Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,578 results · page 80 of 112
Feb 13, 2023Widgets on Pages: Does not validate and escape its shortcode attributes before outputting them back in the pageCVE-2022-4488 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Widgets on Pages
- Fixed in
- 1.8.0
- What to do
- Update Widgets on Pages to 1.8.0 or newer.
Feb 13, 2023Widget Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4473 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Widget Shortcode
- Affected
- up to 0.3.5
- What to do
- Affects up to 0.3.5. Update Widget Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023YARPP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4471 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- YARPP
- Fixed in
- 5.30.3
- What to do
- Update YARPP to 5.30.3 or newer.
Feb 13, 2023amr shortcode any widget: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4458 · WordPress plugins & themes · reported by WPScanMedium 5.4
The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- amr shortcode any widget
- Affected
- up to 4.0
- What to do
- Affects up to 4.0. Update amr shortcode any widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023GiveWP: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4448 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- GiveWP
- Fixed in
- 2.24.0
- What to do
- Update GiveWP to 2.24.0 or newer.
Feb 13, 2023FL3R FeelBox: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4445 · WordPress plugins & themes · reported by WPScanCritical 9.8
The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- FL3R FeelBox
- Affected
- up to 8.1
- What to do
- Affects up to 8.1. Update FL3R FeelBox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2023WP FullCalendar: Does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the requestCVE-2022-3891 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones.
- Product
- WP FullCalendar
- Fixed in
- 1.5
- What to do
- Update WP FullCalendar to 1.5 or newer.
Feb 8, 2023Yellow Yard Searchbar: Does not escape some URL parameters before outputting them back to the userCVE-2022-2094 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross-Site Scripting
- Product
- Yellow Yard Searchbar
- Fixed in
- 2.8.2
- What to do
- Update Yellow Yard Searchbar to 2.8.2 or newer.
Feb 6, 2023YourChannel: Does not sanitize and escape some parametersCVE-2023-0282 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YourChannel WordPress plugin before 1.2.2 does not sanitize and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
- Product
- YourChannel
- Fixed in
- 1.2.2
- What to do
- Update YourChannel to 1.2.2 or newer.
Feb 6, 2023Contextual Related Posts: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0252 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Contextual Related Posts WordPress plugin before 3.3.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Contextual Related Posts
- Fixed in
- 3.3.1
- What to do
- Update Contextual Related Posts to 3.3.1 or newer.
Feb 6, 2023Tutor LMS: Does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributesCVE-2023-0236 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Tutor LMS
- Fixed in
- 2.0.10
- What to do
- Update Tutor LMS to 2.0.10 or newer.
Feb 6, 2023SiteGround Security: Does not properly sanitize user input before using it in an SQL queryCVE-2023-0234 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
- Product
- SiteGround Security
- Fixed in
- 1.3.1
- What to do
- Update SiteGround Security to 1.3.1 or newer.
Feb 6, 2023Annual Archive: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0178 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Annual Archive WordPress plugin before 1.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Annual Archive
- Fixed in
- 1.6.0
- What to do
- Update Annual Archive to 1.6.0 or newer.
Feb 6, 2023Giveaways and Contests by RafflePress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0176 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Giveaways and Contests by RafflePress WordPress plugin before 1.11.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.11.3
- What to do
- Update Giveaways and Contests by RafflePress to 1.11.3 or newer.
Feb 6, 2023WP VR: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0174 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP VR WordPress plugin before 8.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP VR
- Fixed in
- 8.2.7
- What to do
- Update WP VR to 8.2.7 or newer.
Feb 6, 2023Drag & Drop Sales Funnel Builder for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0173 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag & Drop Sales Funnel Builder for WordPress plugin before 2.6.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Drag & Drop Sales Funnel Builder for
- Fixed in
- 2.6.9
- What to do
- Update Drag & Drop Sales Funnel Builder for to 2.6.9 or newer.
Feb 6, 2023jQuery T(-) Countdown Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0171 · WordPress plugins & themes · reported by WPScanMedium 5.4
The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- jQuery T(-) Countdown Widget
- Fixed in
- 2.3.24
- What to do
- Update jQuery T(-) Countdown Widget to 2.3.24 or newer.
Feb 6, 2023Html5 Audio Player: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0170 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Audio Player WordPress plugin before 2.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Html5 Audio Player
- Fixed in
- 2.1.12
- What to do
- Update Html5 Audio Player to 2.1.12 or newer.
Feb 6, 2023GamiPress: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0154 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- GamiPress
- Fixed in
- 1.0.9
- What to do
- Update GamiPress to 1.0.9 or newer.
Feb 6, 2023Vimeo Video Autoplay Automute: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0153 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vimeo Video Autoplay Automute WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Vimeo Video Autoplay Automute
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Vimeo Video Autoplay Automute to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Cloak Front End Email: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cloak Front End Email WordPress plugin before 1.9.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Cloak Front End Email
- Fixed in
- 1.9.2
- What to do
- Update Cloak Front End Email to 1.9.2 or newer.
Feb 6, 2023WordPrezi: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0149 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPrezi WordPress plugin before 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WordPrezi
- Fixed in
- 0.9
- What to do
- Update WordPrezi to 0.9 or newer.
Feb 6, 2023Gallery Factory Lite: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gallery Factory Lite WordPress plugin through 2.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Gallery Factory Lite
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Gallery Factory Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Flexible Captcha: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0147 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Flexible Captcha WordPress plugin through 4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Flexible Captcha
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Flexible Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Naver Map: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0146 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Naver Map WordPress plugin through 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Naver Map
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Naver Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2023Event Manager and Tickets Selling Plugin for WooCommerce: Does not validate and escape some of its post meta before outputting them back in a page/postCVE-2023-0144 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Event Manager and Tickets Selling Plugin for WooCommerce WordPress plugin before 3.8.0 does not validate and escape some of its post meta before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Event Manager and Tickets Selling Plugin for WooCommerce
- Fixed in
- 3.8.0
- What to do
- Update Event Manager and Tickets Selling Plugin for WooCommerce to 3.8.0 or newer.
Feb 6, 2023Send PDF for Contact Form 7: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2023-0143 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Send PDF for Contact Form 7 WordPress plugin before 0.9.9.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Send PDF for Contact Form 7
- Fixed in
- 0.9.9.2
- What to do
- Update Send PDF for Contact Form 7 to 0.9.9.2 or newer.
Feb 6, 2023Happyforms: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0096 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Happyforms WordPress plugin before 1.22.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Happyforms
- Fixed in
- 1.22.0
- What to do
- Update Happyforms to 1.22.0 or newer.
Feb 6, 2023Page View Count: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0095 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page View Count WordPress plugin before 2.6.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Page View Count
- Fixed in
- 2.6.1
- What to do
- Update Page View Count to 2.6.1 or newer.
Feb 6, 2023ExactMetrics: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0082 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ExactMetrics WordPress plugin before 7.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ExactMetrics
- Fixed in
- 7.12.1
- What to do
- Update ExactMetrics to 7.12.1 or newer.
Feb 6, 2023MonsterInsights: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0081 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MonsterInsights WordPress plugin before 8.12.1 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- MonsterInsights
- Fixed in
- 8.12.1
- What to do
- Update MonsterInsights to 8.12.1 or newer.
Feb 6, 2023WC Vendors Marketplace: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0072 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WC Vendors Marketplace WordPress plugin before 2.4.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WC Vendors Marketplace
- Fixed in
- 2.4.5
- What to do
- Update WC Vendors Marketplace to 2.4.5 or newer.
Feb 6, 2023ResponsiveVoice Text To Speech: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0070 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- ResponsiveVoice Text To Speech
- Fixed in
- 1.7.7
- What to do
- Update ResponsiveVoice Text To Speech to 1.7.7 or newer.
Feb 6, 2023EAN for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0062 · WordPress plugins & themes · reported by WPScanMedium 5.4
The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- EAN for WooCommerce
- Fixed in
- 4.4.3
- What to do
- Update EAN for WooCommerce to 4.4.3 or newer.
Feb 6, 2023Clean Login: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4838 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Clean Login
- Fixed in
- 1.13.7
- What to do
- Update Clean Login to 1.13.7 or newer.
Feb 6, 2023Breadcrumb: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4836 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Breadcrumb
- Fixed in
- 1.5.33
- What to do
- Update Breadcrumb to 1.5.33 or newer.
Feb 6, 2023YourChannel: Everything you want in a YouTube: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4833 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- YourChannel: Everything you want in a YouTube
- Fixed in
- 1.2.3
- What to do
- Update YourChannel: Everything you want in a YouTube to 1.2.3 or newer.
Feb 6, 2023Simple Tooltips: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Simple Tooltips
- Fixed in
- 2.1.4
- What to do
- Update Simple Tooltips to 2.1.4 or newer.
Feb 6, 2023WP-ShowHide: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4825 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP-ShowHide WordPress plugin before 1.05 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP-ShowHide
- Fixed in
- 1.05
- What to do
- Update WP-ShowHide to 1.05 or newer.
Feb 6, 2023WP Blog and Widgets: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4824 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- WP Blog and Widgets
- Fixed in
- 2.3.1
- What to do
- Update WP Blog and Widgets to 2.3.1 or newer.
Feb 6, 2023Materialis Companion: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4762 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Materialis Companion
- Fixed in
- 1.3.40
- What to do
- Update Materialis Companion to 1.3.40 or newer.
Feb 6, 2023My YouTube Channel: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4756 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- My YouTube Channel
- Fixed in
- 3.23.0
- What to do
- Update My YouTube Channel to 3.23.0 or newer.
Feb 6, 2023Post Category Image With Grid and Slider: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4747 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Post Category Image With Grid and Slider
- Fixed in
- 1.4.8
- What to do
- Update Post Category Image With Grid and Slider to 1.4.8 or newer.
Feb 6, 2023Strong Testimonials: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4717 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Strong Testimonials
- Fixed in
- 3.0.3
- What to do
- Update Strong Testimonials to 3.0.3 or newer.
Feb 6, 2023Hide My WP: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4681 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Hide My WP
- Fixed in
- 6.2.9
- What to do
- Update Hide My WP to 6.2.9 or newer.
Feb 6, 2023Leaflet Maps Marker: Does not validate and escape one of its shortcode attributesCVE-2022-4677 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
- Product
- Leaflet Maps Marker
- Fixed in
- 3.12.7
- What to do
- Update Leaflet Maps Marker to 3.12.7 or newer.
Feb 6, 2023Ibtana: Does not validate and escape one of its shortcode attributesCVE-2022-4674 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
- Product
- Ibtana
- Fixed in
- 1.1.8.8
- What to do
- Update Ibtana to 1.1.8.8 or newer.
Feb 6, 2023PDF.js Viewer: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- PDF.js Viewer
- Fixed in
- 2.1.8
- What to do
- Update PDF.js Viewer to 2.1.8 or newer.
Feb 6, 2023Logo Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4664 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 3.6.0
- What to do
- Update Logo Slider to 3.6.0 or newer.
Feb 6, 2023Restaurant Menu: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4657 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Restaurant Menu
- Fixed in
- 2.3.6
- What to do
- Update Restaurant Menu to 2.3.6 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.