Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,578 results · page 70 of 112
Oct 16, 2023Magee Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4783 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Magee Shortcodes WordPress plugin through 2.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Magee Shortcodes
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Magee Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2023Simple Posts Ticker: Does not sanitise and escape some of its settingsCVE-2023-4725 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Posts Ticker WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Posts Ticker
- Fixed in
- 1.1.6
- What to do
- Update Simple Posts Ticker to 1.1.6 or newer.
Oct 16, 2023WordPress Online Booking and Scheduling: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-4691 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WordPress Online Booking and Scheduling
- Fixed in
- 22.4
- What to do
- Update WordPress Online Booking and Scheduling to 22.4 or newer.
Oct 16, 2023Page Builder: Pagelayer: Doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled postsCVE-2023-4687 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Page Builder: Pagelayer WordPress plugin before 1.7.7 doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts.
- Product
- Page Builder: Pagelayer
- Fixed in
- 1.7.7
- What to do
- Update Page Builder: Pagelayer to 1.7.7 or newer.
Oct 16, 2023Form Maker by 10Web: Does not validate signaturesCVE-2023-4666 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Form Maker by 10Web WordPress plugin before 1.15.20 does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.20
- What to do
- Update Form Maker by 10Web to 1.15.20 or newer.
Oct 16, 2023Simple Posts Ticker: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4646 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Posts Ticker WordPress plugin before 1.1.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Simple Posts Ticker
- Fixed in
- 1.1.6
- What to do
- Update Simple Posts Ticker to 1.1.6 or newer.
Oct 16, 2023EventON: Does not sanitise and escape some of its settingsCVE-2023-4388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- EventON
- Fixed in
- 2.2
- What to do
- Update EventON to 2.2 or newer.
Oct 16, 2023WP Matterport Shortcode: Does not escape the PHP_SELF server variableCVE-2023-4290 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHP_SELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.7
- What to do
- Update WP Matterport Shortcode to 2.1.7 or newer.
Oct 16, 2023WP Matterport Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4289 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Matterport Shortcode WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Matterport Shortcode
- Fixed in
- 2.1.8
- What to do
- Update WP Matterport Shortcode to 2.1.8 or newer.
Oct 16, 2023ActivityPub: Does not sanitize and escape some data from post contentCVE-2023-3746 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActivityPub WordPress plugin before 1.0.0 does not sanitize and escape some data from post content, which could allow contributor and above role to perform Stored Cross-Site Scripting attacks
- Product
- ActivityPub
- Fixed in
- 1.0.0
- What to do
- Update ActivityPub to 1.0.0 or newer.
Oct 16, 2023ActivityPub: Does not ensure that post contents to be displayed are public and belong to the pluginCVE-2023-3707 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue.
- Product
- ActivityPub
- Fixed in
- 1.0.0
- What to do
- Update ActivityPub to 1.0.0 or newer.
Oct 16, 2023ActivityPub: Does not ensure that post titles to be displayed are public and belong to the pluginCVE-2023-3706 · WordPress plugins & themes · reported by WPScanMedium 4.3
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post (such as draft and private) via an IDOR vector
- Product
- ActivityPub
- Fixed in
- 1.0.0
- What to do
- Update ActivityPub to 1.0.0 or newer.
Oct 16, 2023WordPress Gallery: Does not validate some block attributes before using them to generate paths passed to include function/sCVE-2023-3279 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WordPress Gallery Plugin WordPress plugin before 3.39 does not validate some block attributes before using them to generate paths passed to include function/s, allowing Admin users to perform LFI attacks
- Product
- WordPress Gallery
- Fixed in
- 3.39
- What to do
- Update WordPress Gallery to 3.39 or newer.
Oct 16, 2023File Manager Pro: Does not properly check the CSRF nonce in the `fs_connector` AJAX actionCVE-2023-4827 · WordPress plugins & themes · reported by WPScanHigh 8.8
The File Manager Pro WordPress plugin before 1.8 does not properly check the CSRF nonce in the `fs_connector` AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell.
- Product
- File Manager Pro
- Fixed in
- 1.8
- What to do
- Update File Manager Pro to 1.8 or newer.
Oct 16, 2023Booking Calendar: Does not sanitize and escape some of its booking from dataCVE-2023-4620 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators
- Product
- Booking Calendar
- Fixed in
- 9.7.3.1
- What to do
- Update Booking Calendar to 9.7.3.1 or newer.
Sep 25, 2023DoLogin Security: Does not properly sanitize IP addresses coming from the X-Forwarded-For headerCVE-2023-4549 · WordPress plugins & themes · reported by WPScanMedium 6.1
The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.
- Product
- DoLogin Security
- Fixed in
- 3.7
- What to do
- Update DoLogin Security to 3.7 or newer.
Sep 25, 2023Translate WordPress with GTranslate: Does not sanitise and escape some of its settingsCVE-2023-4502 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.
- Product
- Translate WordPress with GTranslate
- Fixed in
- 3.0.4
- What to do
- Update Translate WordPress with GTranslate to 3.0.4 or newer.
Sep 25, 2023WP Job Portal: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-4490 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Job Portal WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
- Product
- WP Job Portal
- Fixed in
- 2.0.6
- What to do
- Update WP Job Portal to 2.0.6 or newer.
Sep 25, 2023Locatoraid Store Locator: Does not sanitise and escape the lpr-search parameter before outputting it back in the pageCVE-2023-4476 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Locatoraid Store Locator
- Fixed in
- 3.9.24
- What to do
- Update Locatoraid Store Locator to 3.9.24 or newer.
Sep 25, 2023Import XML and RSS Feeds: Does not filter file extensions for uploaded filesCVE-2023-4300 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution.
- Product
- Import XML and RSS Feeds
- Fixed in
- 2.1.4
- What to do
- Update Import XML and RSS Feeds to 2.1.4 or newer.
Sep 25, 2023Prevent files / folders access: Does not validate files to be uploadedCVE-2023-4238 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.
- Product
- Prevent files / folders access
- Fixed in
- 2.5.2
- What to do
- Update Prevent files / folders access to 2.5.2 or newer.
Sep 25, 2023Ditty: Does not sanitise and escape some parameters and generated URLs before outputting them back in attributesCVE-2023-4148 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Ditty
- Fixed in
- 3.1.25
- What to do
- Update Ditty to 3.1.25 or newer.
Sep 25, 2023FileOrganizer: Does not restrict functionality on multisite instancesCVE-2023-3664 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FileOrganizer WordPress plugin through 1.0.2 does not restrict functionality on multisite instances, allowing site admins to gain full control over the server.
- Product
- FileOrganizer
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update FileOrganizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2023All in One B2B for WooCommerce: Does not properly check nonce values in several actionsCVE-2023-3547 · WordPress plugins & themes · reported by WPScanHigh 8.8
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly check nonce values in several actions, allowing an attacker to perform CSRF attacks.
- Product
- All in One B2B for WooCommerce
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update All in One B2B for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2023Popup Builder: Does not sanitise and escape some of its settingsCVE-2023-3226 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Popup Builder
- Fixed in
- 4.2.0
- What to do
- Update Popup Builder to 4.2.0 or newer.
Sep 19, 2023Serial Codes Generator and Validator with WooCommerce Support: Does not sanitise and escape some of its settingsCVE-2023-4376 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Serial Codes Generator and Validator with WooCommerce Support WordPress plugin before 2.4.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Serial Codes Generator and Validator with WooCommerce Support
- Fixed in
- 2.4.15
- What to do
- Update Serial Codes Generator and Validator with WooCommerce Support to 2.4.15 or newer.
Sep 19, 2023Leyka: Does not sanitise and escape some of its settingsCVE-2023-2995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Leyka WordPress plugin before 3.30.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Leyka
- Fixed in
- 3.30.4
- What to do
- Update Leyka to 3.30.4 or newer.
Sep 11, 2023Herd Effects: Does not have CSRFCVE-2023-4318 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack
- Product
- Herd Effects
- Fixed in
- 5.2.4
- What to do
- Update Herd Effects to 5.2.4 or newer.
Sep 11, 2023wpDataTables: Does not validate the "Serialized PHP array" input data before deserializing the dataCVE-2023-4314 · WordPress plugins & themes · reported by WPScanHigh 7.2
The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.
- Product
- wpDataTables
- Fixed in
- 2.1.66
- What to do
- Update wpDataTables to 2.1.66 or newer.
Sep 11, 2023Lock User Account: Does not have CSRF checkCVE-2023-4307 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Lock User Account WordPress plugin through 1.0.3 does not have CSRF check when bulk locking and unlocking accounts, which could allow attackers to make logged in admins lock and unlock arbitrary users via a CSRF attack
- Product
- Lock User Account
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Lock User Account to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2023URL Shortify: Does not properly escape the value of the referer headerCVE-2023-4294 · WordPress plugins & themes · reported by WPScanMedium 6.1
The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link.
- Product
- URL Shortify
- Fixed in
- 1.7.6
- What to do
- Update URL Shortify to 1.7.6 or newer.
Sep 11, 2023MasterStudy LMS: Does not have proper checks in place during registration allowing anyone to register on the siteCVE-2023-4278 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
- Product
- MasterStudy LMS
- Fixed in
- 3.0.18
- What to do
- Update MasterStudy LMS to 3.0.18 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 11, 2023Min Max Control: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-4270 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Min Max Control
- Fixed in
- 4.6
- What to do
- Update Min Max Control to 4.6 or newer.
Sep 11, 2023WP Adminify: Does not sanitise and escape some of its settingsCVE-2023-4060 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Adminify
- Fixed in
- 3.1.6
- What to do
- Update WP Adminify to 3.1.6 or newer.
Sep 11, 2023Herd Effects: Does not sanitise and escape some of its settingsCVE-2023-4022 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Herd Effects
- Fixed in
- 5.2.3
- What to do
- Update Herd Effects to 5.2.3 or newer.
Sep 11, 2023FTP Access: Does not have authorisation and CSRF checksCVE-2023-3510 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin will view the settings of the plugin. The attack could also be perform via CSRF against any authenticated user.
- Product
- FTP Access
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update FTP Access to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settingsCVE-2023-3170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- tagDiv Composer
- Fixed in
- 4.2
- What to do
- Update tagDiv Composer to 4.2 or newer.
Sep 11, 2023The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST routCVE-2023-3169 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.
- Product
- tagDiv Composer
- Fixed in
- 4.2
- What to do
- Update tagDiv Composer to 4.2 or newer.
Sep 11, 2023gAppointments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2705 · WordPress plugins & themes · reported by WPScanMedium 6.1
The gAppointments WordPress plugin before 1.10.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin
- Product
- gAppointments
- Fixed in
- 1.10.0
- What to do
- Update gAppointments to 1.10.0 or newer.
Sep 4, 2023123.chat: Does not sanitise and escape some of its settingsCVE-2023-4298 · WordPress plugins & themes · reported by WPScanMedium 4.8
The 123.chat WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- 123.chat
- Fixed in
- 1.3.1
- What to do
- Update 123.chat to 1.3.1 or newer.
Sep 4, 2023Post Timeline: Does not sanitise and escape an invalid nonce before outputting it back in an AJAX responseCVE-2023-4284 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Timeline WordPress plugin before 2.2.6 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Post Timeline
- Fixed in
- 2.2.6
- What to do
- Update Post Timeline to 2.2.6 or newer.
Sep 4, 2023AI ChatBot: Does not sanitise and escape some of its settingsCVE-2023-4254 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- AI ChatBot
- Fixed in
- 4.7.8
- What to do
- Update AI ChatBot to 4.7.8 or newer.
Sep 4, 2023AI ChatBot: Does not sanitise and escape some of its settingsCVE-2023-4253 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.7.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- AI ChatBot
- Fixed in
- 4.7.8
- What to do
- Update AI ChatBot to 4.7.8 or newer.
Sep 4, 2023Orders Tracking for WooCommerce: Doesn't validate the file_url parameterCVE-2023-4216 · WordPress plugins & themes · reported by WPScanLow 2.7
The Orders Tracking for WooCommerce WordPress plugin before 1.2.6 doesn't validate the file_url parameter when importing a CSV file, allowing high privilege users with the manage_woocommerce capability to access any file on the web server via a Traversal attack. The content retrieved is however limited to the first line of the file.
- Product
- Orders Tracking for WooCommerce
- Fixed in
- 1.2.6
- What to do
- Update Orders Tracking for WooCommerce to 1.2.6 or newer.
Sep 4, 2023Store Locator: Does not sanitise and escape an invalid nonce before outputting it back in an AJAX responseCVE-2023-4151 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Store Locator
- Fixed in
- 1.4.13
- What to do
- Update Store Locator to 1.4.13 or newer.
Sep 4, 2023Media from FTP: Does not properly limit who can use the pluginCVE-2023-4019 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Media from FTP WordPress plugin before 11.17 does not properly limit who can use the plugin, which may allow users with author+ privileges to move files around, like wp-config.php, which may lead to RCE in some cases.
- Product
- Media from FTP
- Fixed in
- 11.17
- What to do
- Update Media from FTP to 11.17 or newer.
Sep 4, 2023Advanced File Manager: Does not adequately authorize its usage on multisite installationsCVE-2023-3814 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Advanced File Manager WordPress plugin before 5.1.1 does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server.
- Product
- Advanced File Manager
- Fixed in
- 5.1.1
- What to do
- Update Advanced File Manager to 5.1.1 or newer.
Sep 4, 2023Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its settingsCVE-2023-3499 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.16
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.16 or newer.
Aug 30, 2023POEditor: Does not have CSRF checks in various placesCVE-2023-4209 · WordPress plugins & themes · reported by WPScanMedium 4.3
The POEditor WordPress plugin before 0.9.8 does not have CSRF checks in various places, which could allow attackers to make logged in admins perform unwanted actions, such as reset the plugin's settings and update its API key via CSRF attacks.
- Product
- POEditor
- Fixed in
- 0.9.8
- What to do
- Update POEditor to 0.9.8 or newer.
Aug 30, 2023User Activity Tracking and Log: Does not have proper CSRF checksCVE-2023-4150 · WordPress plugins & themes · reported by WPScanMedium 4.3
The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks
- Product
- User Activity Tracking and Log
- Fixed in
- 4.0.9
- What to do
- Update User Activity Tracking and Log to 4.0.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.