Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,578 results · page 77 of 112
Mar 27, 2023QuickSwish: Does not have CSRF checkCVE-2023-0499 · WordPress plugins & themes · reported by WPScanMedium 4.3
The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- QuickSwish
- Fixed in
- 1.1.0
- What to do
- Update QuickSwish to 1.1.0 or newer.
Mar 27, 2023WP Education: Does not have CSRF checkCVE-2023-0498 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- WP Education
- Fixed in
- 1.2.7
- What to do
- Update WP Education to 1.2.7 or newer.
Mar 27, 2023HT Portfolio: Does not have CSRF checkCVE-2023-0497 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Portfolio
- Fixed in
- 1.1.6
- What to do
- Update HT Portfolio to 1.1.6 or newer.
Mar 27, 2023HT Event: Does not have CSRF checkCVE-2023-0496 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Event
- Fixed in
- 1.4.6
- What to do
- Update HT Event to 1.4.6 or newer.
Mar 27, 2023HT Slider For Elementor: Does not have CSRF checkCVE-2023-0495 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- HT Slider For Elementor
- Fixed in
- 1.4.0
- What to do
- Update HT Slider For Elementor to 1.4.0 or newer.
Mar 27, 2023Schedulicity: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0491 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Schedulicity WordPress plugin through 2.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Schedulicity
- Affected
- up to 2.21
- What to do
- Affects up to 2.21. Update Schedulicity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks: Does not have CSRF checkCVE-2023-0484 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
- Product
- Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks
- Fixed in
- 1.1.6
- What to do
- Update Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks to 1.1.6 or newer.
Mar 27, 2023WP Dark Mode: Does not properly sanitize the style parameter in shortcodes before using it to load a PHP templateCVE-2023-0467 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP template. This leads to Local File Inclusion on servers where non-existent directories may be traversed, or when chained with another vulnerability allowing arbitrary directory creation.
- Product
- WP Dark Mode
- Fixed in
- 4.0.8
- What to do
- Update WP Dark Mode to 4.0.8 or newer.
Mar 27, 2023menu shortcode: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0395 · WordPress plugins & themes · reported by WPScanMedium 5.4
The menu shortcode WordPress plugin through 1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- menu shortcode
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update menu shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2023NEX-Forms: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0272 · WordPress plugins & themes · reported by WPScanMedium 5.4
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- NEX-Forms
- Fixed in
- 8.3.3
- What to do
- Update NEX-Forms to 8.3.3 or newer.
Mar 20, 2023ProfileGrid: Provides an AJAX endpoint for resetting a user password but does not implement proper authorizationCVE-2023-0940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
- Product
- ProfileGrid
- Fixed in
- 5.3.1
- What to do
- Update ProfileGrid to 5.3.1 or newer.
Mar 20, 2023VK All in One Expansion Unit: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2023-0937 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- VK All in One Expansion Unit
- Fixed in
- 9.87.1.0
- What to do
- Update VK All in One Expansion Unit to 9.87.1.0 or newer.
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not validate the user meta to be retrieved via the user shortcodeCVE-2023-0911 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the user shortcode, allowing any authenticated users such as subscriber to retrieve arbitrary user meta (except the user_pass), such as the user email and activation key by default.
- Product
- WordPress Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 5.12.8
- What to do
- Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Mar 20, 2023WordPress Shortcodes Plugin — Shortcodes Ultimate: Does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the requestCVE-2023-0890 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some shortcodes are already public and can be accessed by the user making the request, allowing any authenticated users such as subscriber to view draft, private or even password protected posts. It is also possible to leak the password of protected posts
- Product
- WordPress Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 5.12.8
- What to do
- Update WordPress Shortcodes Plugin — Shortcodes Ultimate to 5.12.8 or newer.
Mar 20, 2023WP Meta SEO: Does not authorize several ajax actionsCVE-2023-0876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Meta SEO WordPress plugin before 4.5.3 does not authorize several ajax actions, allowing low-privilege users to make updates to certain data and leading to an arbitrary redirect vulnerability.
- Product
- WP Meta SEO
- Fixed in
- 4.5.3
- What to do
- Update WP Meta SEO to 4.5.3 or newer.
Mar 20, 2023WP Meta SEO: Does not properly sanitize and escape inputs into SQL queriesCVE-2023-0875 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.
- Product
- WP Meta SEO
- Fixed in
- 4.5.3
- What to do
- Update WP Meta SEO to 4.5.3 or newer.
Mar 20, 2023WooCommerce Multiple Customer Addresses & Shipping: Does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the requestCVE-2023-0865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allowing any authenticated users, such as subscriber to add/update/duplicate/delete as well as retrieve addresses of other users.
- Product
- WooCommerce Multiple Customer Addresses & Shipping
- Fixed in
- 21.7
- What to do
- Update WooCommerce Multiple Customer Addresses & Shipping to 21.7 or newer.
Mar 20, 2023Paid Memberships Pro: Does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL queryCVE-2023-0631 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query.
- Product
- Paid Memberships Pro
- Fixed in
- 2.9.12
- What to do
- Update Paid Memberships Pro to 2.9.12 or newer.
Mar 20, 2023Slimstat Analytics: Does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL queryCVE-2023-0630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.
- Product
- Slimstat Analytics
- Fixed in
- 4.9.3.3
- What to do
- Update Slimstat Analytics to 4.9.3.3 or newer.
Mar 20, 2023WPB Advanced FAQ: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0370 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPB Advanced FAQ WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WPB Advanced FAQ
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update WPB Advanced FAQ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023GoToWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0369 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GoToWP WordPress plugin through 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GoToWP
- Affected
- up to 5.1.1
- What to do
- Affects up to 5.1.1. Update GoToWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023React Webcam: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0365 · WordPress plugins & themes · reported by WPScanMedium 5.4
The React Webcam WordPress plugin through 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- React Webcam
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update React Webcam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023real.Kit: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- real.Kit
- Fixed in
- 5.1.1
- What to do
- Update real.Kit to 5.1.1 or newer.
Mar 20, 2023Custom Content Shortcode: Does not validate one of its shortcode attributeCVE-2023-0340 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
- Product
- Custom Content Shortcode
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023Custom Content Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0273 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Custom Content Shortcode
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Custom Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023Responsive Clients Logo Gallery Plugin for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0175 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive Clients Logo Gallery Plugin for
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Responsive Clients Logo Gallery Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023GetResponse for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0167 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GetResponse for WordPress plugin through 5.5.31 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GetResponse for
- Affected
- up to 5.5.31
- What to do
- Affects up to 5.5.31. Update GetResponse for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023Saan World Clock: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0145 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Saan World Clock WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Saan World Clock
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Saan World Clock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2023WP OAuth Server (OAuth Authentication): Does not have CSRF checkCVE-2022-3894 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.2.5
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.2.5 or newer.
Mar 13, 2023Namaste! LMS: Does not sanitize and escape some of its settingsCVE-2023-0844 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Namaste! LMS WordPress plugin before 2.6 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Namaste! LMS
- Fixed in
- 2.6
- What to do
- Update Namaste! LMS to 2.6 or newer.
Mar 13, 2023Popup Builder by OptinMonster: Does not ensure that the campaign to be loaded via some shortcodes is actually a campaignCVE-2023-0772 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Popup Builder by OptinMonster WordPress plugin before 2.12.2 does not ensure that the campaign to be loaded via some shortcodes is actually a campaign, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, like draft, private or even password protected ones.
- Product
- Popup Builder by OptinMonster
- Fixed in
- 2.12.2
- What to do
- Update Popup Builder by OptinMonster to 2.12.2 or newer.
Mar 13, 2023Ocean Extra: Does not ensure that the template to be loaded via a shortcode is actually a templateCVE-2023-0749 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.
- Product
- Ocean Extra
- Fixed in
- 2.1.3
- What to do
- Update Ocean Extra to 2.1.3 or newer.
Mar 13, 2023Campaign URL Builder: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0538 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Campaign URL Builder WordPress plugin before 1.8.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Campaign URL Builder
- Fixed in
- 1.8.2
- What to do
- Update Campaign URL Builder to 1.8.2 or newer.
Mar 13, 2023FluentSMTP: Does not sanitize or escape email contentCVE-2023-0219 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FluentSMTP WordPress plugin before 2.2.3 does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks (XSS) when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML.
- Product
- FluentSMTP
- Fixed in
- 2.2.3
- What to do
- Update FluentSMTP to 2.2.3 or newer.
Mar 13, 2023Juicer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0172 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Juicer WordPress plugin before 1.11 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Juicer
- Fixed in
- 1.11
- What to do
- Update Juicer to 1.11 or newer.
Mar 13, 2023Client Logo Carousel: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0073 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Client Logo Carousel WordPress plugin through 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Client Logo Carousel
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update Client Logo Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2023Companion Sitemap Generator: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0066 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Companion Sitemap Generator WordPress plugin through 4.5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Companion Sitemap Generator
- Affected
- up to 4.5.1.1
- What to do
- Affects up to 4.5.1.1. Update Companion Sitemap Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 202310Web Map Builder for Google Maps: Does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated usersCVE-2023-0037 · WordPress plugins & themes · reported by WPScanCritical 9.8
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- 10Web Map Builder for Google Maps
- Fixed in
- 1.0.73
- What to do
- Update 10Web Map Builder for Google Maps to 1.0.73 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Mar 13, 2023Widgets for WooCommerce Products on Elementor: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4661 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Widgets for WooCommerce Products on Elementor
- Fixed in
- 1.0.8
- What to do
- Update Widgets for WooCommerce Products on Elementor to 1.0.8 or newer.
Mar 13, 2023Video Background: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4652 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Background WordPress plugin before 2.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video Background
- Fixed in
- 2.7.5
- What to do
- Update Video Background to 2.7.5 or newer.
Mar 13, 2023WordPress Infinite Scroll: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4466 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WordPress Infinite Scroll
- Fixed in
- 5.6.0.3
- What to do
- Update WordPress Infinite Scroll to 5.6.0.3 or newer.
Mar 6, 2023Scriptless Social Sharing: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0377 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scriptless Social Sharing WordPress plugin before 3.2.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Scriptless Social Sharing
- Fixed in
- 3.2.2
- What to do
- Update Scriptless Social Sharing to 3.2.2 or newer.
Mar 6, 2023WPCode: Does not have adequate privilege checks in place for several AJAX actionsCVE-2023-0328 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).
- Product
- WPCode
- Fixed in
- 2.0.7
- What to do
- Update WPCode to 2.0.7 or newer.
Mar 6, 2023Advanced Recent Posts: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0212 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Advanced Recent Posts WordPress plugin through 0.6.14 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Advanced Recent Posts
- Affected
- up to 0.6.14
- What to do
- Affects up to 0.6.14. Update Advanced Recent Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2023Cost Calculator: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0165 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Cost Calculator
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Cost Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2023Resume Builder: Does not sanitize and escape some parameters related to ResumeCVE-2023-0078 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Resume Builder WordPress plugin through 3.1.1 does not sanitize and escape some parameters related to Resume, which could allow users with a role as low as subscriber to perform Stored XSS attacks against higher privilege users
- Product
- Resume Builder
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Resume Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2023Download Attachments: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0076 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Attachments WordPress plugin before 1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Download Attachments
- Fixed in
- 1.3
- What to do
- Update Download Attachments to 1.3 or newer.
Mar 6, 2023WPaudio MP3 Player: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0069 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPaudio MP3 Player WordPress plugin through 4.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WPaudio MP3 Player
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update WPaudio MP3 Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2023Product GTIN (EAN, UPC, ISBN) for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0068 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product GTIN (EAN, UPC, ISBN) for WooCommerce WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Product GTIN (EAN, UPC, ISBN) for WooCommerce
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Product GTIN (EAN, UPC, ISBN) for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2023i2 Pros & Cons: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0065 · WordPress plugins & themes · reported by WPScanMedium 5.4
The i2 Pros & Cons WordPress plugin through 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- i2 Pros & Cons
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update i2 Pros & Cons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.