Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,578 results · page 73 of 112
Jun 27, 2023CodeColorer: Does not sanitise and escape some of its settingsCVE-2023-2795 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CodeColorer
- Fixed in
- 0.10.1
- What to do
- Update CodeColorer to 0.10.1 or newer.
Jun 27, 2023ERP: Does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statementCVE-2023-2744 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- ERP
- Fixed in
- 1.12.4
- What to do
- Update ERP to 1.12.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023ERP: Does not sanitise and escape the employee_name parameter before outputting it back in the pageCVE-2023-2743 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ERP WordPress plugin before 1.12.4 does not sanitise and escape the employee_name parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- ERP
- Fixed in
- 1.12.4
- What to do
- Update ERP to 1.12.4 or newer.
Jun 27, 2023Ultimate Product Catalog: Does not sanitise and escape some of its settingsCVE-2023-2711 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Product Catalog WordPress plugin before 5.2.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Product Catalog
- Fixed in
- 5.2.6
- What to do
- Update Ultimate Product Catalog to 5.2.6 or newer.
Jun 27, 2023KiviCare: Does not have CSRF checks (either flawed or missing completely) in various AJAX actionsCVE-2023-2628 · WordPress plugins & themes · reported by WPScanHigh 8.8
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Jun 27, 2023KiviCare: Does not have proper CSRF and authorisation checks in various AJAX actionsCVE-2023-2627 · WordPress plugins & themes · reported by WPScanMedium 4.3
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Jun 27, 2023KiviCare: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2624 · WordPress plugins & themes · reported by WPScanMedium 6.1
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrator
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023KiviCare: Does not restrict the information returned in a response and returns all user dataCVE-2023-2623 · WordPress plugins & themes · reported by WPScanMedium 6.5
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users
- Product
- KiviCare
- Fixed in
- 3.2.1
- What to do
- Update KiviCare to 3.2.1 or newer.
Jun 27, 2023wpbrutalai: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2605 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpbrutalai WordPress plugin before 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin.
- Product
- wpbrutalai
- Fixed in
- 2.0.1
- What to do
- Update wpbrutalai to 2.0.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023wpbrutalai: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2601 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wpbrutalai WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin via CSRF.
- Product
- wpbrutalai
- Fixed in
- 2.0.0
- What to do
- Update wpbrutalai to 2.0.0 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023FormCraft: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2592 · WordPress plugins & themes · reported by WPScanHigh 7.2
The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- FormCraft
- Fixed in
- 3.9.7
- What to do
- Update FormCraft to 3.9.7 or newer.
Jun 27, 2023AI Engine: Does not sanitize and escape some of its settingsCVE-2023-2580 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI Engine WordPress plugin before 1.6.83 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- AI Engine
- Fixed in
- 1.6.83
- What to do
- Update AI Engine to 1.6.83 or newer.
Jun 27, 2023Responsive CSS EDITOR: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2482 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Responsive CSS EDITOR WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admin.
- Product
- Responsive CSS EDITOR
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Responsive CSS EDITOR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2023Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro: Does not have CSRF checkCVE-2023-2326 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro WordPress plugin through 1.3.5 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro
- Affected
- up to 1.3.5
- Fixed in
- 1.3.5
- What to do
- Update Gravity Forms Google Sheet Connector WordPress plugin before 1.3.5, gsheetconnector-gravityforms-pro to 1.3.5 or newer.
Jun 27, 2023Aajoda Testimonials: Does not sanitise and escape some of its settingsCVE-2023-2178 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Aajoda Testimonials WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Aajoda Testimonials
- Fixed in
- 2.2.2
- What to do
- Update Aajoda Testimonials to 2.2.2 or newer.
Jun 27, 2023File Manager Advanced Shortcode: Does not adequately prevent uploading files with disallowed MIME typesCVE-2023-2068 · WordPress plugins & themes · reported by WPScanCritical 9.8
The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. This leads to RCE in cases where the allowed MIME type list does not include PHP files. In the worst case, this is available to unauthenticated users.
- Product
- File Manager Advanced Shortcode
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update File Manager Advanced Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 27, 2023Custom 404 Pro: Does not properly sanitize database inputsCVE-2023-2032 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabilities.
- Product
- Custom 404 Pro
- Fixed in
- 3.8.1
- What to do
- Update Custom 404 Pro to 3.8.1 or newer.
Jun 27, 2023Accordion & FAQ: Does not escape various generated URLsCVE-2023-1891 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting
- Product
- Accordion & FAQ
- Fixed in
- 1.9.9
- What to do
- Update Accordion & FAQ to 1.9.9 or newer.
Jun 27, 2023USM-Premium: Does not sanitize and escape some of its settingsCVE-2023-1166 · WordPress plugins & themes · reported by WPScanMedium 4.8
The USM-Premium WordPress plugin before 16.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- USM-Premium
- Fixed in
- 16.3
- What to do
- Update USM-Premium to 16.3 or newer.
Jun 27, 2023Kanban Boards for: Does not sanitise and escape some of its settingsCVE-2023-0873 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kanban Boards for WordPress plugin before 2.5.21 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Kanban Boards for
- Fixed in
- 2.5.21
- What to do
- Update Kanban Boards for to 2.5.21 or newer.
Jun 27, 2023Catalyst Connect Zoho CRM Client Portal: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2023-0588 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
- Product
- Catalyst Connect Zoho CRM Client Portal
- Fixed in
- 2.1.0
- What to do
- Update Catalyst Connect Zoho CRM Client Portal to 2.1.0 or newer.
Jun 27, 2023Editorial Calendar: Does not sanitise and escape its settingsCVE-2022-4115 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Editorial Calendar WordPress plugin before 3.8.3 does not sanitise and escape its settings, allowing users with roles as low as contributor to inject arbitrary web scripts in the plugin admin panel, enabling a Stored Cross-Site Scripting vulnerability targeting higher privileged users.
- Product
- Editorial Calendar
- Fixed in
- 3.8.3
- What to do
- Update Editorial Calendar to 3.8.3 or newer.
Jun 19, 2023Google Map Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-2899 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Google Map Shortcode WordPress plugin through 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Google Map Shortcode
- Affected
- up to 3.1.2
- What to do
- Affects up to 3.1.2. Update Google Map Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023Ultimate Dashboard: Does not sanitise and escape some of its settingsCVE-2023-2812 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ultimate Dashboard WordPress plugin before 3.7.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Dashboard
- Fixed in
- 3.7.6
- What to do
- Update Ultimate Dashboard to 3.7.6 or newer.
Jun 19, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-2811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks to all admin when setting chatbot and all client when using chatbot
- Product
- AI ChatBot
- Fixed in
- 4.5.6
- What to do
- Update AI ChatBot to 4.5.6 or newer.
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statementCVE-2023-2805 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_add_agent_leaves AJAX function before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- SupportCandy
- Fixed in
- 3.1.7
- What to do
- Update SupportCandy to 3.1.7 or newer.
Jun 19, 2023Social Share, Social Login and Social Comments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2779 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.52
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.52 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 19, 2023Upload Resume: Does not validate the captcha parameterCVE-2023-2751 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Upload Resume WordPress plugin through 1.2.0 does not validate the captcha parameter when uploading a resume via the resume_upload_form shortcode, allowing unauthenticated visitors to upload arbitrary media files to the site.
- Product
- Upload Resume
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Upload Resume to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023AI ChatBot: Does not sanitize and escape its settingsCVE-2023-2742 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- AI ChatBot
- Fixed in
- 4.5.5
- What to do
- Update AI ChatBot to 4.5.5 or newer.
Jun 19, 2023SupportCandy: Does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statementCVE-2023-2719 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in the REST API before using it in an SQL statement, leading to an SQL Injection exploitable by users with a role as low as Subscriber.
- Product
- SupportCandy
- Fixed in
- 3.1.7
- What to do
- Update SupportCandy to 3.1.7 or newer.
Jun 19, 2023File Renaming on Upload: Does not sanitise and escape some of its settingsCVE-2023-2684 · WordPress plugins & themes · reported by WPScanMedium 4.8
The File Renaming on Upload WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- File Renaming on Upload
- Fixed in
- 2.5.2
- What to do
- Update File Renaming on Upload to 2.5.2 or newer.
Jun 19, 2023Conditional Menus: Does not escape a parameter before outputting it back in an attributeCVE-2023-2654 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Conditional Menus WordPress plugin before 1.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Conditional Menus
- Fixed in
- 1.2.1
- What to do
- Update Conditional Menus to 1.2.1 or newer.
Jun 19, 2023Custom Base Terms: Does not sanitize and escape some of its settingsCVE-2023-2600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Base Terms WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Custom Base Terms
- Fixed in
- 1.0.3
- What to do
- Update Custom Base Terms to 1.0.3 or newer.
Jun 19, 2023Integration for Contact Form 7 and Zoho CRM, Bigin: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2527 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Integration for Contact Form 7 and Zoho CRM, Bigin WordPress plugin before 1.2.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Integration for Contact Form 7 and Zoho CRM, Bigin
- Fixed in
- 1.2.4
- What to do
- Update Integration for Contact Form 7 and Zoho CRM, Bigin to 1.2.4 or newer.
Jun 19, 2023QueryWall: Plug'n Play Firewall: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2492 · WordPress plugins & themes · reported by WPScanHigh 7.2
The QueryWall: Plug'n Play Firewall WordPress plugin through 1.1.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- QueryWall: Plug'n Play Firewall
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update QueryWall: Plug'n Play Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023QuBot: Does not sanitise and escape some of its settingsCVE-2023-2401 · WordPress plugins & themes · reported by WPScanMedium 4.8
The QuBot WordPress plugin before 1.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- QuBot
- Fixed in
- 1.1.6
- What to do
- Update QuBot to 1.1.6 or newer.
Jun 19, 2023QuBot: Doesn't filter user input on chatCVE-2023-2399 · WordPress plugins & themes · reported by WPScanMedium 6.1
The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard.
- Product
- QuBot
- Fixed in
- 1.1.6
- What to do
- Update QuBot to 1.1.6 or newer.
Jun 19, 2023Slider Revolution: Does not check for valid image files upon importCVE-2023-2359 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations.
- Product
- Slider Revolution
- Affected
- up to 6.6.12
- What to do
- Affects up to 6.6.12. Update Slider Revolution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023WP Custom Cursors: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2221 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- WP Custom Cursors
- Fixed in
- 3.2
- What to do
- Update WP Custom Cursors to 3.2 or newer.
Jun 19, 2023SlideOnline: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0489 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SlideOnline WordPress plugin through 1.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- SlideOnline
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update SlideOnline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 19, 2023Responsive Tabs For WPBakery Page Builder (formerly Visual Composer): Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0368 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Responsive Tabs For WPBakery Page Builder (formerly Visual Composer) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 12, 2023Contact Form Email: Does not escape submitted values before displaying them in the HTMLCVE-2023-2718 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.
- Product
- Contact Form Email
- Fixed in
- 1.3.38
- What to do
- Update Contact Form Email to 1.3.38 or newer.
Jun 12, 2023Photo Gallery by Ays: Does not escape some parameters before outputting it back in attributesCVE-2023-2568 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by Ays WordPress plugin before 5.1.7 does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Photo Gallery by Ays
- Fixed in
- 5.1.7
- What to do
- Update Photo Gallery by Ays to 5.1.7 or newer.
Jun 12, 2023Icegram Engage: Does not escape a parameter before outputting it back in an attributeCVE-2023-2398 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Icegram Engage
- Fixed in
- 3.1.12
- What to do
- Update Icegram Engage to 3.1.12 or newer.
Jun 12, 2023Easy Forms for Mailchimp: Does not sanitise and escape some of its from parametersCVE-2023-1323 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape some of its from parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.9
- What to do
- Update Easy Forms for Mailchimp to 6.8.9 or newer.
Jun 12, 2023File Away: Does not validate and escape one of its shortcode attributesCVE-2023-0431 · WordPress plugins & themes · reported by WPScanMedium 5.4
The File Away WordPress plugin through 3.9.9.0.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- File Away
- Affected
- up to 3.9.9.0.1
- What to do
- Affects up to 3.9.9.0.1. Update File Away to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023Get your number: Does not sanitise and escape some of its settingsCVE-2023-2634 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Get your number WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Get your number
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Get your number to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023Survey Maker: Does not escape some parameters before outputting them back in attributesCVE-2023-2572 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Survey Maker WordPress plugin before 3.4.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Survey Maker
- Fixed in
- 3.4.7
- What to do
- Update Survey Maker to 3.4.7 or newer.
Jun 5, 2023Quiz Maker: Does not escape some parameters before outputting them back in attributesCVE-2023-2571 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz Maker WordPress plugin before 6.4.2.7 does not escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Quiz Maker
- Fixed in
- 6.4.2.7
- What to do
- Update Quiz Maker to 6.4.2.7 or newer.
Jun 5, 202310Web Social Post Feed: Does not sanitise and escape some parameter before outputting it back in a pageCVE-2023-2503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The 10Web Social Post Feed WordPress plugin before 1.2.9 does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- 10Web Social Post Feed
- Fixed in
- 1.2.9
- What to do
- Update 10Web Social Post Feed to 1.2.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.