Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

3,184 results · page 33 of 64

Jan 16, 2024Font Awesome 4 Menus: Does not sanitise and escape some of its settingsCVE-2022-3829 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Font Awesome 4 Menus
Affected
up to 4.7.0
What to do
Affects up to 4.7.0. Update Font Awesome 4 Menus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WP Best Quiz: Does not sanitize and escape some parametersCVE-2022-3739 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Best Quiz WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.
Product
WP Best Quiz
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Best Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Slide Anything: Does not properly sanitize or escape the slide title before outputting it in the admin pagesCVE-2022-2413 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfiltered_html capability is disabled.
Product
Slide Anything
Fixed in
2.3.47
What to do
Update Slide Anything to 2.3.47 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Contact Form & Lead Form Elementor Builder: Does not escape some of its form fields before outputting them in attributesCVE-2022-23179 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Contact Form & Lead Form Elementor Builder
Fixed in
1.7.0
What to do
Update Contact Form & Lead Form Elementor Builder to 1.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Super Forms - Drag & Drop Form Builder: Does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX actionCVE-2022-0402 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX action, leading to a Reflected Cross-Site Scripting. The action is also lacking CSRF, making the attack easier to perform against any user.
Product
Super Forms - Drag & Drop Form Builder
Fixed in
6.0.4
What to do
Update Super Forms - Drag & Drop Form Builder to 6.0.4 or newer.
Full record and what to do →NVD record github.com wpscan.com
Jan 16, 2024WP Fastest Cache: Does not escape user input in the set_urls_with_terms method before using it in a SQL statementCVE-2021-24869 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before using it in a SQL statement, leading to an SQL injection exploitable by low privilege users such as subscriber
Product
WP Fastest Cache
Fixed in
0.9.5
What to do
Update WP Fastest Cache to 0.9.5 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Jan 16, 2024Qyrr: Does not escape the data-uri of the QR CodeCVE-2021-24559 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue.
Product
Qyrr
Fixed in
0.7
What to do
Update Qyrr to 0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024Keap Official Opt-in Forms: Does not sanitise and escape some of its settingsCVE-2023-6941 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Keap Official Opt-in Forms WordPress plugin through 1.0.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Product
Keap Official Opt-in Forms
Affected
up to 1.0.11
What to do
Affects up to 1.0.11. Update Keap Official Opt-in Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024POST SMTP Mailer: Does not properly sanitise and escape several parameters before using them in SQL statementsCVE-2023-6620 · WordPress plugins & themes · reported by WPScanHigh 7.2
The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin.
Product
POST SMTP Mailer
Fixed in
2.8.7
What to do
Update POST SMTP Mailer to 2.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-6163 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Crowdfunding
Fixed in
2.1.10
What to do
Update WP Crowdfunding to 2.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024WP Custom Widget area: Does not properly apply capability and nonce checks on any of its AJAX action callback functionsCVE-2023-6066 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Custom Widget area WordPress plugin through 1.2.5 does not properly apply capability and nonce checks on any of its AJAX action callback functions, which could allow attackers with subscriber+ privilege to create, delete or modify menus on the site.
Product
WP Custom Widget area
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update WP Custom Widget area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024Estatik Real Estate: Does not sanitise and escape various parameters and generated URLs before outputting them back in attributesCVE-2023-6050 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not sanitise and escape various parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Estatik Real Estate
Fixed in
4.1.1
What to do
Update Estatik Real Estate to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 15, 2024Easy Forms for Mailchimp: Does not sanitise and escape some of its settingsCVE-2023-4925 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Forms for Mailchimp WordPress plugin through 6.8.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Product
Easy Forms for Mailchimp
Affected
up to 6.8.10
What to do
Affects up to 6.8.10. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Email Subscription Popup: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-6555 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Subscription Popup WordPress plugin before 1.2.20 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Email Subscription Popup
Fixed in
1.2.20
What to do
Update Email Subscription Popup to 1.2.20 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024WP Crowdfunding: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-6161 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
WP Crowdfunding
Fixed in
2.1.9
What to do
Update WP Crowdfunding to 2.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6141 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks.
Product
Essential Real Estate
Fixed in
4.4.0
What to do
Update Essential Real Estate to 4.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Essential Real Estate: Does not apply proper capability checks on its AJAX actionsCVE-2023-6139 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Denial of Service attacks.
Product
Essential Real Estate
Fixed in
4.4.0
What to do
Update Essential Real Estate to 4.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024WP Custom Cursors | WordPress Cursor: Does not sanitise and escape some of its settingsCVE-2023-5911 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Custom Cursors | WordPress Cursor Plugin WordPress plugin through 3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Custom Cursors | WordPress Cursor
Affected
up to 3.2
What to do
Affects up to 3.2. Update WP Custom Cursors | WordPress Cursor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 8, 2024Duplicator: Does not properly escape valuesCVE-2018-25095 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Duplicator WordPress plugin before 1.3.0 does not properly escape values when its installer script replaces values in WordPress configuration files. If this installer script is left on the site after use, it could be use to run arbitrary code on the server.
Product
Duplicator
Fixed in
1.3.0
What to do
Update Duplicator to 1.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 3, 2024POST SMTP: Does not sanitise and escape the msg parameter before outputting it back in the pageCVE-2023-6621 · WordPress plugins & themes · reported by WPScanMedium 6.1
The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Product
POST SMTP
Fixed in
2.8.7
What to do
Update POST SMTP to 2.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 1, 2024Html5 Video Player: Does not sanitise and escape some of its player settingsCVE-2023-6485 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against high privilege users like admins
Product
Html5 Video Player
Fixed in
2.5.19
What to do
Update Html5 Video Player to 2.5.19 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 1, 2024WP TripAdvisor Review Slider: Does not sanitise and escape some of its settingsCVE-2023-6037 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP TripAdvisor Review Slider
Fixed in
11.9
What to do
Update WP TripAdvisor Review Slider to 11.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023JSON Content Importer: Does not sanitise and escape the tab parameter before outputting it back in the pageCVE-2023-6268 · WordPress plugins & themes · reported by WPScanMedium 6.1
The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
JSON Content Importer
Fixed in
1.5.4
What to do
Update JSON Content Importer to 1.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023Quiz Maker: Does not escape generated URLs before outputting them in attributesCVE-2023-6166 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting
Product
Quiz Maker
Fixed in
6.4.9.5
What to do
Update Quiz Maker to 6.4.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023BSK Forms Blacklist: Does not sanitise and escape some of its settingsCVE-2023-5980 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
BSK Forms Blacklist
Fixed in
3.7
What to do
Update BSK Forms Blacklist to 3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5674 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023WP Mail Log: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5645 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
Product
WP Mail Log
Fixed in
1.1.3
What to do
Update WP Mail Log to 1.1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 26, 2023A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic.CVE-2015-10127 · WordPress plugins & themes · reported by VulDBLow 3.5
A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.
Product
PlusCaptcha
Affected
up to 2.0.6
What to do
Affects up to 2.0.6. Update PlusCaptcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com vuldb.com
Dec 21, 2023WordPress Email Marketing Plugin – WP Email Capture: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-28421 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Winwar Media WordPress Email Marketing Plugin – WP Email Capture.This issue affects WordPress Email Marketing Plugin – WP Email Capture: from n/a through 3.10.
Product
WordPress Email Marketing Plugin – WP Email Capture
Affected
up to 3.10
What to do
Affects up to 3.10. Update WordPress Email Marketing Plugin – WP Email Capture to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Prevent Landscape Rotation: Cross-Site Request Forgery (CSRF)CVE-2023-48772 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0.
Product
Prevent Landscape Rotation
Affected
up to 2.0
What to do
Affects up to 2.0. Update Prevent Landscape Rotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023Product Catalog Mode For WooCommerce: Does not properly authorize settings updates or escape settings valuesCVE-2023-5348 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
Product
Product Catalog Mode For WooCommerce
Fixed in
5.0.3
What to do
Update Product Catalog Mode For WooCommerce to 5.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro: Does not sanitise and escape some of its settingsCVE-2023-5005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro
Fixed in
3.0
What to do
Update Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 15, 2023Forms by CaptainForm – Form Builder for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49170 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captainform Forms by CaptainForm – Form Builder for WordPress allows Reflected XSS.This issue affects Forms by CaptainForm – Form Builder for WordPress: from n/a through 2.5.3.
Product
Forms by CaptainForm – Form Builder for
Affected
up to 2.5.3
What to do
Affects up to 2.5.3. Update Forms by CaptainForm – Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 11, 2023EazyDocs: Does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX actionCVE-2023-6035 · WordPress plugins & themes · reported by WPScanHigh 8.8
The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Product
EazyDocs
Fixed in
2.3.4
What to do
Update EazyDocs to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023Contact Form Email: Does not sanitise and escape some of its settingsCVE-2023-5955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Contact Form Email
Fixed in
1.3.44
What to do
Update Contact Form Email to 1.3.44 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023WP Not Login Hide (WPNLH): Does not sanitise and escape some of its settingsCVE-2023-5940 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Not Login Hide (WPNLH)
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Not Login Hide (WPNLH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-5757 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Crowdfunding
Fixed in
2.1.8
What to do
Update WP Crowdfunding to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023EmbedPress: Does not sanitise and escape a parameter before outputting it back in the page containing a specific contentCVE-2023-5750 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EmbedPress
Fixed in
3.9.2
What to do
Update EmbedPress to 3.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023EmbedPress: Does not sanitise and escape user input before outputting it back in the pageCVE-2023-5749 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EmbedPress
Fixed in
3.9.2
What to do
Update EmbedPress to 3.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023WP Fastest Cache: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-6063 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
Product
WP Fastest Cache
Fixed in
1.2.2
What to do
Update WP Fastest Cache to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Welcart e-Commerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5951 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Welcart e-Commerce
Fixed in
2.9.5
What to do
Update Welcart e-Commerce to 2.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Popup box
Fixed in
3.8.6
What to do
Update Popup box to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5809 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Popup box
Fixed in
3.8.6
What to do
Update Popup box to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023AMP+ Plus: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5210 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
AMP+ Plus
Affected
up to 3.0
What to do
Affects up to 3.0. Update AMP+ Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023BSK Contact Form 7 Blacklist: Does not sanitise and escape the inserted_count parameter before outputting it back in the pageCVE-2023-5141 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
BSK Contact Form 7 Blacklist
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update BSK Contact Form 7 Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Simply Excerpts: Does not sanitize and escape some fields in the plugin settingsCVE-2023-5137 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
Simply Excerpts
Affected
up to 1.4
What to do
Affects up to 1.4. Update Simply Excerpts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Easy Newsletter Signups: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5108 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Easy Newsletter Signups
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Easy Newsletter Signups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 30, 2023WP Forms Puzzle Captcha: Cross-Site Request Forgery (CSRF)CVE-2023-48278 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Stored XSS.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
Product
WP Forms Puzzle Captcha
Affected
up to 4.1
What to do
Affects up to 4.1. Update WP Forms Puzzle Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 27, 2023POST SMTP Mailer: Does not escape email message content before displaying it in the backendCVE-2023-5958 · WordPress plugins & themes · reported by WPScanMedium 6.1
The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
Product
POST SMTP Mailer
Fixed in
2.7.1
What to do
Update POST SMTP Mailer to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Medialist: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-5942 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Medialist
Fixed in
1.4.1
What to do
Update Medialist to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.