: Does not sanitise and escape some of its settingsCVE-2022-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Donations via PayPal
- Fixed in
- 1.9.9
- What to do
- Update Donations via PayPal to 1.9.9 or newer.
Nov 28, 2022Jeeng Push Notifications: Does not sanitise and escape some of its settingsCVE-2022-3610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Jeeng Push Notifications
- Fixed in
- 2.0.4
- What to do
- Update Jeeng Push Notifications to 2.0.4 or newer.
Nov 28, 2022Image Hover Effects Css3: Does not sanitise and escape some of its settingsCVE-2022-3601 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Hover Effects Css3
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update Image Hover Effects Css3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Checkout Field Editor (Checkout Manager) for WooCommerce: Unserializes user input provided via the settingsCVE-2022-3490 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
- Product
- Checkout Field Editor (Checkout Manager) for WooCommerce
- Fixed in
- 1.8.0
- What to do
- Update Checkout Field Editor (Checkout Manager) for WooCommerce to 1.8.0 or newer.
Nov 28, 2022Salat Times: Does not sanitize and escapes its settingsCVE-2022-2983 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Salat Times
- Fixed in
- 3.2.2
- What to do
- Update Salat Times to 3.2.2 or newer.
Nov 28, 2022Find and Replace All: Does not sanitize and escape some parameters from its setting page before outputting them back to the userCVE-2022-2311 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 21, 2022Evaluate: Does not sanitize and escapes some of its settingsCVE-2022-3753 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Evaluate
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Evaluate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2022The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.CVE-2022-3750 · WordPress plugins & themes · reported by WPScanMedium 4.7
The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.
- Fixed in
- 6.8.7
- What to do
- Update the plugin to 6.8.7 or newer.
Nov 21, 2022Spacer: Does not sanitize and escapes some of its settingsCVE-2022-3618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Spacer
- Fixed in
- 3.0.7
- What to do
- Update Spacer to 3.0.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.