Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,619 results · page 279 of 313
Sep 30, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.CVE-2021-36830 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.
- Affected
- up to 0.8.0
- What to do
- Affects up to 0.8.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 26, 2022SEO Smart Links: Does not sanitise and escape some of its settingsCVE-2022-3135 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SEO Smart Links
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update SEO Smart Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Generate PDF: Does not sanitise and escape its settingsCVE-2022-3070 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Generate PDF
- Fixed in
- 3.6
- What to do
- Update Generate PDF to 3.6 or newer.
Sep 26, 2022WordLift: Does not sanitise and escape its settingsCVE-2022-3069 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordLift
- Fixed in
- 3.37.2
- What to do
- Update WordLift to 3.37.2 or newer.
Sep 26, 2022Simple File List: Does not escape parameters before outputting them back in attributesCVE-2022-3062 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Simple File List
- Fixed in
- 4.4.12
- What to do
- Update Simple File List to 4.4.12 or newer.
Sep 26, 2022Download Manager: Does not validate one of its settingsCVE-2022-2926 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory
- Product
- Download Manager
- Fixed in
- 3.2.55
- What to do
- Update Download Manager to 3.2.55 or newer.
Sep 26, 2022WP Popup Builder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2404 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Popup Builder
- Fixed in
- 1.2.9
- What to do
- Update WP Popup Builder to 1.2.9 or newer.
Sep 26, 2022Restricted Site Access: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1613 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations.
- Product
- Restricted Site Access
- Fixed in
- 7.3.2
- What to do
- Update Restricted Site Access to 7.3.2 or newer.
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change.CVE-2022-40132 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change.
- Affected
- up to 2.16.0
- What to do
- Affects up to 2.16.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress.CVE-2022-36340 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress.
- Affected
- up to 1.2.49.0
- What to do
- Affects up to 1.2.49.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.complugins.svn.wordpress.org
Sep 23, 2022Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress.CVE-2022-40215 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress.
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.CVE-2022-36417 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress.
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.CVE-2022-40672 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress.
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress.CVE-2022-40671 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress.
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Rate my Post – WP Rating System plugin <= 3.3.4 at: Authenticated (subscriber+) Race ConditionCVE-2022-40310 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to increase/decrease votes.
- Product
- Rate my Post – WP Rating System plugin <= 3.3.4 at
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Rate my Post – WP Rating System plugin <= 3.3.4 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.CVE-2022-40195 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress.
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.CVE-2022-40193 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.CVE-2022-38460 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.CVE-2022-37342 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress.
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.CVE-2022-37328 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress.
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.CVE-2022-36791 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress.
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.CVE-2022-35238 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.
- Affected
- up to 1.9.7
- What to do
- Affects up to 1.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.CVE-2022-40213 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.
- Affected
- up to 1.9.6
- What to do
- Affects up to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Wordfence Security – Firewall & Malware Scan: Stored Cross-Site ScriptingCVE-2022-3144 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a setting on the options page due to insufficient escaping on the stored value. This makes it possible for authenticated users, with administrative privileges, to inject malicious web scripts into the setting that executes whenever a user accesses a page displaying the affected setting on sites running a vulnerable version.
- Product
- Wordfence Security – Firewall & Malware Scan
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update Wordfence Security – Firewall & Malware Scan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 23, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPressCVE-2022-38703 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress
- Affected
- up to 9.2
- What to do
- Affects up to 9.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.CVE-2022-37339 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress.
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.CVE-2022-37338 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress.
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress.CVE-2022-37330 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress.
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 23, 2022Image Hover Effects Ultimate: Stored Cross-Site ScriptingCVE-2022-2937 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, the plugin only allows administrators access to edit Image Hovers, however, if a site admin makes the plugin's features available to lower privileged users through the 'Who Can Edit?' setting then this can be exploited by those users.
- Product
- Image Hover Effects Ultimate
- Affected
- up to 9.7.3
- What to do
- Affects up to 9.7.3. Update Image Hover Effects Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 21, 2022Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.CVE-2022-38073 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.
- Affected
- up to 6.0.7
- What to do
- Affects up to 6.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 21, 2022Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.CVE-2022-36390 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 21, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress.CVE-2022-36383 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress.
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 21, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Crossword plugin <= 1.1.10 at WordPress.CVE-2022-36365 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Crossword plugin <= 1.1.10 at WordPress.
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 19, 2022Gettext override translations: Does not sanitise and escape some of its settingsCVE-2022-3036 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Gettext override translations
- Fixed in
- 2.0.0
- What to do
- Update Gettext override translations to 2.0.0 or newer.
Sep 19, 2022Slickr Flickr: Does not sanitise and escape its settingsCVE-2022-3021 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Slickr Flickr
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Slickr Flickr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022Scroll To Top: Does not escape some of its settingsCVE-2022-2710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Scroll To Top
- Fixed in
- 1.4.1
- What to do
- Update Scroll To Top to 1.4.1 or newer.
Sep 19, 2022Float to Top Button: Does not escape some of its settingsCVE-2022-2709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Float to Top Button
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Float to Top Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022Form Builder CP: Does not sanitise and escape some of its form settingsCVE-2022-2567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Form Builder CP
- Fixed in
- 1.2.32
- What to do
- Update Form Builder CP to 1.2.32 or newer.
Sep 16, 2022WP Server Health Stats: Does not escape some of its settingsCVE-2022-2887 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Server Health Stats
- Fixed in
- 1.7.0
- What to do
- Update WP Server Health Stats to 1.7.0 or newer.
Sep 16, 2022Affiliates Manager: Does not sanitise and escape some of its settingsCVE-2022-2799 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Affiliates Manager
- Fixed in
- 2.9.14
- What to do
- Update Affiliates Manager to 2.9.14 or newer.
Sep 16, 2022WP STAGING: Does not sanitise and escape some of its settingsCVE-2022-2737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP STAGING
- Fixed in
- 2.9.18
- What to do
- Update WP STAGING to 2.9.18 or newer.
Sep 16, 2022WP Taxonomy Import: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2669 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Taxonomy Import
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP Taxonomy Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2022Classified Listing Pro: Does not escape a generated URL before outputting it back in an attribute in an admin pageCVE-2022-2655 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Classified Listing Pro
- Fixed in
- 2.0.20
- What to do
- Update Classified Listing Pro to 2.0.20 or newer.
Sep 16, 2022Classima: And some of its required plugins (Classified Listing before 2CVE-2022-2654 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified Listing Store & Membership before 1.4.20 and Classima Core before 1.10) do not escape a parameter before outputting it back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Classima
- Fixed in
- 2.1.11
- What to do
- Update Classima to 2.1.11 or newer.
Sep 16, 2022Autoptimize: Does not sanitise and escape some of its settingsCVE-2022-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Autoptimize
- Fixed in
- 3.1.1
- What to do
- Update Autoptimize to 3.1.1 or newer.
Sep 16, 2022WBW Currency Switcher for WooCommerce: Does not sanitise and escape some of its settingsCVE-2022-2575 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WBW Currency Switcher for WooCommerce
- Fixed in
- 1.6.6
- What to do
- Update WBW Currency Switcher for WooCommerce to 1.6.6 or newer.
Sep 16, 2022Post SMTP Mailer/Email Log: Does not escape some of its settings before outputting them in the admins dashboardCVE-2022-2351 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.4
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.4 or newer.
Sep 9, 2022Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.CVE-2022-40191 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in Ali Khallad's Contact Form By Mega Forms plugin <= 1.2.4 at WordPress.
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 9, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.CVE-2022-38068 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 9, 2022Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.CVE-2022-38058 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.