Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,771 results · page 460 of 496
Jun 20, 2022Seamless Donations: Does not have CSRF check in placeCVE-2022-1610 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Seamless Donations
- Fixed in
- 5.1.9
- What to do
- Update Seamless Donations to 5.1.9 or newer.
Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress.CVE-2022-29440 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress.
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 13, 2022DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.CVE-2022-29455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comrotem-bar.com
Jun 13, 2022RSVPMaker: Unauthenticated SQL InjectionCVE-2022-1768 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.
- Product
- RSVPMaker
- Affected
- up to 9.3.2
- What to do
- Affects up to 9.3.2. Update RSVPMaker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.complugins.trac.wordpress.org
Jun 13, 2022Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the inCVE-2022-1659 · WordPress plugins & themes · reported by WordfenceMedium 5.4
Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via thCVE-2022-1658 · WordPress plugins & themes · reported by WordfenceMedium 5.4
Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, any logged-in user can delete any installed plugin on the site.
- Affected
- up to 6.10.1
- What to do
- Affects up to 6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path TraversalCVE-2022-1657 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion. In the JupiterX theme, the jupiterx_cp_load_pane_action AJAX action present in the lib/admin/control-panel/control-panel.php file calls the load_control_panel_pane function. It is possible to use this action to include any local PHP file via the slug parameter. The Jupiter theme has a nearly identical vulnerability which can be exploited via the mka_cp_load_pane_action AJAX action present in the framework/admin/control-panel/logic/functions.php file, which calls the mka_cp_load_pane_action function.
- Affected
- up to 6.10.1
- What to do
- Affects up to 6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.CVE-2022-1788 · WordPress plugins & themes · reported by WPScanMedium 6.5
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Filr: Does not have authorisation check in two of its AJAX actionsCVE-2022-1777 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones.
- Product
- Filr
- Fixed in
- 1.2.2.1
- What to do
- Update Filr to 1.2.2.1 or newer.
Jun 13, 2022Peter’s Collaboration E-mails: Is vulnerable to CSRF due to missing nonce checksCVE-2022-1761 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more.
- Product
- Peter’s Collaboration E-mails
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update Peter’s Collaboration E-mails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Simple Membership: Does not properly sanitise and escape parameters before outputting them back in AJAX actionsCVE-2022-1724 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Reflected Cross-Site Scripting
- Product
- Simple Membership
- Fixed in
- 4.1.1
- What to do
- Update Simple Membership to 4.1.1 or newer.
Jun 13, 2022Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in libCVE-2022-1656 · WordPress plugins & themes · reported by WordfenceMedium 5.4
Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_api_ajax_ actions registered by the JupiterX Core Plugin (<=2.0.6). This includes the ability to deactivate arbitrary plugins as well as update the theme’s API key.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022Carousel CK: Does not sanitize and escape Slide's descriptionsCVE-2022-1336 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Carousel CK
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Carousel CK to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Slideshow CK: Does not sanitize and escape Slide's descriptionsCVE-2022-1335 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Slideshow CK
- Fixed in
- 1.4.10
- What to do
- Update Slideshow CK to 1.4.10 or newer.
Jun 13, 2022Member Hero: Lacks authorization checksCVE-2022-0885 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
- Product
- Member Hero
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Member Hero to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Bestbooks: Does not sanitise and escape some parameters before using them in a SQL statement via an AJAX actionCVE-2022-0827 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
- Product
- Bestbooks
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update Bestbooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022KiviCare: Does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details routeCVE-2022-0786 · WordPress plugins & themes · reported by WPScanCritical 9.8
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
- Product
- KiviCare
- Fixed in
- 2.3.9
- What to do
- Update KiviCare to 2.3.9 or newer.
Jun 13, 2022Enqueue Anything: Does not have authorisation and CSRF checks in the remove_asset AJAX actionCVE-2021-25116 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
- Product
- Enqueue Anything
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Enqueue Anything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter.CVE-2022-27231 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the website using the product.
- Fixed in
- 13.2.0
- What to do
- Update the plugin to 13.2.0 or newer.
Jun 8, 2022WP Simple Adsense Insertion: Does not perform CSRF checks on updates to its admin pageCVE-2022-1695 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form.
- Product
- WP Simple Adsense Insertion
- Fixed in
- 2.1
- What to do
- Update WP Simple Adsense Insertion to 2.1 or newer.
Jun 8, 2022Realty Workstation: Does not sanitise and escape the trans_edit parameter before using it in a SQL statementCVE-2022-1691 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection
- Product
- Realty Workstation
- Fixed in
- 1.0.15
- What to do
- Update Realty Workstation to 1.0.15 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022Note Press: Does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin pageCVE-2022-1690 · WordPress plugins & themes · reported by WPScanLow 2.7
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection
- Product
- Note Press
- Affected
- up to 0.1.10
- What to do
- Affects up to 0.1.10. Update Note Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jun 8, 2022WooCommerce Green Wallet Gateway: Does not escape the error_envision query parameter before outputting it to the pageCVE-2022-1673 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability.
- Product
- WooCommerce Green Wallet Gateway
- Fixed in
- 1.0.2
- What to do
- Update WooCommerce Green Wallet Gateway to 1.0.2 or newer.
Jun 8, 2022WPQA Builder: Which is a companion to the Discy and HimerCVE-2022-1598 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticated users to discover private questions sent between users on the site.
- Product
- WPQA Builder
- Fixed in
- 5.5
- What to do
- Update WPQA Builder to 5.5 or newer.
Jun 8, 2022The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form CVE-2022-1597 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks
- Product
- WPQA Builder
- Fixed in
- 5.4
- What to do
- Update WPQA Builder to 5.4 or newer.
Jun 8, 2022Files Download Delay: Does not have authorisation and CSRF checksCVE-2022-1570 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.
- Product
- Files Download Delay
- Fixed in
- 1.0.7
- What to do
- Update Files Download Delay to 1.0.7 or newer.
Jun 8, 2022Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Does not sanitise and escape some of its form fieldsCVE-2022-1569 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Fixed in
- 1.4.9.4
- What to do
- Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to 1.4.9.4 or newer.
Jun 8, 2022Ask me: Does not perform CSRF checks for any of its AJAX actionsCVE-2022-1424 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform various actions on their behalf on the site.
- Product
- Ask me
- Fixed in
- 6.8.2
- What to do
- Update Ask me to 6.8.2 or newer.
Jun 8, 2022Discy: Does not check for CSRF tokens in the AJAX action discy_reset_optionsCVE-2022-1422 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetting the site settings back to defaults.
- Product
- Discy
- Fixed in
- 5.2
- What to do
- Update Discy to 5.2 or newer.
Jun 8, 2022Discy: Lacks CSRF checks in some AJAX actionsCVE-2022-1421 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack
- Product
- Discy
- Fixed in
- 5.2
- What to do
- Update Discy to 5.2 or newer.
Jun 8, 2022WP Fundraising Donation and Crowdfunding Platform: Does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST routeCVE-2022-0788 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement via one of it's REST route, leading to an SQL injection exploitable by unauthenticated users
- Product
- WP Fundraising Donation and Crowdfunding Platform
- Fixed in
- 1.5.0
- What to do
- Update WP Fundraising Donation and Crowdfunding Platform to 1.5.0 or newer.
Jun 8, 2022User Meta: Does not validate the filepath parameter of its um_show_uploaded_file AJAX actionCVE-2022-0779 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads
- Product
- User Meta
- Fixed in
- 2.4.4
- What to do
- Update User Meta to 2.4.4 or newer.
May 30, 2022Bulk Page Creator: Does not protect its page creation functionalities with nonce checksCVE-2022-1611 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF.
- Product
- Bulk Page Creator
- Fixed in
- 1.1.4
- What to do
- Update Bulk Page Creator to 1.1.4 or newer.
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 30, 2022Content Mask: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2022-1203 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
- Product
- Content Mask
- Fixed in
- 1.8.4.1
- What to do
- Update Content Mask to 1.8.4.1 or newer.
May 30, 2022Smush: Does not sanitise and escape a configuration parameter before outputting it back in an admin pageCVE-2022-1009 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
- Product
- Smush
- Fixed in
- 3.9.9
- What to do
- Update Smush to 3.9.9 or newer.
May 23, 2022Tabs: Does not sanitise and escape Tab descriptionsCVE-2022-1298 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Tabs
- Fixed in
- 2.2.8
- What to do
- Update Tabs to 2.2.8 or newer.
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
- Product
- Nirweb support
- Fixed in
- 2.8.2
- What to do
- Update Nirweb support to 2.8.2 or newer.
May 20, 2022Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.CVE-2022-29447 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.CVE-2022-29448 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 19, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.CVE-2022-29446 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 18, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.CVE-2022-29445 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 17, 2022Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.CVE-2022-29429 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 16, 2022Amministrazione Aperta: Does not validate the open parameter before using it in an include statementCVE-2022-1560 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link
- Product
- Amministrazione Aperta
- Fixed in
- 3.8
- What to do
- Update Amministrazione Aperta to 3.8 or newer.
May 16, 2022ULeak Security & Monitoring: Does not have authorisation and CSRF checksCVE-2022-1557 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings
- Product
- ULeak Security & Monitoring
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update ULeak Security & Monitoring to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX actionCVE-2022-1465 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.
- Product
- WPC Smart Wishlist for WooCommerce
- Fixed in
- 2.9.9
- What to do
- Update WPC Smart Wishlist for WooCommerce to 2.9.9 or newer.
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_messCVE-2022-1425 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
May 16, 2022External Media without Import: Does not have any authorisation and does to ensure that medias added via URLs are external mediasCVE-2022-1398 · WordPress plugins & themes · reported by WPScanMedium 6.5
The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks
- Product
- External Media without Import
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update External Media without Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary CVE-2022-1386 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
- Product
- Fusion Builder
- Fixed in
- 3.6.2
- What to do
- Update Fusion Builder to 3.6.2 or newer.
Full record and what to do →NVD recordtheme-fusion.comwpscan.com
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_iCVE-2022-1349 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to the requesting user, allowing any users (with privileges as low as Subscriber) to delete the profile pictures of any other user.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.