Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,578 results · page 72 of 112
Jul 24, 2023All-in-one Floating Contact Form: Does not sanitise and escape some of its settingsCVE-2023-3248 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- All-in-one Floating Contact Form
- Fixed in
- 2.1.2
- What to do
- Update All-in-one Floating Contact Form to 2.1.2 or newer.
Jul 24, 2023User Activity Log: Does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pagesCVE-2023-2761 · WordPress plugins & themes · reported by WPScanHigh 7.2
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- User Activity Log
- Fixed in
- 1.6.3
- What to do
- Update User Activity Log to 1.6.3 or newer.
Jul 24, 2023wpForo Forum: Does not escape some request parameters while in debug modeCVE-2023-2309 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpForo Forum WordPress plugin before 2.1.9 does not escape some request parameters while in debug mode, leading to a Reflected Cross-Site Scripting vulnerability.
- Product
- wpForo Forum
- Fixed in
- 2.1.9
- What to do
- Update wpForo Forum to 2.1.9 or newer.
Jul 17, 2023Floating Chat Widget: Does not sanitise and escape some of its settingsCVE-2023-3245 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Chat Widget
- Fixed in
- 3.1.2
- What to do
- Update Floating Chat Widget to 3.1.2 or newer.
Jul 17, 2023Membership: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3182 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Membership
- Fixed in
- 3.2.3
- What to do
- Update Membership to 3.2.3 or newer.
Jul 17, 2023POST SMTP Mailer: Does not have proper CSRF checks in some AJAX actionsCVE-2023-3179 · WordPress plugins & themes · reported by WPScanHigh 8.8
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
- Product
- POST SMTP Mailer
- Fixed in
- 2.5.7
- What to do
- Update POST SMTP Mailer to 2.5.7 or newer.
Jul 17, 2023Autochat Automatic Conversation: Does not sanitise and escape user input before outputting it back on the pageCVE-2023-3041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack.
- Product
- Autochat Automatic Conversation
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Autochat Automatic Conversation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2023Gravity Forms: Does not escape generated URLs before outputting them in attributesCVE-2023-2701 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin.
- Product
- Gravity Forms
- Fixed in
- 2.7.5
- What to do
- Update Gravity Forms to 2.7.5 or newer.
Jul 17, 2023AN_GradeBook: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2636 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
- Product
- AN_GradeBook
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2023InventoryPress: Does not sanitise and escape some of its settingsCVE-2023-2579 · WordPress plugins & themes · reported by WPScanMedium 5.4
The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
- Product
- InventoryPress
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update InventoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2023Caldera Forms Google Sheets Connector: Does not have CSRF checkCVE-2023-2330 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- Caldera Forms Google Sheets Connector
- Fixed in
- 1.3
- What to do
- Update Caldera Forms Google Sheets Connector to 1.3 or newer.
Jul 17, 2023WooCommerce Google Sheet Connector: Does not have CSRF checkCVE-2023-2329 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- WooCommerce Google Sheet Connector
- Fixed in
- 1.3.6
- What to do
- Update WooCommerce Google Sheet Connector to 1.3.6 or newer.
Jul 17, 2023Enable SVG, WebP & ICO Upload: Does not sanitize SVG file contentsCVE-2023-2143 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.
- Product
- Enable SVG, WebP & ICO Upload
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Enable SVG, WebP & ICO Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2023Login Configurator: Does not properly escape a URL parameter before outputting it to the pageCVE-2023-1893 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
- Product
- Login Configurator
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Login Configurator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2023NEX-Forms: Does not escape its form nameCVE-2023-0439 · WordPress plugins & themes · reported by WPScanMedium 5.4
The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.
- Product
- NEX-Forms
- Fixed in
- 8.4.4
- What to do
- Update NEX-Forms to 8.4.4 or newer.
Jul 17, 20233DPrint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-4023 · WordPress plugins & themes · reported by WPScanMedium 5.3
The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.
- Product
- 3DPrint
- Fixed in
- 3.5.6.9
- What to do
- Update 3DPrint to 3.5.6.9 or newer.
Jul 10, 2023Float menu: Does not sanitise and escape some of its settingsCVE-2023-3225 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Float menu
- Fixed in
- 5.0.3
- What to do
- Update Float menu to 5.0.3 or newer.
Jul 10, 2023EventON: Does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid EventCVE-2023-3219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
- Product
- EventON
- Fixed in
- 2.1.2
- What to do
- Update EventON to 2.1.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3209 · WordPress plugins & themes · reported by WPScanLow 3.5
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- Product
- MStore API
- Fixed in
- 3.9.7
- What to do
- Update MStore API to 3.9.7 or newer.
Jul 10, 2023AI ChatBot: Does not adequately escape some settingsCVE-2023-3175 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- AI ChatBot
- Fixed in
- 4.6.1
- What to do
- Update AI ChatBot to 4.6.1 or newer.
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3131 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- Product
- MStore API
- Fixed in
- 3.9.7
- What to do
- Update MStore API to 3.9.7 or newer.
Jul 10, 2023URL Shortify: Does not sanitise and escape some of its settingsCVE-2023-3129 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- URL Shortify
- Fixed in
- 1.7.0
- What to do
- Update URL Shortify to 1.7.0 or newer.
Jul 10, 2023Export All URLs: Does not sanitise and escape a parameter before outputting them back in the pageCVE-2023-3118 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Export All URLs
- Fixed in
- 4.6
- What to do
- Update Export All URLs to 4.6 or newer.
Jul 10, 2023MStore API: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-3077 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
- Product
- MStore API
- Fixed in
- 3.9.8
- What to do
- Update MStore API to 3.9.8 or newer.
Jul 10, 2023MStore API: Does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpointCVE-2023-3076 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
- Product
- MStore API
- Fixed in
- 3.9.9
- What to do
- Update MStore API to 3.9.9 or newer.
Jul 10, 2023TinyMCE Custom Styles: Does not sanitise and escape some of its settingsCVE-2023-2967 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- TinyMCE Custom Styles
- Fixed in
- 1.1.4
- What to do
- Update TinyMCE Custom Styles to 1.1.4 or newer.
Jul 10, 2023Simple Iframe: Does not properly validate one of its WordPress block attribute's contentCVE-2023-2964 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks.
- Product
- Simple Iframe
- Fixed in
- 1.2.0
- What to do
- Update Simple Iframe to 1.2.0 or newer.
Jul 10, 2023AN_GradeBook: Does not sanitise and escape some of its settingsCVE-2023-2709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AN_GradeBook
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023Call Now Accessibility Button: Does not sanitise and escape some of its settingsCVE-2023-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Call Now Accessibility Button
- Fixed in
- 1.1
- What to do
- Update Call Now Accessibility Button to 1.1 or newer.
Jul 10, 2023Buy Me a Coffee: Does not sanitise and escape some of its settingsCVE-2023-2578 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Buy Me a Coffee
- Fixed in
- 3.7
- What to do
- Update Buy Me a Coffee to 3.7 or newer.
Jul 10, 2023Enable SVG Uploads: Does not sanitise uploaded SVG filesCVE-2023-2529 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Enable SVG Uploads
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Enable SVG Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023Greeklish-permalink: Does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX actionCVE-2023-2495 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
- Product
- Greeklish-permalink
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Greeklish-permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023All In One Redirection: Does not properly sanitise and escape multiple parameters before using them in an SQL statementCVE-2023-2493 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- All In One Redirection
- Fixed in
- 2.2.0
- What to do
- Update All In One Redirection to 2.2.0 or newer.
Jul 10, 2023PrePost SEO: Does not properly sanitize some of its settingsCVE-2023-2029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PrePost SEO
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update PrePost SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 10, 2023Call Now Accessibility Button: Does not properly sanitize some of its settingsCVE-2023-2028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Call Now Accessibility Button
- Fixed in
- 1.1
- What to do
- Update Call Now Accessibility Button to 1.1 or newer.
Jul 10, 2023Image Protector: Does not properly sanitize some of its settingsCVE-2023-2026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Protector
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Image Protector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023Companion Sitemap Generator: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-1780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Companion Sitemap Generator
- Fixed in
- 4.5.3
- What to do
- Update Companion Sitemap Generator to 4.5.3 or newer.
Jul 10, 2023tagDiv Cloud Library: Does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated usersCVE-2023-1597 · WordPress plugins & themes · reported by WPScanHigh 8.8
The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.
- Product
- tagDiv Cloud Library
- Fixed in
- 2.7
- What to do
- Update tagDiv Cloud Library to 2.7 or newer.
Jul 4, 2023Ultimate Member: Does not prevent visitors from creating user accounts with arbitrary capabilitiesCVE-2023-3460 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
- Product
- Ultimate Member
- Fixed in
- 2.6.7
- What to do
- Update Ultimate Member to 2.6.7 or newer.
Full record and what to do →NVD recordblog.wpscan.comwpscan.com
Jul 4, 2023Tutor LMS: Does not implement adequate permission checks for REST API endpointsCVE-2023-3133 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
- Product
- Tutor LMS
- Fixed in
- 2.2.1
- What to do
- Update Tutor LMS to 2.2.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 4, 2023Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2333 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro
- Affected
- up to 1.2.7
- Fixed in
- 1.2.7
- What to do
- Update Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro to 1.2.7 or newer.
Jul 4, 2023Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro: Does not escape some parameters before outputting them back in attributesCVE-2023-2324 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro WordPress plugin through 1.0.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro
- Affected
- up to 1.0.7
- Fixed in
- 1.0.7
- What to do
- Update Elementor Forms Google Sheet Connector WordPress plugin before 1.0.7, gsheetconnector-for-elementor-forms-pro to 1.0.7 or newer.
Jul 4, 2023WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2321 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro WordPress plugin through 3.4.6 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro
- Affected
- up to 3.4.6
- Fixed in
- 3.4.6
- What to do
- Update WPForms Google Sheet Connector WordPress plugin before 3.4.6, gsheetconnector-wpforms-pro to 3.4.6 or newer.
Jul 4, 2023CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro
- Affected
- up to 5.0.2
- Fixed in
- 5.0.2
- What to do
- Update CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro to 5.0.2 or newer.
Jul 4, 2023Forminator: Does not use an atomic operation to check whether a user has already votedCVE-2023-2010 · WordPress plugins & themes · reported by WPScanLow 3.1
The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.
- Product
- Forminator
- Fixed in
- 1.24.1
- What to do
- Update Forminator to 1.24.1 or newer.
Jul 4, 2023ND Shortcodes: Does not validate some shortcode attributes before using them to generate paths passed to include function/sCVE-2023-1273 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks
- Product
- ND Shortcodes
- Fixed in
- 7.0
- What to do
- Update ND Shortcodes to 7.0 or newer.
Jul 4, 2023ND Shortcodes: Does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4623 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ND Shortcodes WordPress plugin before 7.0 does not validate and escape numerous of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- ND Shortcodes
- Fixed in
- 7.0
- What to do
- Update ND Shortcodes to 7.0 or newer.
Jun 27, 2023Jetpack: Does not validate uploaded filesCVE-2023-2996 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization.
- Product
- Jetpack
- Fixed in
- 12.1.1
- What to do
- Update Jetpack to 12.1.1 or newer.
Jun 27, 2023Formidable Forms: Does not adequately authorize the user or validate the plugin URL in its functionality for installing add-onsCVE-2023-2877 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
- Product
- Formidable Forms
- Fixed in
- 6.3.1
- What to do
- Update Formidable Forms to 6.3.1 or newer.
Jun 27, 2023WP Inventory Manager: Does not have CSRF checksCVE-2023-2842 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack
- Product
- WP Inventory Manager
- Fixed in
- 2.1.0.14
- What to do
- Update WP Inventory Manager to 2.1.0.14 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.