Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,619 results · page 281 of 313
Aug 22, 2022Simple Job Board: Is susceptible to Directory ListingCVE-2022-2558 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations.
- Product
- Simple Job Board
- Fixed in
- 2.10.0
- What to do
- Update Simple Job Board to 2.10.0 or newer.
Aug 22, 2022Feed Them Social: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2532 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Feed Them Social
- Fixed in
- 3.0.1
- What to do
- Update Feed Them Social to 3.0.1 or newer.
Aug 22, 2022WP phpMyAdmin: Does not escape some of its settingsCVE-2022-2407 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP phpMyAdmin
- Fixed in
- 5.2.0.4
- What to do
- Update WP phpMyAdmin to 5.2.0.4 or newer.
Aug 22, 2022Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami: Does not have authorisation and CSRF checks in one of its AJAX actionCVE-2022-2389 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations
- Product
- Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami
- Fixed in
- 2.1.2
- What to do
- Update Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami to 2.1.2 or newer.
Aug 22, 2022Feed Them Social: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2383 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Feed Them Social
- Fixed in
- 3.0.1
- What to do
- Update Feed Them Social to 3.0.1 or newer.
Aug 22, 2022Download Manager: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-2362 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based download blocking restrictions.
- Product
- Download Manager
- Fixed in
- 3.2.50
- What to do
- Update Download Manager to 3.2.50 or newer.
Aug 22, 2022WP Social Chat: Does not sanitise and escape some of its settingsCVE-2022-2361 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks.
- Product
- WP Social Chat
- Fixed in
- 6.0.5
- What to do
- Update WP Social Chat to 6.0.5 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not validate its debug settingsCVE-2022-25812 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Aug 22, 2022Rezgo Online Booking: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2022-1932 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file
- Product
- Rezgo Online Booking
- Fixed in
- 4.1.8
- What to do
- Update Rezgo Online Booking to 4.1.8 or newer.
Aug 22, 2022Coming Soon - Under Construction: Does not sanitize and escape some of its settingsCVE-2022-1322 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Coming Soon - Under Construction
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Coming Soon - Under Construction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 22, 2022Simple Banner: Does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks evenCVE-2022-0446 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Banner
- Fixed in
- 2.12.0
- What to do
- Update Simple Banner to 2.12.0 or newer.
Aug 22, 2022Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.CVE-2021-36857 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (editor+) Stored Cross-Site Scripting (XSS) vulnerability in wpshopmart Testimonial Builder plugin <= 1.6.1 at WordPress.
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 22, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.CVE-2021-36847 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebbaPlugins Webba Booking plugin <= 4.2.21 at WordPress.
- Affected
- up to 4.2.21
- What to do
- Affects up to 4.2.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 15, 2022Digital Publications by Supsystic: Does not sanitise and escape its settingsCVE-2022-2384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Digital Publications by Supsystic WordPress plugin before 1.7.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Digital Publications by Supsystic
- Fixed in
- 1.7.4
- What to do
- Update Digital Publications by Supsystic to 1.7.4 or newer.
Aug 15, 2022Easy Student Results: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2378 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Student Results WordPress plugin through 2.2.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Easy Student Results
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Easy Student Results to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 15, 2022Duplicate Page and Post: Does not sanitise and escape its settingsCVE-2022-2152 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Duplicate Page and Post
- Fixed in
- 2.8
- What to do
- Update Duplicate Page and Post to 2.8 or newer.
Aug 15, 2022Contact Form DB: Does not sanitise and escape some parameters before outputting them back in attributesCVE-2022-2116 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Contact Form DB
- Fixed in
- 1.8.0
- What to do
- Update Contact Form DB to 1.8.0 or newer.
Aug 8, 2022WPDating: Does not properly escape user input before concatenating it to certain SQL queriesCVE-2022-2460 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users
- Product
- WPDating
- Fixed in
- 7.4.0
- What to do
- Update WPDating to 7.4.0 or newer.
Aug 8, 2022Thinkific Uploader: Does not sanitise and escape its settingsCVE-2022-2426 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.
- Product
- Thinkific Uploader
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Thinkific Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022WP DS Blog Map: Does not sanitise and escape some of its settingsCVE-2022-2425 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP DS Blog Map
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update WP DS Blog Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Google Maps Anywhere: Does not sanitise and escape any of its settingsCVE-2022-2424 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Google Maps Anywhere
- Affected
- up to 1.2.6.3
- What to do
- Affects up to 1.2.6.3. Update Google Maps Anywhere to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022DW Promobar: Does not sanitise and escape some of its settingsCVE-2022-2423 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DW Promobar
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update DW Promobar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Better Tag Cloud: Does not sanitise and escape some of its settingsCVE-2022-2412 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Better Tag Cloud WordPress plugin through 0.99.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Better Tag Cloud
- Affected
- up to 0.99.5
- What to do
- Affects up to 0.99.5. Update Better Tag Cloud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Auto More Tag: Does not sanitise and escape some of its settingsCVE-2022-2411 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Auto More Tag
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Auto More Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022mTouch Quiz: Does not sanitise and escape some of its settingsCVE-2022-2410 · WordPress plugins & themes · reported by WPScanMedium 4.8
The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- mTouch Quiz
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update mTouch Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022weForms: Does not sanitise and escape its settingsCVE-2022-2395 · WordPress plugins & themes · reported by WPScanMedium 4.8
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- weForms
- Fixed in
- 1.6.14
- What to do
- Update weForms to 1.6.14 or newer.
Aug 8, 2022Crowdsignal Dashboard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2386 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Crowdsignal Dashboard
- Fixed in
- 3.0.8
- What to do
- Update Crowdsignal Dashboard to 3.0.8 or newer.
Aug 8, 2022YaySMTP: Does not sanitise and escape some of its settingsCVE-2022-2372 · WordPress plugins & themes · reported by WPScanMedium 4.8
The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- YaySMTP
- Fixed in
- 2.2.2
- What to do
- Update YaySMTP to 2.2.2 or newer.
Aug 1, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPCVE-2022-36343 · WordPress plugins & themes · reported by PatchstackLow 3.4
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress.
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Aug 1, 2022YaySMTP: Does not have capability check before displaying the Mailer Credentials in JS code for the settingsCVE-2022-2370 · WordPress plugins & themes · reported by WPScanMedium 6.5
The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 1, 2022Flexi Quote Rotator: Does not sanitise and escape its settingsCVE-2022-2328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flexi Quote Rotator
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Flexi Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Invitation Based Registrations: Does not sanitise and escape some of its settingsCVE-2022-2325 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Invitation Based Registrations
- Affected
- up to 2.2.84
- What to do
- Affects up to 2.2.84. Update Invitation Based Registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022WordPress Popup: Does not sanitise and escape some of its settingsCVE-2022-2305 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Popup
- Affected
- up to 1.9.3.8
- What to do
- Affects up to 1.9.3.8. Update WordPress Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022GiveWP: Does not properly sanitise and escape the currency settingsCVE-2022-2215 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GiveWP
- Fixed in
- 2.21.3
- What to do
- Update GiveWP to 2.21.3 or newer.
Aug 1, 2022Advanced WordPress Reset: Does not escape some generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2181 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced WordPress Reset
- Fixed in
- 1.6
- What to do
- Update Advanced WordPress Reset to 1.6 or newer.
Aug 1, 2022Microsoft Advertising Universal Event Tracking (UET): Does not sanitise and escape its settingsCVE-2022-2170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
- Product
- Microsoft Advertising Universal Event Tracking (UET)
- Fixed in
- 1.0.4
- What to do
- Update Microsoft Advertising Universal Event Tracking (UET) to 1.0.4 or newer.
Aug 1, 2022Copyright Proof: Does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-1906 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
- Product
- Copyright Proof
- Affected
- up to 4.16
- What to do
- Affects up to 4.16. Update Copyright Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022YOP Poll: Prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDRCVE-2022-1600 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
- Product
- YOP Poll
- Fixed in
- 6.4.3
- What to do
- Update YOP Poll to 6.4.3 or newer.
Aug 1, 2022Login with phone number: Does not sanitise and escape plugin settingsCVE-2022-0598 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Login with phone number
- Fixed in
- 1.3.8
- What to do
- Update Login with phone number to 1.3.8 or newer.
Jul 29, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress.CVE-2022-36378 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress.
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 28, 2022Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.CVE-2022-35882 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial Slider plugin <= 1.9.5 at WordPress.
- Affected
- up to 1.9.5
- What to do
- Affects up to 1.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 27, 2022Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress.CVE-2022-33943 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor or higher user role) Cross-Site Scripting (XSS) vulnerability in Nico Amarilla's BxSlider WP plugin <= 2.0.0 at WordPress.
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 25, 2022Simple Page Transition: Does not sanitise and escape some of its settingsCVE-2022-2341 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Page Transition
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Simple Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 25, 2022Request a Quote: Does not sanitise and escape some of its settingsCVE-2022-2239 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Request a Quote
- Fixed in
- 2.3.9
- What to do
- Update Request a Quote to 2.3.9 or newer.
Jul 25, 2022Unyson: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2219 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Unyson
- Fixed in
- 2.7.27
- What to do
- Update Unyson to 2.7.27 or newer.
Jul 25, 2022WP Video Lightbox: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- WP Video Lightbox
- Fixed in
- 1.9.5
- What to do
- Update WP Video Lightbox to 1.9.5 or newer.
Jul 25, 2022Popup Anything: Does not sanitise and escape a parameter before outputting it back in a frontend pageCVE-2022-2115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting
- Product
- Popup Anything
- Fixed in
- 2.1.7
- What to do
- Update Popup Anything to 2.1.7 or newer.
Jul 25, 2022Name Directory: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2072 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well
- Product
- Name Directory
- Fixed in
- 1.25.3
- What to do
- Update Name Directory to 1.25.3 or newer.
Jul 25, 2022Header Footer Code Manager: Does not escape generated URLs before outputting them back in attributes in an admin pageCVE-2022-0899 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Header Footer Code Manager
- Fixed in
- 1.1.24
- What to do
- Update Header Footer Code Manager to 1.1.24 or newer.
Jul 22, 2022Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.CVE-2022-34853 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.