Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,765 results · page 63 of 116
Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress.CVE-2022-29440 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in Promotion Slider plugin <= 3.3.4 at WordPress.
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 15, 2022Image Slider by NextCode plugin <= 1.1.2 at: Cross-Site Request Forgery (CSRF)CVE-2022-29439 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress allows deleting slides.
- Product
- Image Slider by NextCode plugin <= 1.1.2 at
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Image Slider by NextCode plugin <= 1.1.2 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 15, 2022Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress.CVE-2022-29438 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher user role) Persistent Cross-Site Scripting (XSS) vulnerability in Image Slider by NextCode plugin <= 1.1.2 at WordPress.
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 15, 2022Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress.CVE-2022-29437 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Image Slider by NextCode plugin <= 1.1.2 at WordPress.
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 15, 2022Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team Manager plugin <= 1CVE-2022-29406 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in DynamicWebLab's WordPress Team Manager plugin <= 1.6.9 at WordPress.
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 15, 2022Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress.CVE-2021-36901 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Phil Baker's Age Gate plugin <= 2.17.0 at WordPress.
- Affected
- up to 2.17.0
- What to do
- Affects up to 2.17.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 13, 2022DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.CVE-2022-29455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comrotem-bar.com
Jun 13, 2022Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the inCVE-2022-1659 · WordPress plugins & themes · reported by WordfenceMedium 5.4
Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack.
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via thCVE-2022-1658 · WordPress plugins & themes · reported by WordfenceMedium 5.4
Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, any logged-in user can delete any installed plugin on the site.
- Affected
- up to 6.10.1
- What to do
- Affects up to 6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrCVE-2022-1654 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions
- Affected
- up to 6.10.1
- What to do
- Affects up to 6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 13, 2022One Click Plugin Updater: Does not have CSRF check in placeCVE-2022-1791 · WordPress plugins & themes · reported by WPScanHigh 8.1
The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.
- Product
- One Click Plugin Updater
- Affected
- up to 2.4.14
- What to do
- Affects up to 2.4.14. Update One Click Plugin Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.CVE-2022-1788 · WordPress plugins & themes · reported by WPScanMedium 6.5
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including rCVE-2022-1763 · WordPress plugins & themes · reported by WPScanMedium 5.4
Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022iQ Block Country: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-1762 · WordPress plugins & themes · reported by WPScanHigh 7.5
The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- iQ Block Country
- Fixed in
- 1.2.20
- What to do
- Update iQ Block Country to 1.2.20 or newer.
Jun 13, 2022HC Custom WP-Admin URL: Leaks the secret login URLCVE-2022-1595 · WordPress plugins & themes · reported by WPScanMedium 5.3
The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request
- Product
- HC Custom WP-Admin URL
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update HC Custom WP-Admin URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a RCVE-2022-1532 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Fixed in
- 1.3.8
- What to do
- Update the plugin to 1.3.8 or newer.
Jun 8, 2022The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form CVE-2022-1597 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form which makes it possible to perform Reflected Cross-Site Scripting attacks
- Product
- WPQA Builder
- Fixed in
- 5.4
- What to do
- Update WPQA Builder to 5.4 or newer.
Jun 2, 2022Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress.CVE-2021-36890 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Social Share Buttons by Supsystic plugin <= 2.2.2 at WordPress.
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jun 2, 2022Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at WordPress.CVE-2021-36866 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Easy Pricing Tables plugin <= 3.1.2 at WordPress.
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 30, 2022VikBooking Hotel Booking Engine & PMS: Does not escape the current URL before putting it back in a JavaScript contextCVE-2022-1528 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.9
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.9 or newer.
May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
- Product
- JivoChat Live Chat
- Fixed in
- 1.3.5.4
- What to do
- Update JivoChat Live Chat to 1.3.5.4 or newer.
May 25, 2022Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.CVE-2022-29408 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Persistent Cross-Site Scripting (XSS) vulnerability in Vsourz Digital's Advanced Contact form 7 DB plugin <= 1.8.7 at WordPress.
- Affected
- up to 1.8.7
- What to do
- Affects up to 1.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.CVE-2022-29447 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Spiffy Plugins Spiffy Calendar <= 4.9.0 at: Insecure Direct Object References (IDOR)CVE-2022-29434 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.
- Product
- Spiffy Plugins Spiffy Calendar <= 4.9.0 at
- Affected
- up to 4.9.0
- What to do
- Affects up to 4.9.0. Update Spiffy Plugins Spiffy Calendar <= 4.9.0 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 onCVE-2022-29432 · WordPress plugins & themes · reported by PatchstackLow 3.4
Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters.
- Affected
- up to 2.1.27
- What to do
- Affects up to 2.1.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022KubiQ CPT base plugin <= 5.8 at: Cross-Site Request Forgery (CSRF)CVE-2022-29431 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base.
- Product
- KubiQ CPT base plugin <= 5.8 at
- Affected
- up to 5.8
- What to do
- Affects up to 5.8. Update KubiQ CPT base plugin <= 5.8 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022KubiQ's PNG to JPG plugin <= 4.0 at: Cross-Site Scripting (XSS)CVE-2022-29430 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable parameter &jpg_quality.
- Product
- KubiQ's PNG to JPG plugin <= 4.0 at
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update KubiQ's PNG to JPG plugin <= 4.0 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5 at WordPress.CVE-2022-29428 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5 at WordPress.
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress.CVE-2022-29427 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress.
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin <CVE-2022-29426 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin <= 1.3.54 at WordPress.
- Affected
- up to 1.3.54
- What to do
- Affects up to 1.3.54. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.CVE-2022-29448 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.
- Affected
- up to 5.2
- What to do
- Affects up to 5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress.CVE-2022-29425 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1 aCVE-2022-29424 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1 at WordPress.
- Affected
- up to 9.7.1
- What to do
- Affects up to 9.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress.CVE-2021-36833 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress.
- Affected
- up to 4.8.6
- What to do
- Affects up to 4.8.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 19, 2022Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 at WordPress.CVE-2022-29449 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booking plugin <= 1.2.7 at WordPress.
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 19, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.CVE-2022-29446 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugin <= 1.1.1 at WordPress.
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 18, 2022Code Snippets plugin <= 2.14.3 at: Reflected Cross-Site Scripting (XSS)CVE-2022-25617 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter.
- Product
- Code Snippets plugin <= 2.14.3 at
- Affected
- up to 2.14.3
- What to do
- Affects up to 2.14.3. Update Code Snippets plugin <= 2.14.3 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 18, 2022Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.CVE-2022-29445 · WordPress plugins & themes · reported by PatchstackMedium 6.8
Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Popup Box plugin <= 2.1.2 at WordPress.
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 17, 2022Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on: Persistent Cross-Site Scripting (XSS)CVE-2022-29436 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Persistent Cross-Site Scripting (XSS) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery (vulnerable parameters &title, &snippet_code).
- Product
- Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 17, 2022Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on: Cross-Site Request Forgery (CSRF)CVE-2022-29435 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress allows an attacker to delete or to turn on/off snippets.
- Product
- Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 17, 2022Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.CVE-2022-29429 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.
- Affected
- up to 1.4.7
- What to do
- Affects up to 1.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_messCVE-2022-1425 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not properly validate imagesCVE-2022-1409 · WordPress plugins & themes · reported by WPScanHigh 7.2
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not escape various settings before outputting them in attributesCVE-2022-1408 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not have CSRF check in placeCVE-2022-1407 · WordPress plugins & themes · reported by WPScanMedium 6.5
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 16, 2022The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary CVE-2022-1386 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms which could be used to initiate arbitrary HTTP requests. The data returned is then reflected back in the application's response. This could be used to interact with hosts on the server's local network bypassing firewalls and access control measures.
- Product
- Fusion Builder
- Fixed in
- 3.6.2
- What to do
- Update Fusion Builder to 3.6.2 or newer.
Full record and what to do →NVD recordtheme-fusion.comwpscan.com
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_iCVE-2022-1349 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_id parameter of the ajax action wpqa_remove_image belongs to the requesting user, allowing any users (with privileges as low as Subscriber) to delete the profile pictures of any other user.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
May 16, 2022Bulk Edit and Create User Profiles: Does not sanitise and escape the Users LoginCVE-2022-1089 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Bulk Edit and Create User Profiles
- Fixed in
- 1.5.14
- What to do
- Update Bulk Edit and Create User Profiles to 1.5.14 or newer.
May 16, 2022The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profilCVE-2022-1051 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any authenticated user to perform Cross-Site Scripting attacks.
- Product
- WPQA Builder
- Fixed in
- 5.2
- What to do
- Update WPQA Builder to 5.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.