Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

389 results · page 6 of 8

Feb 29, 2024Adsmonetizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-1437 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in José Fernandez Adsmonetizer allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.1.2.
Product
Adsmonetizer
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update Adsmonetizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 19, 2024Montonio for WooCommerce: Server-Side Request Forgery (SSRF)CVE-2022-40700 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards
Product
Montonio for WooCommerce
Affected
up to 6.0.1
What to do
Affects up to 6.0.1. Update Montonio for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024Download Monitor: Exposure of Sensitive Information to an Unauthorized ActorCVE-2022-45354 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.
Product
Download Monitor
Affected
up to 4.7.60
What to do
Affects up to 4.7.60. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024Strong Testimonials: Cross-Site Request Forgery (CSRF)CVE-2023-52123 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10.
Product
Strong Testimonials
Affected
up to 3.1.10
What to do
Affects up to 3.1.10. Update Strong Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 26, 2023WP Sessions Time Monitoring Full Automatic: Does not sanitize the request URL or query parameters before using them in an SQL queryCVE-2023-5203 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
Product
WP Sessions Time Monitoring Full Automatic
Fixed in
1.0.9
What to do
Update WP Sessions Time Monitoring Full Automatic to 1.0.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2023Event Monster – Event Management, Tickets Booking, Upcoming Event: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47525 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through 1.3.2.
Product
Event Monster – Event Management, Tickets Booking, Upcoming Event
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Download Monitor: Unrestricted Upload of File with Dangerous TypeCVE-2023-34007 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.3.
Product
Download Monitor
Affected
up to 4.8.3
What to do
Affects up to 4.8.3. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023SEO Change Monitor – Track Website Changes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-33209 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track Website Changes.This issue affects SEO Change Monitor – Track Website Changes: from n/a through 1.2.
Product
SEO Change Monitor – Track Website Changes
Affected
up to 1.2
What to do
Affects up to 1.2. Update SEO Change Monitor – Track Website Changes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Smart External Link Click Monitor [Link Log]: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49771 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Link Log] allows Reflected XSS.This issue affects Smart External Link Click Monitor [Link Log]: from n/a through 5.0.2.
Product
Smart External Link Click Monitor [Link Log]
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Smart External Link Click Monitor [Link Log] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Smart External Link Click Monitor [Link Log]: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49770 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Link Log] allows Stored XSS.This issue affects Smart External Link Click Monitor [Link Log]: from n/a through 5.0.2.
Product
Smart External Link Click Monitor [Link Log]
Affected
up to 5.0.2
What to do
Affects up to 5.0.2. Update Smart External Link Click Monitor [Link Log] to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Simple Testimonials Showcase: Cross-Site Request Forgery (CSRF)CVE-2023-48283 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Testimonials Showcase allows Cross Site Request Forgery.This issue affects Simple Testimonials Showcase: from n/a through 1.1.5.
Product
Simple Testimonials Showcase
Affected
up to 1.1.5
What to do
Affects up to 1.1.5. Update Simple Testimonials Showcase to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Campaign Monitor for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-38474 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Reflected XSS.This issue affects Campaign Monitor for WordPress: from n/a through 2.8.12.
Product
Campaign Monitor for
Affected
up to 2.8.12
What to do
Affects up to 2.8.12. Update Campaign Monitor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023MonsterInsights Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-32291 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MonsterInsights Pro allows Stored XSS.This issue affects MonsterInsights Pro: from n/a through 8.14.1.
Product
MonsterInsights Pro
Affected
up to 8.14.1
What to do
Affects up to 8.14.1. Update MonsterInsights Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form plugin <= 1.7.11 versions.CVE-2023-47758 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form plugin <= 1.7.11 versions.
Fixed in
1.7.11
What to do
Update the plugin to 1.7.11 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Download Monitor: Server-Side Request Forgery (SSRF)CVE-2023-31219 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Server-Side Request Forgery (SSRF) vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.8.1.
Product
Download Monitor
Affected
up to 4.8.1
What to do
Affects up to 4.8.1. Update Download Monitor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 3, 2023demon image annotation: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-40215 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Demonisblack demon image annotation allows SQL Injection.This issue affects demon image annotation: from n/a through 5.1.
Product
demon image annotation
Affected
up to 5.1
What to do
Affects up to 5.1. Update demon image annotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 31, 2023Campaign Monitor Forms by Optin Cat: Does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true"CVE-2023-5098 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.
Product
Campaign Monitor Forms by Optin Cat
Fixed in
2.5.6
What to do
Update Campaign Monitor Forms by Optin Cat to 2.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2023Easy Testimonial Slider and Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-45754 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form allows Stored XSS.This issue affects Easy Testimonial Slider and Form: from n/a through 1.0.18.
Product
Easy Testimonial Slider and Form
Affected
up to 1.0.18
What to do
Affects up to 1.0.18. Update Easy Testimonial Slider and Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023Super Testimonials: Stored Cross-Site ScriptingCVE-2023-5613 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Super Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tpsscode' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Super Testimonials
Affected
up to 2.9
What to do
Affects up to 2.9. Update Super Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 16, 2023Testimonial Slider Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-4795 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Testimonial Slider Shortcode WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Product
Testimonial Slider Shortcode
Fixed in
1.1.9
What to do
Update Testimonial Slider Shortcode to 1.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.CVE-2023-45048 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.
Affected
up to 5.00
What to do
Affects up to 5.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Trustindex.Io WP Testimonials plugin <= 1.4.2 versions.CVE-2023-2830 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Trustindex.Io WP Testimonials plugin <= 1.4.2 versions.
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Monchito.Net WP Emoji One plugin <= 0.6.0 versions.CVE-2023-37991 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Monchito.Net WP Emoji One plugin <= 0.6.0 versions.
Affected
up to 0.6.0
What to do
Affects up to 0.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin <= 2.0.4 versions.CVE-2023-37891 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin <= 2.0.4 versions.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Keith Solomon Configurable Tag Cloud: Cross-Site Request Forgery (CSRF)CVE-2023-28995 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Keith Solomon Configurable Tag Cloud (CTC) plugin <= 5.2 versions.
Product
Keith Solomon Configurable Tag Cloud
Fixed in
5.3
What to do
Update Keith Solomon Configurable Tag Cloud to 5.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2023Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions.CVE-2023-22673 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MageNet Website Monetization by MageNet plugin <= 1.0.29.1 versions.
Affected
up to 1.0.29.1
What to do
Affects up to 1.0.29.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 1, 2023Easy Testimonials: Cross-Site Request ForgeryCVE-2020-36749 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Easy Testimonials
Affected
up to 3.6.1
What to do
Affects up to 3.6.1. Update Easy Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 27, 2023Aajoda Testimonials: Does not sanitise and escape some of its settingsCVE-2023-2178 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Aajoda Testimonials
Fixed in
2.2.2
What to do
Update Aajoda Testimonials to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Mass Delete Unused Tags plugin <= 2.0.0 versions.CVE-2023-27430 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Mass Delete Unused Tags plugin <= 2.0.0 versions.
Fixed in
3.0.0
What to do
Update the plugin to 3.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 18, 2023Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Auto Prune Posts plugin <= 1.8.0 versions.CVE-2023-27423 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Ramon Fincken Auto Prune Posts plugin <= 1.8.0 versions.
Fixed in
2.0.0
What to do
Update the plugin to 2.0.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 17, 2023Cross-Site Scripting (XSS) vulnerability in Erin Garscadden GC Testimonials plugin <= 1.3.2 versions.CVE-2022-45817 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Scripting (XSS) vulnerability in Erin Garscadden GC Testimonials plugin <= 1.3.2 versions.
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 13, 2023Popup Builder by OptinMonster: Does not ensure that the campaign to be loaded via some shortcodes is actually a campaignCVE-2023-0772 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
Product
Popup Builder by OptinMonster
Fixed in
2.12.2
What to do
Update Popup Builder by OptinMonster to 2.12.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023WH Testimonials: Stored Cross-Site ScriptingCVE-2023-1372 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WH Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as wh_homepage, wh_text_short, wh_text_full and in versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WH Testimonials
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update WH Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record danielkelley.me plugins.trac.wordpress.org
Feb 21, 2023WP Responsive Testimonials Slider And Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4750 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Responsive Testimonials Slider And Widget
Affected
up to 1.5
What to do
Affects up to 1.5. Update WP Responsive Testimonials Slider And Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023MonsterInsights: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0081 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
MonsterInsights
Fixed in
8.12.1
What to do
Update MonsterInsights to 8.12.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Strong Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4717 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Strong Testimonials
Fixed in
3.0.3
What to do
Update Strong Testimonials to 3.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 6, 2023Easy Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Easy Testimonials
Fixed in
3.9.3
What to do
Update Easy Testimonials to 3.9.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 23, 2023Mongoose Page: Does not validate and escape one of its shortcode attributesCVE-2022-4675 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Product
Mongoose Page
Fixed in
1.9.0
What to do
Update Mongoose Page to 1.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023Real Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4648 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Real Testimonials
Fixed in
2.6.0
What to do
Update Real Testimonials to 2.6.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2023MonsterInsights: Does not sanitize or escape page titles in the top posts/pages sectionCVE-2022-3904 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
Product
MonsterInsights
Fixed in
8.9.1
What to do
Update MonsterInsights to 8.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 13, 2022demon image annotation: Improper input validationCVE-2022-4171 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters input. This means that unauthenticated attackers can bypass the length restrictions and input more characters than allowed via the settings.
Product
demon image annotation
Affected
up to 5.0
What to do
Affects up to 5.0. Update demon image annotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 21, 2022Event Monster: Does not validate and escape some parameters before using them in SQL statementsCVE-2022-3720 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users
Product
Event Monster
Fixed in
1.2.0
What to do
Update Event Monster to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 21, 2022Event Monster: Does not have CSRF checkCVE-2022-3336 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack
Product
Event Monster
Fixed in
1.2.0
What to do
Update Event Monster to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 14, 2022Testimonials WordPress plugin before 2.7, super-testimonial-pro: Do not sanitize and escape its settingsCVE-2022-3539 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Testimonials WordPress plugin before 2.7, super-testimonial-pro
Fixed in
2.7
What to do
Update Testimonials WordPress plugin before 2.7, super-testimonial-pro to 2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2022Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.CVE-2022-44741 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Oct 28, 2022demon image annotation: Cross-Site Request ForgeryCVE-2022-2864 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the ~/includes/settings.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
demon image annotation
Affected
up to 4.7
What to do
Affects up to 4.7. Update demon image annotation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 10, 2022Download Monitor: Does not ensure that files to be downloaded are inside the blog foldersCVE-2022-2981 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
Product
Download Monitor
Fixed in
4.5.98
What to do
Update Download Monitor to 4.5.98 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 23, 2022Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.CVE-2022-40213 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress.
Affected
up to 1.9.6
What to do
Affects up to 1.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 1, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress.CVE-2022-36373 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress.
Affected
up to 2.7.3
What to do
Affects up to 2.7.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Aug 23, 2022Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.CVE-2022-36379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress.
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.