Vulnerability database

15,619 results · page 286 of 313

• Apr 18, 2022Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9CVE-2022-27853 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9

  Affected

  up to 13.1.0.9

  What to do

  Affects up to 13.1.0.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 15, 2022Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions.CVE-2022-27852 · WordPress plugins & themes · reported by PatchstackMedium 6.1

  Multiple Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilities in KB Support (WordPress plugin) <= 1.5.5 versions.

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 15, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions.CVE-2021-36828 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions.

  Affected

  up to 6.0.7

  What to do

  Affects up to 6.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 14, 2022Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1CVE-2022-27848 · WordPress plugins & themes · reported by PatchstackLow 3.4

  Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1

  Affected

  up to 6.5.1

  What to do

  Affects up to 6.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 12, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11.CVE-2021-36914 · WordPress plugins & themes · reported by PatchstackMedium 6.1

  Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS) in CalderaWP License Manager (WordPress plugin) <= 1.2.11.

  Affected

  up to 1.2.11

  What to do

  Affects up to 1.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.compatchstack.com

• Apr 11, 2022Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2CVE-2022-27845 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) in PlausibleHQ Plausible Analytics (WordPress plugin) <= 1.2.2

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 11, 2022Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion.CVE-2022-25615 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion.

  Affected

  up to 1.3.8

  What to do

  Affects up to 1.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 11, 2022Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings.CVE-2022-25614 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings.

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 11, 2022Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.CVE-2021-36910 · WordPress plugins & themes · reported by PatchstackLow 3.4

  Authenticated (admin user role) Stored Cross-Site Scripting (XSS) in WP-Appbox (WordPress plugin) <= 4.3.20.

  Affected

  up to 4.3.20

  What to do

  Affects up to 4.3.20. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 11, 2022Pricing Table: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS)CVE-2021-36896 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Pricing Table (WordPress plugin) versions <= 1.5.2

  Product

  Pricing Table

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update Pricing Table to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 11, 2022Responsive Tabs: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS)CVE-2021-36893 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Responsive Tabs (WordPress plugin) <= 4.0.5

  Product

  Responsive Tabs

  Affected

  up to 4.0.5

  What to do

  Affects up to 4.0.5. Update Responsive Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 11, 2022Social Media Feather: Authenticated (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36848 · WordPress plugins & themes · reported by PatchstackLow 3.4

  Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Feather (WordPress plugin) versions <= 2.0.4

  Product

  Social Media Feather

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update Social Media Feather to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 11, 2022Premio Chaty: Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS)CVE-2021-36846 · WordPress plugins & themes · reported by PatchstackMedium 4.8

  Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Premio Chaty (WordPress plugin) <= 2.8.3

  Product

  Premio Chaty

  Affected

  up to 2.8.3

  What to do

  Affects up to 2.8.3. Update Premio Chaty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 11, 2022Advanced Booking Calendar: Does not sanitise and escape the room parameter before outputting it back in an admin pageCVE-2022-1007 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

  Product

  Advanced Booking Calendar

  Fixed in

  1.7.1

  What to do

  Update Advanced Booking Calendar to 1.7.1 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Apr 11, 2022Image optimization & Lazy Load by Optimole: Does not sanitise and escape its "Lazyload background images for selectors" settingsCVE-2022-0969 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.

  Product

  Image optimization & Lazy Load by Optimole

  Fixed in

  3.3.2

  What to do

  Update Image optimization & Lazy Load by Optimole to 3.3.2 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Apr 11, 2022Export All URLs: Does not sanitise and escape the CSV filename before outputting it back in the pageCVE-2022-0892 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting

  Product

  Export All URLs

  Fixed in

  4.2

  What to do

  Update Export All URLs to 4.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 11, 2022Easy Smooth Scroll Links: Does not sanitise and escape its settingsCVE-2022-0728 · WordPress plugins & themes · reported by WPScanMedium 4.8

  The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

  Product

  Easy Smooth Scroll Links

  Fixed in

  2.23.1

  What to do

  Update Easy Smooth Scroll Links to 2.23.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 11, 2022Migration, Backup, Staging: Does not sanitise and escape the sub_page parameter before outputting it back in the pageCVE-2022-0531 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting

  Product

  Migration, Backup, Staging

  Fixed in

  0.9.70

  What to do

  Update Migration, Backup, Staging to 0.9.70 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 11, 2022Favicon by RealFaviconGenerator: Does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboardCVE-2022-0471 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue

  Product

  Favicon by RealFaviconGenerator

  Fixed in

  1.3.23

  What to do

  Update Favicon by RealFaviconGenerator to 1.3.23 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Apr 11, 2022Post Grid: Does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX actionCVE-2022-0447 · WordPress plugins & themes · reported by WPScanMedium 6.4

  The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting

  Product

  Post Grid

  Fixed in

  2.1.16

  What to do

  Update Post Grid to 2.1.16 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 11, 2022Nimble Page Builder: Does not sanitise and escape the preview-level-guid parameter before outputting it back in the pageCVE-2022-0314 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

  Product

  Nimble Page Builder

  Fixed in

  3.2.2

  What to do

  Update Nimble Page Builder to 3.2.2 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 11, 2022LearnPress: Does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX actionCVE-2022-0271 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting

  Product

  LearnPress

  Fixed in

  4.1.6

  What to do

  Update LearnPress to 4.1.6 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 11, 2022settings of the iQ Block Country: Can be exported or imported using its backup functionalityCVE-2022-0246 · WordPress plugins & themes · reported by WPScanMedium 4.9

  The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.

  Product

  settings of the iQ Block Country

  Fixed in

  1.2.13

  What to do

  Update settings of the iQ Block Country to 1.2.13 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 11, 2022Social Share, Social Login and Social Comments: Does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it CVE-2021-24987 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.

  Product

  Social Share, Social Login and Social Comments

  Fixed in

  7.13.30

  What to do

  Update Social Share, Social Login and Social Comments to 7.13.30 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 11, 2022Post Grid: Does not escape the keyword parameter before outputting it back in an attributeCVE-2021-24986 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form

  Product

  Post Grid

  Fixed in

  2.1.16

  What to do

  Update Post Grid to 2.1.16 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 4, 2022wpDataTables: Authenticated (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-25618 · WordPress plugins & themes · reported by PatchstackLow 3.4

  Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27

  Product

  wpDataTables

  Affected

  up to 2.1.27

  What to do

  Affects up to 2.1.27. Update wpDataTables to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 4, 2022FV Flowplayer Video Player: Authenticated Persistent Cross-Site Scripting (XSS)CVE-2022-25613 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.

  Product

  FV Flowplayer Video Player

  Affected

  up to 7.5.18.727

  What to do

  Affects up to 7.5.18.727. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 4, 2022Web-Settler Testimonial Slider – Free Testimonials Slider: Authenticated (editor or higher user role) Cross-Site Scripting (XSS)CVE-2021-36851 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin (WordPress plugin) via parameters mpsp_posts_bg_color, mpsp_posts_description_color, mpsp_slide_nav_button_color.

  Product

  Web-Settler Testimonial Slider – Free Testimonials Slider

  Affected

  up to 3.5.8.3

  What to do

  Affects up to 3.5.8.3. Update Web-Settler Testimonial Slider – Free Testimonials Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

• Apr 4, 2022Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager pluginCVE-2021-36826 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP Project Manager plugin <= 2.4.13 versions.

  Affected

  up to 2.4.13

  What to do

  Affects up to 2.4.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.compatchstack.com

• Apr 4, 2022There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.CVE-2022-1168 · WordPress plugins & themes · reported by WPScanMedium 6.1

  There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.

  Product

  JobSearch WP JobSearch

  Fixed in

  1.5.1

  What to do

  Update JobSearch WP JobSearch to 1.5.1 or newer.

  Full record and what to do →NVD recordcodecanyon.netwpscan.com

• Apr 4, 2022There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters.CVE-2022-1167 · WordPress plugins & themes · reported by WPScanMedium 6.1

  There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters.

  Fixed in

  2.3.1

  What to do

  Update the plugin to 2.3.1 or newer.

  Full record and what to do →NVD recordm0ze.ruthemeforest.net

• Apr 4, 2022The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess fCVE-2022-1166 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.

  Fixed in

  4.6.6.1

  What to do

  Update the plugin to 4.6.6.1 or newer.

  Full record and what to do →NVD recordthemeforest.netwpscan.com

• Apr 4, 2022The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to aCVE-2022-0901 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters

  Fixed in

  2.7.12

  What to do

  Update the plugin to 2.7.12 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com

• Apr 4, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_interval parameter before outputting it back in an admin pageCVE-2022-0864 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.

  Product

  UpdraftPlus WordPress Backup

  Fixed in

  1.22.9

  What to do

  Update UpdraftPlus WordPress Backup to 1.22.9 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com

• Apr 4, 2022Booking Package: Requires a token for exporting the ical representation of it's booking calendarCVE-2022-0709 · WordPress plugins & themes · reported by WPScanHigh 7.5

  The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.

  Product

  Booking Package

  Fixed in

  1.5.29

  What to do

  Update Booking Package to 1.5.29 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 4, 2022MapPress Maps for: Allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" functionCVE-2022-0537 · WordPress plugins & themes · reported by WPScanHigh 7.2

  The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.

  Product

  MapPress Maps for

  Fixed in

  2.73.13

  What to do

  Update MapPress Maps for to 2.73.13 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Apr 4, 2022Insights from Google PageSpeed: Does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboardCVE-2022-0431 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting

  Product

  Insights from Google PageSpeed

  Fixed in

  4.0.4

  What to do

  Update Insights from Google PageSpeed to 4.0.4 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com

• Mar 28, 2022Bulk Creator: Does not sanitize and escape the post_type parameter before outputting it back in an admin pageCVE-2022-0647 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

  Product

  Bulk Creator

  Affected

  up to 1.0.1

  What to do

  Affects up to 1.0.1. Update Bulk Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022Bank Mellat: Does not sanitize and escape the orderId parameter before outputting it back in an admin pageCVE-2022-0643 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

  Product

  Bank Mellat

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update Bank Mellat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022Popup Like box: Does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin pageCVE-2022-0641 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

  Product

  Popup Like box

  Fixed in

  3.6.1

  What to do

  Update Popup Like box to 3.6.1 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022dTabs: Does not sanitize and escape the tab parameter before outputting it back in an admin pageCVE-2022-0621 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

  Product

  dTabs

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update dTabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022Delete Old Orders: Does not sanitize and escape the date parameter before outputting it back in an admin pageCVE-2022-0620 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

  Product

  Delete Old Orders

  Affected

  up to 0.2

  What to do

  Affects up to 0.2. Update Delete Old Orders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022Database Peek: Does not sanitize and escape the match parameter before outputting it back in an admin pageCVE-2022-0619 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

  Product

  Database Peek

  Affected

  up to 1.2

  What to do

  Affects up to 1.2. Update Database Peek to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022Conference Scheduler: Does not sanitize and escape the tab parameter before outputting back in an admin pageCVE-2022-0600 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting.

  Product

  Conference Scheduler

  Fixed in

  2.4.3

  What to do

  Update Conference Scheduler to 2.4.3 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022Mapping Multiple URLs Redirect Same Page: Does not sanitize and escape the mmursp_id parameter before outputting it back in an admin pageCVE-2022-0599 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.

  Product

  Mapping Multiple URLs Redirect Same Page

  Affected

  up to 5.8

  What to do

  Affects up to 5.8. Update Mapping Multiple URLs Redirect Same Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user)CVE-2022-0397 · WordPress plugins & themes · reported by WPScanMedium 5.4

  The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting

  Product

  WPC Smart Wishlist for WooCommerce

  Fixed in

  2.9.4

  What to do

  Update WPC Smart Wishlist for WooCommerce to 2.9.4 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected CroCVE-2021-25071 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

  Product

  WordPress

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022Pz-LinkCard: Does not sanitise and escape multiple parameters before outputting them back in admin dashboard pagesCVE-2021-25012 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues

  Product

  Pz-LinkCard

  Affected

  up to 2.4.4.4

  What to do

  Affects up to 2.4.4.4. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 28, 2022Social Sharing: Does not escape the viewed post URL before outputting it back in onclick attributesCVE-2021-24746 · WordPress plugins & themes · reported by WPScanMedium 6.1

  The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.

  Product

  Social Sharing

  Fixed in

  3.3.40

  What to do

  Update Social Sharing to 3.3.40 or newer.

  Full record and what to do →NVD recordwpscan.comwpscan.com

• Mar 25, 2022Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higherCVE-2022-25612 · WordPress plugins & themes · reported by PatchstackMedium 4.1

  Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities in Simple Event Planner WordPress plugin <= 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &custom[event_organiser], &custom[organiser_email], &custom[organiser_contact].

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.comwordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.