Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

481 results · page 7 of 10

Aug 10, 2023EmbedPress: Unauthorized loss of dataCVE-2023-4282 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated attackers with subscriber privileges or above, to delete plugin settings.
Product
EmbedPress
Affected
up to 3.8.2
What to do
Affects up to 3.8.2. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 4, 2023ND Shortcodes: Does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4623 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
ND Shortcodes
Fixed in
7.0
What to do
Update ND Shortcodes to 7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 26, 2023EmbedPress: Sensitive Information ExposureCVE-2023-3371 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The EmbedPress plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'lock_content_form_handler' and 'display_password_form' function in versions up to, and including, 3.7.3. This makes it possible for unauthenticated attackers to decrypt and view the password protected content.
Product
EmbedPress
Affected
up to 3.7.3
What to do
Affects up to 3.7.3. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2023SlideOnline: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0489 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
SlideOnline
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update SlideOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023Responsive Tabs For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0368 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)
Affected
up to 1.1
What to do
Affects up to 1.1. Update Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2023WP Multi Store Locator: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0152 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Multi Store Locator
Affected
up to 2.4
What to do
Affects up to 2.4. Update WP Multi Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023f(x) TOC: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0490 · WordPress plugins & themes · reported by WPScanMedium 5.4
The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
f(x) TOC
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update f(x) TOC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 15, 2023ActiveCampaign: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0233 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
ActiveCampaign
Fixed in
8.1.12
What to do
Update ActiveCampaign to 8.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023WP Popups: Does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embedCVE-2023-1905 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003
Product
WP Popups
Fixed in
2.1.5.1
What to do
Update WP Popups to 2.1.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Custom Post Type List Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0542 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Post Type List Shortcode WordPress plugin through 1.4.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Custom Post Type List Shortcode
Affected
up to 1.4.4
What to do
Affects up to 1.4.4. Update Custom Post Type List Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Product Slider For WooCommerce Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0537 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider For WooCommerce Lite WordPress plugin through 1.1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Product Slider For WooCommerce Lite
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update Product Slider For WooCommerce Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Wp-D3: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wp-D3 WordPress plugin through 2.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Wp-D3
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update Wp-D3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Post Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0526 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Post Shortcode
Affected
up to 2.0.9
What to do
Affects up to 2.0.9. Update Post Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Ultimate Carousel For Elementor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0280 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Carousel For Elementor WordPress plugin through 2.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Ultimate Carousel For Elementor
Affected
up to 2.1.7
What to do
Affects up to 2.1.7. Update Ultimate Carousel For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Mega Addons For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0268 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mega Addons For WPBakery Page Builder WordPress plugin before 4.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Mega Addons For WPBakery Page Builder
Fixed in
4.3.0
What to do
Update Mega Addons For WPBakery Page Builder to 4.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023Ultimate Carousel For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0267 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Carousel For WPBakery Page Builder WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Ultimate Carousel For WPBakery Page Builder
Affected
up to 2.6
What to do
Affects up to 2.6. Update Ultimate Carousel For WPBakery Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2023StagTools: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0891 · WordPress plugins & themes · reported by WPScanMedium 5.4
The StagTools WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
StagTools
Fixed in
2.3.7
What to do
Update StagTools to 2.3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023Video Central for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0418 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Video Central for
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Video Central for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023Weaver Xtreme Theme Support: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0276 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Weaver Xtreme Theme Support WordPress plugin before 6.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Weaver Xtreme Theme Support
Fixed in
6.2.7
What to do
Update Weaver Xtreme Theme Support to 6.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023Easy Forms for Mailchimp: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1325 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Easy Forms for Mailchimp
Fixed in
6.8.7
What to do
Update Easy Forms for Mailchimp to 6.8.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023W4 Post List: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0374 · WordPress plugins & themes · reported by WPScanMedium 5.4
The W4 Post List WordPress plugin before 2.4.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
W4 Post List
Fixed in
2.4.6
What to do
Update W4 Post List to 2.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2023Pricing Tables For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0367 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
Fixed in
3.0
What to do
Update Pricing Tables For WPBakery Page Builder (formerly Visual Composer) to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023Scheduled Announcements Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0363 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Scheduled Announcements Widget
Fixed in
1.0
What to do
Update Scheduled Announcements Widget to 1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 10, 2023WP Tiles: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4827 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Tiles WordPress plugin through 1.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Tiles
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update WP Tiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 3, 2023Image Over Image For WPBakery Page Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0399 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Over Image For WPBakery Page Builder WordPress plugin before 3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Image Over Image For WPBakery Page Builder
Fixed in
3.0
What to do
Update Image Over Image For WPBakery Page Builder to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Complianz WordPress plugin before 6.4.2, Complianz Premium: Do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-1069 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Complianz WordPress plugin before 6.4.2, Complianz Premium WordPress plugin before 6.4.2 do not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Complianz WordPress plugin before 6.4.2, Complianz Premium
Fixed in
6.4.2
What to do
Update Complianz WordPress plugin before 6.4.2, Complianz Premium to 6.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Cookie Notice & Compliance for GDPR / CCPA: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0823 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Cookie Notice & Compliance for GDPR / CCPA
Fixed in
2.4.7
What to do
Update Cookie Notice & Compliance for GDPR / CCPA to 2.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Smart Slider 3: Does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0660 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Smart Slider 3
Fixed in
3.5.1.14
What to do
Update Smart Slider 3 to 3.5.1.14 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023Schedulicity: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0491 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Schedulicity
Affected
up to 2.21
What to do
Affects up to 2.21. Update Schedulicity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023menu shortcode: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0395 · WordPress plugins & themes · reported by WPScanMedium 5.4
The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
menu shortcode
Affected
up to 1.0
What to do
Affects up to 1.0. Update menu shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 27, 2023NEX-Forms: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0272 · WordPress plugins & themes · reported by WPScanMedium 5.4
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
NEX-Forms
Fixed in
8.3.3
What to do
Update NEX-Forms to 8.3.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 23, 2023Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous TypeCVE-2023-23707 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via upload of SVG and HTML files. This issue affects Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.1 versions.
Product
Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
Affected
up to 2.7.1
What to do
Affects up to 2.7.1. Update Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 20, 2023WPB Advanced FAQ: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0370 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WPB Advanced FAQ
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update WPB Advanced FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023GoToWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0369 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
GoToWP
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update GoToWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023React Webcam: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0365 · WordPress plugins & themes · reported by WPScanMedium 5.4
The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
React Webcam
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update React Webcam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023real.Kit: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
real.Kit
Fixed in
5.1.1
What to do
Update real.Kit to 5.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Custom Content Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Custom Content Shortcode
Affected
up to 4.0.2
What to do
Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Responsive Clients Logo Gallery Plugin for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0175 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Responsive Clients Logo Gallery Plugin for
Affected
up to 1.1.9
What to do
Affects up to 1.1.9. Update Responsive Clients Logo Gallery Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023GetResponse for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0167 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GetResponse for WordPress plugin through 5.5.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
GetResponse for
Affected
up to 5.5.31
What to do
Affects up to 5.5.31. Update GetResponse for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 20, 2023Saan World Clock: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0145 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Saan World Clock
Affected
up to 1.8
What to do
Affects up to 1.8. Update Saan World Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Campaign URL Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0538 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Campaign URL Builder
Fixed in
1.8.2
What to do
Update Campaign URL Builder to 1.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Juicer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0172 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Juicer
Fixed in
1.11
What to do
Update Juicer to 1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Client Logo Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0073 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Client Logo Carousel
Affected
up to 3.0.0
What to do
Affects up to 3.0.0. Update Client Logo Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Companion Sitemap Generator: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0066 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Companion Sitemap Generator WordPress plugin through 4.5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Companion Sitemap Generator
Affected
up to 4.5.1.1
What to do
Affects up to 4.5.1.1. Update Companion Sitemap Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Widgets for WooCommerce Products on Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4661 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Widgets for WooCommerce Products on Elementor
Fixed in
1.0.8
What to do
Update Widgets for WooCommerce Products on Elementor to 1.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023Video Background: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4652 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Background WordPress plugin before 2.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Video Background
Fixed in
2.7.5
What to do
Update Video Background to 2.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2023WordPress Infinite Scroll: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4466 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
WordPress Infinite Scroll
Fixed in
5.6.0.3
What to do
Update WordPress Infinite Scroll to 5.6.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Scriptless Social Sharing: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0377 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Scriptless Social Sharing
Fixed in
3.2.2
What to do
Update Scriptless Social Sharing to 3.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Advanced Recent Posts: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0212 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Advanced Recent Posts
Affected
up to 0.6.14
What to do
Affects up to 0.6.14. Update Advanced Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 6, 2023Cost Calculator: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0165 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Cost Calculator
Affected
up to 1.8
What to do
Affects up to 1.8. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.