Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,578 results · page 78 of 112
Mar 6, 2023eVision Responsive Column Layout Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0064 · WordPress plugins & themes · reported by WPScanMedium 5.4
The eVision Responsive Column Layout Shortcodes WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- eVision Responsive Column Layout Shortcodes
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update eVision Responsive Column Layout Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2023WordPress Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0063 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Shortcodes WordPress plugin through 1.6.36 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WordPress Shortcodes
- Affected
- up to 1.6.36
- What to do
- Affects up to 1.6.36. Update WordPress Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 6, 2023WooCommerce Checkout Field Manager: Does not validate files to be uploadedCVE-2022-4328 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Checkout Field Manager WordPress plugin before 18.0 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
- Product
- WooCommerce Checkout Field Manager
- Fixed in
- 18.0
- What to do
- Update WooCommerce Checkout Field Manager to 18.0 or newer.
Mar 6, 2023Replyable: Does not validate the class name submitted by the requestCVE-2022-4265 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Replyable WordPress plugin before 2.2.10 does not validate the class name submitted by the request when instantiating an object in the prompt_dismiss_notice action and also lacks CSRF check in the related action. This could allow any authenticated users, such as subscriber to perform Object Injection attacks. The attack could also be done via a CSRF vector against any authenticated user
- Product
- Replyable
- Fixed in
- 2.2.10
- What to do
- Update Replyable to 2.2.10 or newer.
Feb 27, 2023Registration Forms: Does not properly validate the redirection URLCVE-2023-0552 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability
- Product
- Registration Forms
- Fixed in
- 3.8.2.3
- What to do
- Update Registration Forms to 3.8.2.3 or newer.
Feb 27, 2023Namaste! LMS: Does not sanitize and escape some of its settingsCVE-2023-0548 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Namaste! LMS
- Fixed in
- 2.5.9.4
- What to do
- Update Namaste! LMS to 2.5.9.4 or newer.
Feb 27, 2023Arigato Autoresponder and Newsletter: Does not sanitize and escape some of its settingsCVE-2023-0543 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Arigato Autoresponder and Newsletter WordPress plugin before 2.1.7.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Arigato Autoresponder and Newsletter
- Fixed in
- 2.1.7.2
- What to do
- Update Arigato Autoresponder and Newsletter to 2.1.7.2 or newer.
Feb 27, 2023GS Insever Portfolio: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0539 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Insever Portfolio WordPress plugin before 1.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GS Insever Portfolio
- Fixed in
- 1.4.5
- What to do
- Update GS Insever Portfolio to 1.4.5 or newer.
Feb 27, 2023Donation Block For PayPal: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0535 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donation Block For PayPal WordPress plugin before 2.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Donation Block For PayPal
- Fixed in
- 2.1.0
- What to do
- Update Donation Block For PayPal to 2.1.0 or newer.
Feb 27, 2023My Sticky Elements: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0487 · WordPress plugins & themes · reported by WPScanHigh 7.2
The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- My Sticky Elements
- Fixed in
- 2.0.9
- What to do
- Update My Sticky Elements to 2.0.9 or newer.
Feb 27, 2023GigPress: Does not validate and escape some of its shortcode attributes before using them in SQL statement/sCVE-2023-0381 · WordPress plugins & themes · reported by WPScanHigh 8.8
The GigPress WordPress plugin through 2.3.28 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks
- Product
- GigPress
- Affected
- up to 2.3.28
- What to do
- Affects up to 2.3.28. Update GigPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023ShortPixel Adaptive Images: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0334 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin
- Product
- ShortPixel Adaptive Images
- Fixed in
- 3.6.3
- What to do
- Update ShortPixel Adaptive Images to 3.6.3 or newer.
Feb 27, 2023Correos Oficial: Does not have an authorization check user input validationCVE-2023-0331 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path, allowing unauthenticated attackers to download arbitrary files from the server.
- Product
- Correos Oficial
- Affected
- up to 1.2.0.2
- What to do
- Affects up to 1.2.0.2. Update Correos Oficial to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Media Library Assistant: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0279 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- Media Library Assistant
- Fixed in
- 3.06
- What to do
- Update Media Library Assistant to 3.06 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Feb 27, 2023GeoDirectory: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0278 · WordPress plugins & themes · reported by WPScanHigh 7.2
The GeoDirectory WordPress plugin before 2.2.24 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- GeoDirectory
- Fixed in
- 2.2.24
- What to do
- Update GeoDirectory to 2.2.24 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Feb 27, 2023VK All in One Expansion Unit: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0230 · WordPress plugins & themes · reported by WPScanMedium 5.4
The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- VK All in One Expansion Unit
- Fixed in
- 9.86.0.0
- What to do
- Update VK All in One Expansion Unit to 9.86.0.0 or newer.
Feb 27, 2023Olevmedia Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0168 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Olevmedia Shortcodes WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Olevmedia Shortcodes
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update Olevmedia Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Custom Add User: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0043 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom Add User WordPress plugin through 2.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Custom Add User
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Custom Add User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Show-Hide / Collapse-Expand: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4829 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Show-Hide / Collapse-Expand
- Fixed in
- 1.3.0
- What to do
- Update Show-Hide / Collapse-Expand to 1.3.0 or newer.
Feb 27, 2023Galleries by Angie Makes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4795 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Galleries by Angie Makes WordPress plugin through 1.67 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Galleries by Angie Makes
- Affected
- up to 1.67
- What to do
- Affects up to 1.67. Update Galleries by Angie Makes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023Embed PDF: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4788 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Embed PDF
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Embed PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 27, 2023List Pages Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- List Pages Shortcode
- Fixed in
- 1.7.6
- What to do
- Update List Pages Shortcode to 1.7.6 or newer.
Feb 27, 2023Wufoo Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4679 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wufoo Shortcode WordPress plugin before 1.52 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Wufoo Shortcode
- Fixed in
- 1.52
- What to do
- Update Wufoo Shortcode to 1.52 or newer.
Feb 21, 2023GS Portfolio for Envato: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0559 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Portfolio for Envato WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GS Portfolio for Envato
- Fixed in
- 1.4.0
- What to do
- Update GS Portfolio for Envato to 1.4.0 or newer.
Feb 21, 2023GS Books Showcase: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0541 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Books Showcase WordPress plugin before 1.3.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GS Books Showcase
- Fixed in
- 1.3.1
- What to do
- Update GS Books Showcase to 1.3.1 or newer.
Feb 21, 2023GS Filterable Portfolio: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0540 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Filterable Portfolio WordPress plugin before 1.6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GS Filterable Portfolio
- Fixed in
- 1.6.1
- What to do
- Update GS Filterable Portfolio to 1.6.1 or newer.
Feb 21, 2023GS Products Slider for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0492 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GS Products Slider for WooCommerce WordPress plugin before 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GS Products Slider for WooCommerce
- Fixed in
- 1.5.9
- What to do
- Update GS Products Slider for WooCommerce to 1.5.9 or newer.
Feb 21, 2023The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed CVE-2023-0453 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Private Message WordPress plugin (bundled with the Superio theme as a required plugin) before 1.0.6 does not ensure that private messages to be accessed belong to the user making the requests. This allowing any authenticated users to access private messages belonging to other users by tampering the ID.
- Fixed in
- 1.0.6
- What to do
- Update the plugin to 1.0.6 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Feb 21, 2023Loan Comparison: Does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcodeCVE-2023-0442 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a page/post via an embedded shortcode, which could allow an attacker to inject javascript into into the site via a crafted URL.
- Product
- Loan Comparison
- Fixed in
- 1.5.3
- What to do
- Update Loan Comparison to 1.5.3 or newer.
Feb 21, 2023Watu Quiz: Does not sanitise and escape some of its settingsCVE-2023-0429 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Watu Quiz
- Fixed in
- 3.3.8.2
- What to do
- Update Watu Quiz to 3.3.8.2 or newer.
Feb 21, 2023Watu Quiz: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Watu Quiz WordPress plugin before 3.3.8.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Watu Quiz
- Fixed in
- 3.3.8.2
- What to do
- Update Watu Quiz to 3.3.8.2 or newer.
Feb 21, 2023Shortcode for Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0419 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Shortcode for Font Awesome WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Shortcode for Font Awesome
- Fixed in
- 1.4.1
- What to do
- Update Shortcode for Font Awesome to 1.4.1 or newer.
Feb 21, 2023Easy Digital Downloads: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0380 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Digital Downloads WordPress plugin before 3.1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Digital Downloads
- Fixed in
- 3.1.0.5
- What to do
- Update Easy Digital Downloads to 3.1.0.5 or newer.
Feb 21, 2023Greenshift: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0378 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Greenshift
- Fixed in
- 5.0
- What to do
- Update Greenshift to 5.0 or newer.
Feb 21, 2023Easy Affiliate Links: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embeddedCVE-2023-0375 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Affiliate Links WordPress plugin before 3.7.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Easy Affiliate Links
- Fixed in
- 3.7.1
- What to do
- Update Easy Affiliate Links to 3.7.1 or newer.
Feb 21, 2023EmbedStories: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0372 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EmbedStories WordPress plugin before 0.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- EmbedStories
- Fixed in
- 0.7.5
- What to do
- Update EmbedStories to 0.7.5 or newer.
Feb 21, 2023EmbedSocial: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0371 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EmbedSocial WordPress plugin before 1.1.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- EmbedSocial
- Fixed in
- 1.1.28
- What to do
- Update EmbedSocial to 1.1.28 or newer.
Feb 21, 2023Loan Comparison: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0366 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Loan Comparison
- Fixed in
- 1.5.3
- What to do
- Update Loan Comparison to 1.5.3 or newer.
Feb 21, 2023Real Media Library: Does not sanitise and escape the created folder namesCVE-2023-0285 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
- Product
- Real Media Library
- Fixed in
- 4.18.29
- What to do
- Update Real Media Library to 4.18.29 or newer.
Feb 21, 2023WP Font Awesome: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embeddedCVE-2023-0271 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Font Awesome WordPress plugin before 1.7.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP Font Awesome
- Fixed in
- 1.7.9
- What to do
- Update WP Font Awesome to 1.7.9 or newer.
Feb 21, 2023ShopLentor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0231 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ShopLentor
- Fixed in
- 2.5.4
- What to do
- Update ShopLentor to 2.5.4 or newer.
Feb 21, 2023Timed Content: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timed Content WordPress plugin before 2.73 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Timed Content
- Fixed in
- 2.73
- What to do
- Update Timed Content to 2.73 or newer.
Feb 21, 2023Youzify: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0059 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Youzify
- Fixed in
- 1.2.2
- What to do
- Update Youzify to 1.2.2 or newer.
Feb 21, 2023BackupBuddy: Does not sanitise and escape some parameters before outputting them back in various placesCVE-2022-4897 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting
- Product
- BackupBuddy
- Fixed in
- 8.8.3
- What to do
- Update BackupBuddy to 8.8.3 or newer.
Feb 21, 2023Product Slider and Carousel with Category for WooCommerce: Does not validate and escape one of its shortcode attributesCVE-2022-4791 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Product Slider and Carousel with Category for WooCommerce
- Fixed in
- 2.8
- What to do
- Update Product Slider and Carousel with Category for WooCommerce to 2.8 or newer.
Feb 21, 2023Video.js: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4786 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video.js
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update Video.js to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Video Sidebar Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4785 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Video Sidebar Widgets
- Affected
- up to 6.1
- What to do
- Affects up to 6.1. Update Video Sidebar Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Hueman Addons: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4784 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Hueman Addons
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update Hueman Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Bootstrap Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4777 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Bootstrap Shortcodes
- Affected
- up to 3.4.0
- What to do
- Affects up to 3.4.0. Update Bootstrap Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2023Simple File Downloader: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4764 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Simple File Downloader
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Simple File Downloader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.