Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,578 results · page 74 of 112
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape some of its settingsCVE-2023-2489 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Stop Spammers Security | Block Spam Users, Comments, Forms: Does not sanitise and escape various parameters before outputting them back in admin dashboard pagesCVE-2023-2488 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2023 does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Stop Spammers Security | Block Spam Users, Comments, Forms
- Fixed in
- 2023
- What to do
- Update Stop Spammers Security | Block Spam Users, Comments, Forms to 2023 or newer.
Jun 5, 2023Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not sanitise and escape a parameter before outputting it back in the admin dashboardCVE-2023-2472 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.61 does not sanitise and escape a parameter before outputting it back in the admin dashboard when the WPML plugin is also active and configured, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.61
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.61 or newer.
Jun 5, 2023ConvertKit: Does not escape a parameter before outputting it back in an attributeCVE-2023-2337 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- ConvertKit
- Fixed in
- 2.2.1
- What to do
- Update ConvertKit to 2.2.1 or newer.
Jun 5, 2023SEO by 10Web: Does not sanitise and escape some of its settingsCVE-2023-2224 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO by 10Web WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- SEO by 10Web
- Fixed in
- 1.2.7
- What to do
- Update SEO by 10Web to 1.2.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jun 5, 2023Pricing Table Builder: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0900 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Pricing Table Builder WordPress plugin through 1.1.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high-privilege users such as admins.
- Product
- Pricing Table Builder
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Pricing Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023Hostel: Does not sanitise and escape some of its settingsCVE-2023-0545 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Hostel WordPress plugin before 1.1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Hostel
- Fixed in
- 1.1.5.2
- What to do
- Update Hostel to 1.1.5.2 or newer.
Jun 5, 2023WP Multi Store Locator: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0152 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Multi Store Locator
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update WP Multi Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 5, 2023Frontend Post: Does not validate an attribute of one of its shortcodeCVE-2022-4946 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role as low as contributor to add a malicious shortcode to a page/post, which will redirect users to an arbitrary domain.
- Product
- Frontend Post
- Affected
- up to 2.8.4
- What to do
- Affects up to 2.8.4. Update Frontend Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Easy Forms for Mailchimp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-2518 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Easy Forms for Mailchimp
- Fixed in
- 6.8.9
- What to do
- Update Easy Forms for Mailchimp to 6.8.9 or newer.
May 30, 2023Add to Feedly: Does not sanitize and escape its settingsCVE-2023-2470 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Add to Feedly
- Affected
- up to 1.2.11
- What to do
- Affects up to 1.2.11. Update Add to Feedly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Loginizer: Does not escape a parameter before outputting it back in the pageCVE-2023-2296 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Loginizer
- Fixed in
- 1.7.9
- What to do
- Update Loginizer to 1.7.9 or newer.
May 30, 2023Otter: Does not sanitize some user-controlled file paths before performing file operations on themCVE-2023-2288 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
- Product
- Otter
- Fixed in
- 2.2.6
- What to do
- Update Otter to 2.2.6 or newer.
May 30, 2023Orbit Fox by ThemeIsle: Does not limit URLsCVE-2023-2287 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.
- Product
- Orbit Fox by ThemeIsle
- Fixed in
- 2.10.24
- What to do
- Update Orbit Fox by ThemeIsle to 2.10.24 or newer.
May 30, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some URL parametersCVE-2023-2256 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting.
- Product
- Product Addons & Fields for WooCommerce
- Fixed in
- 32.0.7
- What to do
- Update Product Addons & Fields for WooCommerce to 32.0.7 or newer.
May 30, 2023Login rebuilder: Does not sanitise and escape some of its settingsCVE-2023-2223 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login rebuilder
- Fixed in
- 2.8.1
- What to do
- Update Login rebuilder to 2.8.1 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2023Image Optimizer by 10web: Does not sanitize the dir parameterCVE-2023-2117 · WordPress plugins & themes · reported by WPScanLow 2.7
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.
- Product
- Image Optimizer by 10web
- Fixed in
- 1.0.27
- What to do
- Update Image Optimizer by 10web to 1.0.27 or newer.
May 30, 2023Autoptimize: Does not sanitise and escape the settings imported from a previous exportCVE-2023-2113 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
- Product
- Autoptimize
- Fixed in
- 3.1.7
- What to do
- Update Autoptimize to 3.1.7 or newer.
May 30, 2023Custom 404 Pro: Does not escape some URLs before outputting them in attributesCVE-2023-2023 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
- Product
- Custom 404 Pro
- Fixed in
- 3.7.3
- What to do
- Update Custom 404 Pro to 3.7.3 or newer.
May 30, 2023WP Fastest Cache: Does not have CSRF check in an AJAX actionCVE-2023-1938 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remote_get() function, leading to a Blind SSRF issue
- Product
- WP Fastest Cache
- Fixed in
- 1.1.5
- What to do
- Update WP Fastest Cache to 1.1.5 or newer.
May 30, 2023Download Manager: Does not adequately validate passwords for password-protected filesCVE-2023-1524 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any password-protected file on the server, allowing a user to download any file with the knowledge of any one file's password.
- Product
- Download Manager
- Fixed in
- 3.2.71
- What to do
- Update Download Manager to 3.2.71 or newer.
May 30, 2023Newsletter Popup: Does not have CSRF checks in some placesCVE-2023-0766 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Newsletter Popup: Does not sanitise and escape some of its settingsCVE-2023-0733 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2023Elementor Website Builder: Does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statementCVE-2023-0329 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.
- Product
- Elementor Website Builder
- Fixed in
- 3.12.2
- What to do
- Update Elementor Website Builder to 3.12.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2023OSM: Does not validate and escape some of its shortcode attributesCVE-2022-4676 · WordPress plugins & themes · reported by WPScanMedium 5.4
The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- OSM
- Affected
- up to 6.01
- What to do
- Affects up to 6.01. Update OSM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023KIWIZ Invoices Certification & PDF System: Does not validate the path of files to be downloadedCVE-2023-2180 · WordPress plugins & themes · reported by WPScanHigh 7.5
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization (assuming they can upload a file on the server)
- Product
- KIWIZ Invoices Certification & PDF System
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update KIWIZ Invoices Certification & PDF System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023WooCommerce Order Status Change Notifier: Does not have authorisation and CSRFCVE-2023-2179 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making them paid without actually paying for them for example
- Product
- WooCommerce Order Status Change Notifier
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WooCommerce Order Status Change Notifier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform SCVE-2023-2009 · WordPress plugins & themes · reported by WPScanMedium 4.8
Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pretty Url
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Pretty Url to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Thumbnail carousel slider: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-1915 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Thumbnail carousel slider WordPress plugin before 1.1.10 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting vulnerability which could be used against high privilege users such as admin.
- Product
- Thumbnail carousel slider
- Fixed in
- 1.1.10
- What to do
- Update Thumbnail carousel slider to 1.1.10 or newer.
May 15, 2023Tablesome: Does not escape various generated URLsCVE-2023-1890 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting
- Product
- Tablesome
- Fixed in
- 1.0.9
- What to do
- Update Tablesome to 1.0.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 15, 2023Product Addons & Fields for WooCommerce: Does not sanitize and escape some of its setting fieldsCVE-2023-1839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Product Addons & Fields for WooCommerce
- Fixed in
- 32.0.6
- What to do
- Update Product Addons & Fields for WooCommerce to 32.0.6 or newer.
May 15, 2023Ninja Forms Contact Form: Does not properly escape user input before outputting it back in an admin pageCVE-2023-1835 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.22
- What to do
- Update Ninja Forms Contact Form to 3.6.22 or newer.
May 15, 2023tagDiv Composer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-1596 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tagDiv Composer WordPress plugin before 4.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- tagDiv Composer
- Fixed in
- 4.0
- What to do
- Update tagDiv Composer to 4.0 or newer.
May 15, 2023Help Desk WP: Does not sanitise and escape some parametersCVE-2023-1019 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Help Desk WP WordPress plugin through 1.2.0 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.
- Product
- Help Desk WP
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Help Desk WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023BizLibrary: Does not sanitise and escape some of its settingsCVE-2023-0892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BizLibrary WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- BizLibrary
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update BizLibrary to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Active Directory Integration / LDAP Integration: Does not have proper authorization or nonce values for some POST requestsCVE-2023-0812 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.
- Product
- Active Directory Integration / LDAP Integration
- Fixed in
- 4.1.1
- What to do
- Update Active Directory Integration / LDAP Integration to 4.1.1 or newer.
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0763 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack
- Product
- Clock In Portal- Staff & Attendance Management
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0762 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack
- Product
- Clock In Portal- Staff & Attendance Management
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Clock In Portal- Staff & Attendance Management: Does not have CSRF checkCVE-2023-0761 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack
- Product
- Clock In Portal- Staff & Attendance Management
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Clock In Portal- Staff & Attendance Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023Push Notifications for WordPress by PushAssist: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-0644 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Push Notifications for WordPress by PushAssist
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Push Notifications for WordPress by PushAssist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023WP Visitor Statistics (Real Time Traffic): Does not escape user inputCVE-2023-0600 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.9 does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks.
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 6.9
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 6.9 or newer.
May 15, 2023RapidExpCart: Does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the pageCVE-2023-0520 · WordPress plugins & themes · reported by WPScanMedium 5.4
The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it and outputting it back in the page, leading to a Stored Cross-Site Scripting vulnerability which could be used against high-privilege users such as admin, furthermore lack of csrf protection means an attacker can trick a logged in admin to perform the attack by submitting a hidden form.
- Product
- RapidExpCart
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update RapidExpCart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023f(x) TOC: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0490 · WordPress plugins & themes · reported by WPScanMedium 5.4
The f(x) TOC WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- f(x) TOC
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update f(x) TOC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2023ActiveCampaign: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0233 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- ActiveCampaign
- Fixed in
- 8.1.12
- What to do
- Update ActiveCampaign to 8.1.12 or newer.
May 15, 2023Bit Form: Does not validate the file types uploaded via it's file upload form fieldCVE-2022-4774 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.
- Product
- Bit Form
- Fixed in
- 1.9
- What to do
- Update Bit Form to 1.9 or newer.
May 8, 2023NEX-Forms: Does not properly escape the `table` parameterCVE-2023-2114 · WordPress plugins & themes · reported by WPScanHigh 7.2
The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user input, before concatenating it to an SQL query.
- Product
- NEX-Forms
- Fixed in
- 8.4
- What to do
- Update NEX-Forms to 8.4 or newer.
May 8, 2023WP Popups: Does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embedCVE-2023-1905 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. This is due to an insufficient fix of CVE-2023-24003
- Product
- WP Popups
- Fixed in
- 2.1.5.1
- What to do
- Update WP Popups to 2.1.5.1 or newer.
May 8, 2023WP Inventory Manager: Does not sanitise and escape the message parameter before outputting it back in the pageCVE-2023-1806 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Inventory Manager WordPress plugin before 2.1.0.12 does not sanitise and escape the message parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
- Product
- WP Inventory Manager
- Fixed in
- 2.1.0.12
- What to do
- Update WP Inventory Manager to 2.1.0.12 or newer.
May 8, 2023AI ChatBot: Does not have authorisation and CSRF in a function hooked to initCVE-2023-1660 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard
- Product
- AI ChatBot
- Fixed in
- 4.4.9
- What to do
- Update AI ChatBot to 4.4.9 or newer.
May 8, 2023AI ChatBot: Does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settingsCVE-2023-1651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS
- Product
- AI ChatBot
- Fixed in
- 4.4.9
- What to do
- Update AI ChatBot to 4.4.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.