Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,184 results · page 36 of 64
Aug 7, 2023MultiParcels Shipping For WooCommerce: Does not properly sanitize and escape a parameter before using it in an SQL statementCVE-2023-2843 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MultiParcels Shipping For WooCommerce WordPress plugin before 1.14.15 does not properly sanitize and escape a parameter before using it in an SQL statement, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
- Product
- MultiParcels Shipping For WooCommerce
- Fixed in
- 1.14.15
- What to do
- Update MultiParcels Shipping For WooCommerce to 1.14.15 or newer.
Aug 7, 2023WP Food Manager: Does not sanitise and escape some of its settingsCVE-2023-0604 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Food Manager WordPress plugin before 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Food Manager
- Fixed in
- 1.0.4
- What to do
- Update WP Food Manager to 1.0.4 or newer.
Jul 31, 2023grid-kit-premium: Does not escape some parametersCVE-2023-3292 · WordPress plugins & themes · reported by WPScanMedium 6.1
The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- grid-kit-premium
- Fixed in
- 2.2.0
- What to do
- Update grid-kit-premium to 2.2.0 or newer.
Jul 31, 2023Forminator: Does not properly escape values that are being reflected inside form fields that use pre-populated query parametersCVE-2023-3134 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.
- Product
- Forminator
- Fixed in
- 1.24.4
- What to do
- Update Forminator to 1.24.4 or newer.
Jul 31, 2023Short URL: Does not sanitise and escape some of its settingsCVE-2023-3130 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Short URL WordPress plugin before 1.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Short URL
- Fixed in
- 1.6.5
- What to do
- Update Short URL to 1.6.5 or newer.
Jul 31, 2023Twittee Text Tweet: Does not properly escape POST valuesCVE-2023-0602 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Twittee Text Tweet WordPress plugin through 1.0.8 does not properly escape POST values which are printed back to the user inside one of the plugin's administrative page, which allows reflected XSS attacks targeting administrators to happen.
- Product
- Twittee Text Tweet
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Twittee Text Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 28, 2023Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation funcCVE-2023-0958 · WordPress plugins & themes · reported by WordfenceMedium 4.3
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 24, 2023Auto Location for WP Job Manager via Google: Does not sanitise and escape some of its settingsCVE-2023-3344 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Auto Location for WP Job Manager via Google
- Fixed in
- 1.1
- What to do
- Update Auto Location for WP Job Manager via Google to 1.1 or newer.
Jul 24, 2023All-in-one Floating Contact Form: Does not sanitise and escape some of its settingsCVE-2023-3248 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- All-in-one Floating Contact Form
- Fixed in
- 2.1.2
- What to do
- Update All-in-one Floating Contact Form to 2.1.2 or newer.
Jul 24, 2023User Activity Log: Does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pagesCVE-2023-2761 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- User Activity Log
- Fixed in
- 1.6.3
- What to do
- Update User Activity Log to 1.6.3 or newer.
Jul 24, 2023wpForo Forum: Does not escape some request parameters while in debug modeCVE-2023-2309 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.
- Product
- wpForo Forum
- Fixed in
- 2.1.9
- What to do
- Update wpForo Forum to 2.1.9 or newer.
Jul 17, 2023Floating Chat Widget: Does not sanitise and escape some of its settingsCVE-2023-3245 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Chat Widget
- Fixed in
- 3.1.2
- What to do
- Update Floating Chat Widget to 3.1.2 or newer.
Jul 17, 2023Membership: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3182 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Membership
- Fixed in
- 3.2.3
- What to do
- Update Membership to 3.2.3 or newer.
Jul 17, 2023Autochat Automatic Conversation: Does not sanitise and escape user input before outputting it back on the pageCVE-2023-3041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack.
- Product
- Autochat Automatic Conversation
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Autochat Automatic Conversation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2023Gravity Forms: Does not escape generated URLs before outputting them in attributesCVE-2023-2701 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin.
- Product
- Gravity Forms
- Fixed in
- 2.7.5
- What to do
- Update Gravity Forms to 2.7.5 or newer.
Jul 17, 2023AN_GradeBook: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2636 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
- Product
- AN_GradeBook
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2023InventoryPress: Does not sanitise and escape some of its settingsCVE-2023-2579 · WordPress plugins & themes · reported by WPScanMedium 5.4
The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
- Product
- InventoryPress
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update InventoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2023Login Configurator: Does not properly escape a URL parameter before outputting it to the pageCVE-2023-1893 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
- Product
- Login Configurator
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Login Configurator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2023NEX-Forms: Does not escape its form nameCVE-2023-0439 · WordPress plugins & themes · reported by WPScanMedium 5.4
The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.
- Product
- NEX-Forms
- Fixed in
- 8.4.4
- What to do
- Update NEX-Forms to 8.4.4 or newer.
Jul 10, 2023Float menu: Does not sanitise and escape some of its settingsCVE-2023-3225 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Float menu
- Fixed in
- 5.0.3
- What to do
- Update Float menu to 5.0.3 or newer.
Jul 10, 2023AI ChatBot: Does not adequately escape some settingsCVE-2023-3175 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- AI ChatBot
- Fixed in
- 4.6.1
- What to do
- Update AI ChatBot to 4.6.1 or newer.
Jul 10, 2023URL Shortify: Does not sanitise and escape some of its settingsCVE-2023-3129 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- URL Shortify
- Fixed in
- 1.7.0
- What to do
- Update URL Shortify to 1.7.0 or newer.
Jul 10, 2023Export All URLs: Does not sanitise and escape a parameter before outputting them back in the pageCVE-2023-3118 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Export All URLs
- Fixed in
- 4.6
- What to do
- Update Export All URLs to 4.6 or newer.
Jul 10, 2023MStore API: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-3077 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
- Product
- MStore API
- Fixed in
- 3.9.8
- What to do
- Update MStore API to 3.9.8 or newer.
Jul 10, 2023TinyMCE Custom Styles: Does not sanitise and escape some of its settingsCVE-2023-2967 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- TinyMCE Custom Styles
- Fixed in
- 1.1.4
- What to do
- Update TinyMCE Custom Styles to 1.1.4 or newer.
Jul 10, 2023AN_GradeBook: Does not sanitise and escape some of its settingsCVE-2023-2709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AN_GradeBook
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023Call Now Accessibility Button: Does not sanitise and escape some of its settingsCVE-2023-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Call Now Accessibility Button
- Fixed in
- 1.1
- What to do
- Update Call Now Accessibility Button to 1.1 or newer.
Jul 10, 2023Buy Me a Coffee: Does not sanitise and escape some of its settingsCVE-2023-2578 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Buy Me a Coffee
- Fixed in
- 3.7
- What to do
- Update Buy Me a Coffee to 3.7 or newer.
Jul 10, 2023All In One Redirection: Does not properly sanitise and escape multiple parameters before using them in an SQL statementCVE-2023-2493 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- All In One Redirection
- Fixed in
- 2.2.0
- What to do
- Update All In One Redirection to 2.2.0 or newer.
Jul 10, 2023Companion Sitemap Generator: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-1780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Companion Sitemap Generator
- Fixed in
- 4.5.3
- What to do
- Update Companion Sitemap Generator to 4.5.3 or newer.
Jul 10, 2023WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin: Use a third-party library that removes the escaping on some HTML charactersCVE-2023-1119 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library that removes the escaping on some HTML characters, leading to a cross-site scripting vulnerability.
- Product
- WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin
- Fixed in
- 3.2.13
- What to do
- Update WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin to 3.2.13 or newer.
Jul 4, 2023Ultimate Member: Does not prevent visitors from creating user accounts with arbitrary capabilitiesCVE-2023-3460 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
- Product
- Ultimate Member
- Fixed in
- 2.6.7
- What to do
- Update Ultimate Member to 2.6.7 or newer.
Full record and what to do →NVD recordblog.wpscan.comwpscan.com
Jul 4, 2023Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2333 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro
- Affected
- up to 1.2.7
- Fixed in
- 1.2.7
- What to do
- Update Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro to 1.2.7 or newer.
Jul 4, 2023Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro: Does not escape some parameters before outputting them back in attributesCVE-2023-2324 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro WordPress plugin through 1.0.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro
- Affected
- up to 1.0.7
- Fixed in
- 1.0.7
- What to do
- Update Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro to 1.0.7 or newer.
Jul 4, 2023WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro
- Affected
- up to 3.4.6
- Fixed in
- 3.4.6
- What to do
- Update WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro to 3.4.6 or newer.
Jul 4, 2023CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro
- Affected
- up to 5.0.2
- Fixed in
- 5.0.2
- What to do
- Update CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro to 5.0.2 or newer.
Jul 4, 2023ND Shortcodes: Does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4623 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- ND Shortcodes
- Fixed in
- 7.0
- What to do
- Update ND Shortcodes to 7.0 or newer.
Jun 27, 2023CodeColorer: Does not sanitise and escape some of its settingsCVE-2023-2795 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CodeColorer
- Fixed in
- 0.10.1
- What to do
- Update CodeColorer to 0.10.1 or newer.
Jun 27, 2023ERP: Does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statementCVE-2023-2744 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- ERP
- Fixed in
- 1.12.4
- What to do
- Update ERP to 1.12.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023ERP: Does not sanitise and escape the employee_name parameter before outputting it back in the pageCVE-2023-2743 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ERP
- Fixed in
- 1.12.4
- What to do
- Update ERP to 1.12.4 or newer.
Jun 27, 2023Ultimate Product Catalog: Does not sanitise and escape some of its settingsCVE-2023-2711 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Product Catalog
- Fixed in
- 5.2.6
- What to do
- Update Ultimate Product Catalog to 5.2.6 or newer.
Jun 27, 2023KiviCare: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2624 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023wpbrutalai: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2605 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
- Product
- wpbrutalai
- Fixed in
- 2.0.1
- What to do
- Update wpbrutalai to 2.0.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023wpbrutalai: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2601 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin via CSRF.
- Product
- wpbrutalai
- Fixed in
- 2.0.0
- What to do
- Update wpbrutalai to 2.0.0 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023FormCraft: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2592 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- FormCraft
- Fixed in
- 3.9.7
- What to do
- Update FormCraft to 3.9.7 or newer.
Jun 27, 2023AI Engine: Does not sanitize and escape some of its settingsCVE-2023-2580 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- AI Engine
- Fixed in
- 1.6.83
- What to do
- Update AI Engine to 1.6.83 or newer.
Jun 27, 2023Responsive CSS EDITOR: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2482 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.
- Product
- Responsive CSS EDITOR
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Responsive CSS EDITOR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2023Aajoda Testimonials: Does not sanitise and escape some of its settingsCVE-2023-2178 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Aajoda Testimonials
- Fixed in
- 2.2.2
- What to do
- Update Aajoda Testimonials to 2.2.2 or newer.
Jun 27, 2023Accordion & FAQ: Does not escape various generated URLsCVE-2023-1891 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting
- Product
- Accordion & FAQ
- Fixed in
- 1.9.9
- What to do
- Update Accordion & FAQ to 1.9.9 or newer.
Jun 27, 2023USM-Premium: Does not sanitize and escape some of its settingsCVE-2023-1166 · WordPress plugins & themes · reported by WPScanMedium 4.8
The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- USM-Premium
- Fixed in
- 16.3
- What to do
- Update USM-Premium to 16.3 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.