Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

518new WordPress flaws this week

395,110entries in the database

16,061 results · page 278 of 322

Oct 21, 2023Add Custom Body Class: Stored Cross-Site ScriptingCVE-2023-5205 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Add Custom Body Class plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_custom_body_class' value in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Add Custom Body Class
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update Add Custom Body Class to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 21, 2023EventON: Reflected Cross-Site ScriptingCVE-2023-4635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The EventON plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
EventON
Affected
up to 2.2.2
What to do
Affects up to 2.2.2. Update EventON to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 20, 2023nsc: Reflected Cross-Site ScriptingCVE-2023-3965 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
nsc
Affected
up to 1.0
What to do
Affects up to 1.0. Update nsc to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Oct 20, 2023Winters: Reflected Cross-Site ScriptingCVE-2023-3962 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Winters theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Winters
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Winters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Oct 20, 2023Your Journey: Reflected Cross-Site ScriptingCVE-2023-3933 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Your Journey
Affected
up to 1.9.8
What to do
Affects up to 1.9.8. Update Your Journey to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Oct 20, 2023Modern Footnotes: Stored Cross-Site ScriptingCVE-2023-5618 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Modern Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 1.4.16 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Modern Footnotes
Affected
up to 1.4.16
What to do
Affects up to 1.4.16. Update Modern Footnotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Oct 20, 2023Skype Legacy Buttons: Stored Cross-Site ScriptingCVE-2023-5615 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Skype Legacy Buttons
Affected
up to 3.1
What to do
Affects up to 3.1. Update Skype Legacy Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Social Media Share Buttons & Social Sharing Icons: Cross-Site Request ForgeryCVE-2023-5602 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes it possible for unauthenticated attackers to invoke those actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Social Media Share Buttons & Social Sharing Icons
Affected
up to 2.8.5
What to do
Affects up to 2.8.5. Update Social Media Share Buttons & Social Sharing Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023AI ChatBot: Cross-Site Request ForgeryCVE-2023-5534 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is due to missing or incorrect nonce validation on the corresponding functions. This makes it possible for unauthenticated attackers to invoke those functions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
AI ChatBot
Affected
up to 4.8.9
What to do
Affects up to 4.8.9. Update AI ChatBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Contact form Form For All: Stored Cross-Site ScriptingCVE-2023-5337 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Contact form Form For All
Affected
up to 1.2
What to do
Affects up to 1.2. Update Contact form Form For All to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Advanced Custom Fields: Extended: Stored Cross-Site ScriptingCVE-2023-5292 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfe_form' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Advanced Custom Fields: Extended
Affected
up to 0.8.9.3
What to do
Affects up to 0.8.9.3. Update Advanced Custom Fields: Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Magic Action Box: Stored Cross-Site ScriptingCVE-2023-5231 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Magic Action Box
Affected
up to 2.17.2
What to do
Affects up to 2.17.2. Update Magic Action Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Migration, Backup, Staging – WPvivid: Stored Cross-Site ScriptingCVE-2023-5121 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings (the backup path parameter) in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.89
What to do
Affects up to 0.9.89. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023WP Mailto Links – Protect Email Addresses: Stored Cross-Site ScriptingCVE-2023-5109 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode in versions up to, and including, 3.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 3.1.3 and fully patched in version 3.1.4.
Product
WP Mailto Links – Protect Email Addresses
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update WP Mailto Links – Protect Email Addresses to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Copy Anything to Clipboard: Stored Cross-Site ScriptingCVE-2023-5086 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Copy Anything to Clipboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'copy' shortcode in versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Copy Anything to Clipboard
Affected
up to 2.6.4
What to do
Affects up to 2.6.4. Update Copy Anything to Clipboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Poptin: Stored Cross-Site ScriptingCVE-2023-4961 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Poptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'poptin-form' shortcode in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Poptin
Affected
up to 1.3
What to do
Affects up to 1.3. Update Poptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4926 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulk_delete_products function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4923 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_delete function. This makes it possible for unauthenticated attackers to delete products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023WP Customer Reviews: Stored Cross-Site ScriptingCVE-2023-4648 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Customer Reviews
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Modern Events Calendar lite: Stored Cross-Site ScriptingCVE-2023-4021 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Modern Events Calendar lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Google API key and Calendar ID in versions up to, but not including, 7.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Modern Events Calendar lite
Fixed in
7.1.0
What to do
Update Modern Events Calendar lite to 7.1.0 or newer.
Full record and what to do →NVD record webnus.net wordfence.com
Oct 20, 2023ARMember Lite - Membership: Stored Cross-Site ScriptingCVE-2023-3996 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
ARMember Lite - Membership
Affected
up to 4.0.16
What to do
Affects up to 4.0.16. Update ARMember Lite - Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.svn.wordpress.org plugins.svn.wordpress.org
Oct 20, 2023Custom CSS, JS & PHP: Cross-Site Request ForgeryCVE-2021-4418 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Custom CSS, JS & PHP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save code snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Custom CSS, JS & PHP
Affected
up to 2.0.7
What to do
Affects up to 2.0.7. Update Custom CSS, JS & PHP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Oct 20, 2023Woody code snippets: Cross-Site Request ForgeryCVE-2020-36759 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Woody code snippets
Affected
up to 2.3.9
What to do
Affects up to 2.3.9. Update Woody code snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Oct 20, 2023RSS Aggregator by Feedzy: Cross-Site Request ForgeryCVE-2020-36758 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the save_feedzy_post_type_meta() function. This makes it possible for unauthenticated attackers to update post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
RSS Aggregator by Feedzy
Affected
up to 3.4.2
What to do
Affects up to 3.4.2. Update RSS Aggregator by Feedzy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Oct 20, 2023Customizr: Cross-Site Request ForgeryCVE-2020-36755 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Customizr theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missing or incorrect nonce validation on the czr_fn_post_fields_save() function. This makes it possible for unauthenticated attackers to post fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Customizr
Affected
up to 4.3.0
What to do
Affects up to 4.3.0. Update Customizr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Oct 20, 2023Paid Memberships Pro: Cross-Site Request ForgeryCVE-2020-36754 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Paid Memberships Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.2. This is due to missing or incorrect nonce validation on the pmpro_page_save() function. This makes it possible for unauthenticated attackers to save pages via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Paid Memberships Pro
Affected
up to 2.4.2
What to do
Affects up to 2.4.2. Update Paid Memberships Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Oct 20, 2023Hueman: Cross-Site Request ForgeryCVE-2020-36753 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the save_meta_box() function. This makes it possible for unauthenticated attackers to save metabox data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Hueman
Affected
up to 3.6.3
What to do
Affects up to 3.6.3. Update Hueman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Oct 20, 2023Coupon Creator: Cross-Site Request ForgeryCVE-2020-36751 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_meta() function. This makes it possible for unauthenticated attackers to save meta fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Coupon Creator
Affected
up to 3.1
What to do
Affects up to 3.1. Update Coupon Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Oct 20, 2023Podcast Subscribe Buttons: Stored Cross-Site ScriptingCVE-2023-5308 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Podcast Subscribe Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'podcast_subscribe' shortcode in versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Podcast Subscribe Buttons
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Podcast Subscribe Buttons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023flowpaper: Stored Cross-Site ScriptingCVE-2023-5200 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The flowpaper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'flipbook' shortcode in versions up to, and including, 2.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
flowpaper
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update flowpaper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Migration, Backup, Staging – WPvivid: Stored Cross-Site ScriptingCVE-2023-5120 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image file path parameter in versions up to, and including, 0.9.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Migration, Backup, Staging – WPvivid
Affected
up to 0.9.89
What to do
Affects up to 0.9.89. Update Migration, Backup, Staging – WPvivid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Sitekit: Stored Cross-Site ScriptingCVE-2023-5071 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Sitekit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sitekit_iframe' shortcode in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Sitekit
Affected
up to 1.4
What to do
Affects up to 1.4. Update Sitekit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Leaflet Map: Stored Cross-Site ScriptingCVE-2023-5050 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Leaflet Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Leaflet Map
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Leaflet Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Website Builder by SeedProd: Cross-Site Request ForgeryCVE-2023-4975 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated attackers to change the stripe connect token via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Website Builder by SeedProd
Affected
up to 6.15.13.1
What to do
Affects up to 6.15.13.1. Update Website Builder by SeedProd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023WPLegalPages: Stored Cross-Site ScriptingCVE-2023-4968 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The WPLegalPages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wplegalpage' shortcode in versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with author-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPLegalPages
Affected
up to 2.9.2
What to do
Affects up to 2.9.2. Update WPLegalPages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4942 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_visibility function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4940 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4937 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_apply_default_combination function. This makes it possible for unauthenticated attackers to manipulate products via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4935 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the create_profile function. This makes it possible for unauthenticated attackers to create profiles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023BEAR: Cross-Site Request ForgeryCVE-2023-4920 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additionally, input sanitization and escaping is insufficient resulting in the possibility of malicious script injection.
Product
BEAR
Affected
up to 1.1.3.3
What to do
Affects up to 1.1.3.3. Update BEAR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023iframe: Stored Cross-Site ScriptingCVE-2023-4919 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `iframe` shortcode in versions up to, and including, 4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permission and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This was partially patched in version 4.6 and fully patched in version 4.7.
Product
iframe
Affected
up to 4.6
What to do
Affects up to 4.6. Update iframe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Auto Amazon Links: Stored Cross-Site ScriptingCVE-2023-4482 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Auto Amazon Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in versions up to, and including, 5.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Auto Amazon Links
Affected
up to 5.3.1
What to do
Affects up to 5.3.1. Update Auto Amazon Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Photospace Responsive: Stored Cross-Site ScriptingCVE-2023-4271 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Photospace Responsive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘psres_button_size’ parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Photospace Responsive
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Photospace Responsive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Waiting: One-click countdowns: Stored Cross-Site ScriptingCVE-2022-4954 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Waiting: One-click countdowns
Affected
up to 0.6.2
What to do
Affects up to 0.6.2. Update Waiting: One-click countdowns to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023WP Cerber Security: Stored cross-site scriptingCVE-2022-4712 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, and including, 9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Cerber Security
Affected
up to 9.1
What to do
Affects up to 9.1. Update WP Cerber Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023WhatsApp Share Button: Stored Cross-Site ScriptingCVE-2023-5668 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WhatsApp Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'whatsapp' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WhatsApp Share Button
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WhatsApp Share Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 20, 2023Theme Switcha: Stored Cross-Site ScriptingCVE-2023-5614 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Theme Switcha plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'theme_switcha_list' shortcode in all versions up to, and including, 3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Theme Switcha
Affected
up to 3.3
What to do
Affects up to 3.3. Update Theme Switcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 20, 2023Super Testimonials: Stored Cross-Site ScriptingCVE-2023-5613 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Super Testimonials
Affected
up to 2.9
What to do
Affects up to 2.9. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2023Team Showcase: Stored Cross-Site ScriptingCVE-2023-5639 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Team Showcase
Affected
up to 2.1
What to do
Affects up to 2.1. Update Team Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 18, 2023Booster for WooCommerce: Stored Cross-Site ScriptingCVE-2023-5638 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, and including, 7.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Booster for WooCommerce
Affected
up to 7.1.2
What to do
Affects up to 7.1.2. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.