Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,981 results · page 28 of 60
Sep 4, 2023Store Locator: Does not sanitise and escape an invalid nonce before outputting it back in an AJAX responseCVE-2023-4151 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Store Locator
- Fixed in
- 1.4.13
- What to do
- Update Store Locator to 1.4.13 or newer.
Sep 4, 2023Profile Builder: Lacks authorisation and CSRF in its page creation functionCVE-2023-4059 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog
- Product
- Profile Builder
- Fixed in
- 3.9.8
- What to do
- Update Profile Builder to 3.9.8 or newer.
Aug 31, 2023Order Tracking Pro: Stored Cross-Site ScriptingCVE-2023-4500 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers (admin or higher) to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Order Tracking Pro
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Order Tracking Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 31, 2023Order Tracking Pro: Reflected Cross-Site ScriptingCVE-2023-4471 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Order Tracking Pro
- Affected
- up to 3.3.6
- What to do
- Affects up to 3.3.6. Update Order Tracking Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2023User Activity Tracking and Log: Does not have proper CSRF checksCVE-2023-4150 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
- Product
- User Activity Tracking and Log
- Fixed in
- 4.0.9
- What to do
- Update User Activity Tracking and Log to 4.0.9 or newer.
Aug 30, 2023Simple Blog Card: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4035 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Blog Card WordPress plugin before 1.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Simple Blog Card
- Fixed in
- 1.31
- What to do
- Update Simple Blog Card to 1.31 or newer.
Aug 30, 2023PostX: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3992 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PostX WordPress plugin before 3.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- PostX
- Fixed in
- 3.0.6
- What to do
- Update PostX to 3.0.6 or newer.
Aug 21, 2023MultiParcels Shipping For WooCommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3954 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- MultiParcels Shipping For WooCommerce
- Fixed in
- 1.15.4
- What to do
- Update MultiParcels Shipping For WooCommerce to 1.15.4 or newer.
Aug 21, 2023Blog2Social: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3936 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Blog2Social
- Fixed in
- 7.2.1
- What to do
- Update Blog2Social to 7.2.1 or newer.
Aug 16, 2023Tiempo.com: Does not sanitise and escape the page parameter before outputting it back in the pageCVE-2023-2272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Tiempo.com
- Affected
- up to 0.1.2
- What to do
- Affects up to 0.1.2. Update Tiempo.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 16, 2023WP Inventory Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2123 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- WP Inventory Manager
- Fixed in
- 2.1.0.13
- What to do
- Update WP Inventory Manager to 2.1.0.13 or newer.
Aug 16, 2023WP EasyPay: Does not escape some generated URLs before outputting them back in pagesCVE-2023-1465 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP EasyPay WordPress plugin before 4.1 does not escape some generated URLs before outputting them back in pages, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
- Product
- WP EasyPay
- Fixed in
- 4.1
- What to do
- Update WP EasyPay to 4.1 or newer.
Aug 16, 2023Yellow Yard Searchbar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1110 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Yellow Yard Searchbar
- Fixed in
- 2.8.12
- What to do
- Update Yellow Yard Searchbar to 2.8.12 or newer.
Aug 16, 2023URL Params: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0274 · WordPress plugins & themes · reported by WPScanMedium 5.4
The URL Params WordPress plugin before 2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- URL Params
- Fixed in
- 2.5
- What to do
- Update URL Params to 2.5 or newer.
Aug 14, 2023Ultimate Addons for Contact Form 7: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2803 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Ultimate Addons for Contact Form 7
- Fixed in
- 3.1.29
- What to do
- Update Ultimate Addons for Contact Form 7 to 3.1.29 or newer.
Aug 12, 2023Premium Packages - Sell Digital Products Securely: Privilege escalationCVE-2023-4293 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update.
- Product
- Premium Packages - Sell Digital Products Securely
- Affected
- up to 5.7.4
- What to do
- Affects up to 5.7.4. Update Premium Packages - Sell Digital Products Securely to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not sanitise and escape various parameters before outputting it back in the pageCVE-2023-3671 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.4 does not sanitise and escape various parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- MultiParcels Shipping For WooCommerce
- Fixed in
- 1.15.4
- What to do
- Update MultiParcels Shipping For WooCommerce to 1.15.4 or newer.
Jul 17, 2023Popup by Supsystic: Has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into ObjectCVE-2023-3186 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.
- Product
- Popup by Supsystic
- Fixed in
- 1.10.19
- What to do
- Update Popup by Supsystic to 1.10.19 or newer.
Jul 17, 2023Membership: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3182 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Membership
- Fixed in
- 3.2.3
- What to do
- Update Membership to 3.2.3 or newer.
Jul 17, 2023Autochat Automatic Conversation: Does not sanitise and escape user input before outputting it back on the pageCVE-2023-3041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack.
- Product
- Autochat Automatic Conversation
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Autochat Automatic Conversation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 20233DPrint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-4023 · WordPress plugins & themes · reported by WPScanMedium 5.3
The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.
- Product
- 3DPrint
- Fixed in
- 3.5.6.9
- What to do
- Update 3DPrint to 3.5.6.9 or newer.
Jul 12, 2023WP-Backgrounds Lite: Cross-Site Request ForgeryCVE-2021-4419 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP-Backgrounds Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the ino_save_data() function. This makes it possible for unauthenticated attackers to save meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP-Backgrounds Lite
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update WP-Backgrounds Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <CVE-2023-37391 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <= 3.4.1 versions.
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 10, 2023Export All URLs: Does not sanitise and escape a parameter before outputting them back in the pageCVE-2023-3118 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Export All URLs
- Fixed in
- 4.6
- What to do
- Update Export All URLs to 4.6 or newer.
Jul 10, 2023EventON: Lacks authentication and authorization in its eventon_ics_download ajax actionCVE-2023-2796 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.
- Product
- EventON
- Fixed in
- 2.1.2
- What to do
- Update EventON to 2.1.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 10, 2023Companion Sitemap Generator: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-1780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Companion Sitemap Generator
- Fixed in
- 4.5.3
- What to do
- Update Companion Sitemap Generator to 4.5.3 or newer.
Jul 4, 2023Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2333 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro
- Affected
- up to 1.2.7
- Fixed in
- 1.2.7
- What to do
- Update Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro to 1.2.7 or newer.
Jul 4, 2023Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro: Does not escape some parameters before outputting them back in attributesCVE-2023-2324 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro WordPress plugin through 1.0.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro
- Affected
- up to 1.0.7
- Fixed in
- 1.0.7
- What to do
- Update Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro to 1.0.7 or newer.
Jul 4, 2023WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro
- Affected
- up to 3.4.6
- Fixed in
- 3.4.6
- What to do
- Update WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro to 3.4.6 or newer.
Jul 4, 2023CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro
- Affected
- up to 5.0.2
- Fixed in
- 5.0.2
- What to do
- Update CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro to 5.0.2 or newer.
Jul 4, 2023ND Shortcodes: Does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4623 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- ND Shortcodes
- Fixed in
- 7.0
- What to do
- Update ND Shortcodes to 7.0 or newer.
Jun 27, 2023Jetpack: Does not validate uploaded filesCVE-2023-2996 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
- Product
- Jetpack
- Fixed in
- 12.1.1
- What to do
- Update Jetpack to 12.1.1 or newer.
Jun 27, 2023ERP: Does not sanitise and escape the employee_name parameter before outputting it back in the pageCVE-2023-2743 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ERP
- Fixed in
- 1.12.4
- What to do
- Update ERP to 1.12.4 or newer.
Jun 27, 2023KiviCare: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2624 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023wpbrutalai: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2605 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
- Product
- wpbrutalai
- Fixed in
- 2.0.1
- What to do
- Update wpbrutalai to 2.0.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023Catalyst Connect Zoho CRM Client Portal: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2023-0588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
- Product
- Catalyst Connect Zoho CRM Client Portal
- Fixed in
- 2.1.0
- What to do
- Update Catalyst Connect Zoho CRM Client Portal to 2.1.0 or newer.
Jun 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide CrossCVE-2023-32960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).
- Affected
- up to 1.23.3
- What to do
- Affects up to 1.23.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 19, 2023Google Map Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-2899 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Google Map Shortcode
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Google Map Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023Social Share, Social Login and Social Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2779 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.52
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.52 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 19, 2023Conditional Menus: Does not escape a parameter before outputting it back in an attributeCVE-2023-2654 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Conditional Menus
- Fixed in
- 1.2.1
- What to do
- Update Conditional Menus to 1.2.1 or newer.
Jun 19, 2023SlideOnline: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0489 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- SlideOnline
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update SlideOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023Responsive Tabs For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0368 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2023Photo Gallery by Ays: Does not escape some parameters before outputting it back in attributesCVE-2023-2568 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Photo Gallery by Ays
- Fixed in
- 5.1.7
- What to do
- Update Photo Gallery by Ays to 5.1.7 or newer.
Jun 12, 2023Icegram Engage: Does not escape a parameter before outputting it back in an attributeCVE-2023-2398 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Icegram Engage
- Fixed in
- 3.1.12
- What to do
- Update Icegram Engage to 3.1.12 or newer.
Jun 6, 2023uListing: Authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validatedCVE-2021-4370 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to conduct numerous administrative actions, including those less critical than the explicitly outlined ones in our detection.
- Product
- uListing
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update uListing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.complugins.trac.wordpress.org
Jun 6, 2023The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticCVE-2021-4347 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 6, 2023WPS Hide Login: Login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sitesCVE-2020-36710 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.
- Product
- WPS Hide Login
- Affected
- up to 1.5.4.2
- What to do
- Affects up to 1.5.4.2. Update WPS Hide Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordfence.com
Jun 5, 2023Survey Maker: Does not escape some parameters before outputting them back in attributesCVE-2023-2572 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Survey Maker
- Fixed in
- 3.4.7
- What to do
- Update Survey Maker to 3.4.7 or newer.
Jun 5, 2023Quiz Maker: Does not escape some parameters before outputting them back in attributesCVE-2023-2571 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Quiz Maker
- Fixed in
- 6.4.2.7
- What to do
- Update Quiz Maker to 6.4.2.7 or newer.
Jun 5, 202310Web Social Post Feed: Does not sanitise and escape some parameter before outputting it back in a pageCVE-2023-2503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- 10Web Social Post Feed
- Fixed in
- 1.2.9
- What to do
- Update 10Web Social Post Feed to 1.2.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.