Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

570new WordPress flaws this week

391,310entries in the database

2,981 results · page 36 of 60

Aug 1, 2022Microsoft Advertising Universal Event Tracking (UET): Does not sanitise and escape its settingsCVE-2022-2170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
Product
Microsoft Advertising Universal Event Tracking (UET)
Fixed in
1.0.4
What to do
Update Microsoft Advertising Universal Event Tracking (UET) to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Copyright Proof: Does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-1906 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
Product
Copyright Proof
Affected
up to 4.16
What to do
Affects up to 4.16. Update Copyright Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 1, 2022Project Source Code Download: Does not protect its backup generation and download functionalitiesCVE-2022-1585 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
Product
Project Source Code Download
Affected
up to 1.0.0
What to do
Affects up to 1.0.0. Update Project Source Code Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022Unyson: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2219 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Unyson
Fixed in
2.7.27
What to do
Update Unyson to 2.7.27 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022WP Video Lightbox: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
WP Video Lightbox
Fixed in
1.9.5
What to do
Update WP Video Lightbox to 1.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022Popup Anything: Does not sanitise and escape a parameter before outputting it back in a frontend pageCVE-2022-2115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting
Product
Popup Anything
Fixed in
2.1.7
What to do
Update Popup Anything to 2.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022Name Directory: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2072 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well
Product
Name Directory
Fixed in
1.25.3
What to do
Update Name Directory to 1.25.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 25, 2022Header Footer Code Manager: Does not escape generated URLs before outputting them back in attributes in an admin pageCVE-2022-0899 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Header Footer Code Manager
Fixed in
1.1.24
What to do
Update Header Footer Code Manager to 1.1.24 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Contact Form 7 Captcha: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Product
Contact Form 7 Captcha
Fixed in
0.1.2
What to do
Update Contact Form 7 Captcha to 0.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Advanced Database Cleaner: Does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
Product
Advanced Database Cleaner
Fixed in
3.1.1
What to do
Update Advanced Database Cleaner to 3.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Download Manager: Does not escape a generated URL before outputting it back in an attribute of the history dashboardCVE-2022-2168 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting
Product
Download Manager
Fixed in
3.2.44
What to do
Update Download Manager to 3.2.44 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Import CSV Files: Does not sanitise and escaped imported data before outputting them back in a pageCVE-2022-2146 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check when performing such action as well, resulting in a Reflected Cross-Site Scripting
Product
Import CSV Files
Affected
up to 1.0
What to do
Affects up to 1.0. Update Import CSV Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titlesCVE-2022-2099 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
Product
WooCommerce
Fixed in
6.6.0
What to do
Update WooCommerce to 6.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Discount Rules for WooCommerce: Does not escape a parameter before outputting it back in an attribute of the plugin's discount rule pageCVE-2022-2090 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting
Product
Discount Rules for WooCommerce
Fixed in
2.4.2
What to do
Update Discount Rules for WooCommerce to 2.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022CDI: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1933 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
Product
CDI
Fixed in
5.1.9
What to do
Update CDI to 5.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022WooCommerce PDF Invoices & Packing Slips: Doesn't escape a parameter on its setting pageCVE-2022-2092 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to conduct reflected cross-site scripting attacks.
Product
WooCommerce PDF Invoices & Packing Slips
Fixed in
2.16.0
What to do
Update WooCommerce PDF Invoices & Packing Slips to 2.16.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022core plugin for kitestudio: Does not sanitise and escape some parameters before outputting them back in a response of an AJAX actionCVE-2022-1951 · WordPress plugins & themes · reported by WPScanMedium 6.1
The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting.
Product
core plugin for kitestudio
Fixed in
2.3.1
What to do
Update core plugin for kitestudio to 2.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022Awin Data Feed: Does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting
Product
Awin Data Feed
Fixed in
1.8
What to do
Update Awin Data Feed to 1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022Shortcodes and extra features for Phlox: Does not sanitise and escape a parameter before outputting it back in the responseCVE-2022-1910 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Product
Shortcodes and extra features for Phlox
Fixed in
2.9.8
What to do
Update Shortcodes and extra features for Phlox to 2.9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022WP Maintenance Mode & Coming Soon: Is lacking CSRFCVE-2022-1576 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Product
WP Maintenance Mode & Coming Soon
Fixed in
2.4.5
What to do
Update WP Maintenance Mode & Coming Soon to 2.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022WooCommerce - Product Importer: Does not sanitise and escape the imported data before outputting it back in the pageCVE-2022-1546 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
WooCommerce - Product Importer
Affected
up to 1.5.2
What to do
Affects up to 1.5.2. Update WooCommerce - Product Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022WP Event Manager: Does not sanitise and escape its search before outputting it back in an attribute on the event dashboardCVE-2022-1474 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting
Product
WP Event Manager
Fixed in
3.1.28
What to do
Update WP Event Manager to 3.1.28 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2022FoxyShop: Does not sanitise and escape a parameter before outputting it back in an admin pageCVE-2022-1220 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
FoxyShop
Fixed in
4.8.2
What to do
Update FoxyShop to 4.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 7, 2022In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application.CVE-2015-1785 · WordPress plugins & themes · reported by Red HatMedium 6.5
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Fixed in
2.0.77.3
What to do
Update the plugin to 2.0.77.3 or newer.
Full record and what to do →NVD record blog.nettitude.com wpscan.com
Jul 7, 2022In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application.CVE-2015-1784 · WordPress plugins & themes · reported by Red HatHigh 8.8
In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Fixed in
2.0.77.3
What to do
Update the plugin to 2.0.77.3 or newer.
Full record and what to do →NVD record blog.nettitude.com wpscan.com
Jul 4, 2022WP Championship: Is lacking CSRF checks in various placesCVE-2022-1967 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
Product
WP Championship
Fixed in
9.3
What to do
Update WP Championship to 9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2022Gallery: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users)CVE-2022-1946 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Product
Gallery
Fixed in
2.0.0
What to do
Update Gallery to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenCVE-2022-1916 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting
Product
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
Fixed in
1.0.5
What to do
Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to 1.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Pricing Tables: Does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated)CVE-2022-1904 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflected Cross-Site Scripting
Product
Pricing Tables
Fixed in
3.2.1
What to do
Update Pricing Tables to 3.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Ultimate WooCommerce CSV Importer: Does not sanitise and escape the imported data before outputting it back in the pageCVE-2022-1470 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
Ultimate WooCommerce CSV Importer
Affected
up to 2.0
What to do
Affects up to 2.0. Update Ultimate WooCommerce CSV Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to maliCVE-2022-1028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
Product
WordPress Security Firewall, Malware Scanner, Secure Login and Backup
Fixed in
4.2.1
What to do
Update WordPress Security Firewall, Malware Scanner, Secure Login and Backup to 4.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 27, 2022Backup, Restore and Migrate WordPress Sites With the XCloner: Does not have authorisation and CSRF checksCVE-2022-0444 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.
Product
Backup, Restore and Migrate WordPress Sites With the XCloner
Fixed in
4.3.6
What to do
Update Backup, Restore and Migrate WordPress Sites With the XCloner to 4.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 24, 2022In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WorCVE-2013-1916 · WordPress plugins & themes · reported by Red HatHigh 8.8
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.
Affected
0.9.4 to 0.9.4
What to do
Affects 0.9.4 to 0.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 13, 2022Keep Backup Daily: Reflected Cross-Site ScriptingCVE-2022-1820 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Keep Backup Daily
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 13, 2022Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrCVE-2022-1654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions
Affected
up to 6.10.1
What to do
Affects up to 6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jun 13, 2022Mitsol Social Post Feed: Does not escape some of its settings before outputting them back in attributesCVE-2022-0209 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Mitsol Social Post Feed
Fixed in
1.11
What to do
Update Mitsol Social Post Feed to 1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.CVE-2022-1788 · WordPress plugins & themes · reported by WPScanMedium 6.5
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022WP Athletics: Does not sanitise and escape a parameter before outputting back in an admin pageCVE-2022-1773 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting
Product
WP Athletics
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WP Athletics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including rCVE-2022-1763 · WordPress plugins & themes · reported by WPScanMedium 5.4
Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings
Affected
up to 2.1
What to do
Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Newsletter: Does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pagesCVE-2022-1756 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below.
Product
Newsletter
Fixed in
7.4.5
What to do
Update Newsletter to 7.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Simple Membership: Does not properly sanitise and escape parameters before outputting them back in AJAX actionsCVE-2022-1724 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
Product
Simple Membership
Fixed in
4.1.1
What to do
Update Simple Membership to 4.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022MailerLite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-1604 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Product
MailerLite
Fixed in
1.5.4
What to do
Update MailerLite to 1.5.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a RCVE-2022-1532 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Fixed in
1.3.8
What to do
Update the plugin to 1.3.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Member Hero: Lacks authorization checksCVE-2022-0885 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
Product
Member Hero
Affected
up to 1.0.9
What to do
Affects up to 1.0.9. Update Member Hero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022WP SVG Icons: Does not properly validate uploaded custom icon packsCVE-2022-0863 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
Product
WP SVG Icons
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update WP SVG Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Advanced Admin Search: Does not sanitize and escape some parameters before outputting them back in an admin pageCVE-2022-0626 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
Product
Advanced Admin Search
Fixed in
1.1.6
What to do
Update Advanced Admin Search to 1.1.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022Database Backup for: Does not have CSRF check in placeCVE-2022-1577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
Product
Database Backup for
Fixed in
2.5.2
What to do
Update Database Backup for to 2.5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022Discy: Lacks CSRF checks in some AJAX actionsCVE-2022-1421 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack
Product
Discy
Fixed in
5.2
What to do
Update Discy to 5.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022WP Statistics: Does not sanitise the REQUEST_URI parameter before outputting it back in the rendered pageCVE-2022-1005 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters
Product
WP Statistics
Fixed in
13.2.2
What to do
Update WP Statistics to 13.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022Simple Real Estate Pack: Does not sanitise and escape some of its settingsCVE-2022-1646 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Product
Simple Real Estate Pack
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Simple Real Estate Pack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.