Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,288 results · page 82 of 86
Nov 28, 2022The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks inCVE-2022-4169 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.
- Affected
- up to 3.2.16
- What to do
- Affects up to 3.2.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3849 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3848 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022OWM Weather: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3769 · WordPress plugins & themes · reported by WPScanHigh 8.8
The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as contributor
- Product
- OWM Weather
- Fixed in
- 5.6.9
- What to do
- Update OWM Weather to 5.6.9 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WPSmartContracts: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3768 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
- Product
- WPSmartContracts
- Fixed in
- 1.3.12
- What to do
- Update WPSmartContracts to 1.3.12 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022HTML Forms: Does not properly properly escape a parameter before using it in a SQL statementCVE-2022-3689 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
- Product
- HTML Forms
- Fixed in
- 1.3.25
- What to do
- Update HTML Forms to 1.3.25 or newer.
Nov 21, 2022The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.CVE-2022-3750 · WordPress plugins & themes · reported by WPScanMedium 4.7
The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.
- Fixed in
- 6.8.7
- What to do
- Update the plugin to 6.8.7 or newer.
Nov 21, 2022Event Monster: Does not validate and escape some parameters before using them in SQL statementsCVE-2022-3720 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users
- Product
- Event Monster
- Fixed in
- 1.2.0
- What to do
- Update Event Monster to 1.2.0 or newer.
Nov 21, 2022My wpdb: Is missing CSRF checkCVE-2022-1578 · WordPress plugins & themes · reported by WPScanHigh 8.8
The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack
- Product
- My wpdb
- Fixed in
- 2.5
- What to do
- Update My wpdb to 2.5 or newer.
Nov 18, 2022Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.CVE-2022-43482 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.
- Affected
- up to 1.3.69
- What to do
- Affects up to 1.3.69. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 18, 2022Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.CVE-2022-41692 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.
- Affected
- up to 1.3.71
- What to do
- Affects up to 1.3.71. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 8, 2022Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.CVE-2022-40223 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change.
- Affected
- up to 4.2.5
- What to do
- Affects up to 4.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comsearchwp.com
Nov 7, 2022WooCommerce Dropshipping: Does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated usersCVE-2022-3481 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
- Product
- WooCommerce Dropshipping
- Fixed in
- 4.4
- What to do
- Update WooCommerce Dropshipping to 4.4 or newer.
Nov 3, 2022David Cole Simple SEO: Missing Authorization, Cross-Site Request Forgery (CSRF)CVE-2022-36404 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions.
- Product
- David Cole Simple SEO
- Affected
- up to 1.8.12
- What to do
- Affects up to 1.8.12. Update David Cole Simple SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 31, 2022WordPress Classifieds: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users andCVE-2022-3254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection
- Product
- WordPress Classifieds
- Fixed in
- 4.3
- What to do
- Update WordPress Classifieds to 4.3 or newer.
Oct 25, 2022Spam protection, AntiSpam, FireWall by CleanTalk: Does not validate ids before using them in a SQL statementCVE-2022-3302 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statement, which could lead to SQL injection exploitable by high privilege users such as admin
- Product
- Spam protection, AntiSpam, FireWall by CleanTalk
- Fixed in
- 5.185.1
- What to do
- Update Spam protection, AntiSpam, FireWall by CleanTalk to 5.185.1 or newer.
Oct 25, 2022Form Maker by 10Web: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3300 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.6
- What to do
- Update Form Maker by 10Web to 1.15.6 or newer.
Oct 25, 2022Blog2Social: Social Media Auto Post & Scheduler: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3246 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers
- Product
- Blog2Social: Social Media Auto Post & Scheduler
- Fixed in
- 6.9.10
- What to do
- Update Blog2Social: Social Media Auto Post & Scheduler to 6.9.10 or newer.
Oct 17, 2022Import all XML, CSV & TXT: Does not properly sanitise and escape imported data before using them back SQL statementsCVE-2022-3243 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
- Product
- Import all XML, CSV & TXT
- Fixed in
- 6.5.8
- What to do
- Update Import all XML, CSV & TXT to 6.5.8 or newer.
Oct 17, 2022Passster: Stores the password inside a cookie named "passster" using base64 encoding methodCVE-2022-3206 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked.
- Product
- Passster
- Fixed in
- 3.5.5.5.2
- What to do
- Update Passster to 3.5.5.5.2 or newer.
Oct 17, 2022WP Custom Cursors: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3150 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users such as admin
- Product
- WP Custom Cursors
- Fixed in
- 3.2
- What to do
- Update WP Custom Cursors to 3.2 or newer.
Oct 17, 2022Search Logger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3131 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Search Logger WordPress plugin through 0.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
- Product
- Search Logger
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update Search Logger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022OAuth client Single Sign On: Does not have authorisation and CSRFCVE-2022-3119 · WordPress plugins & themes · reported by WPScanHigh 7.5
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address
- Product
- OAuth client Single Sign On
- Fixed in
- 3.0.4
- What to do
- Update OAuth client Single Sign On to 3.0.4 or newer.
Sep 19, 2022NEX-Forms: Does not properly sanitise and escape user input before using it in SQL statementsCVE-2022-3142 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Product
- NEX-Forms
- Fixed in
- 7.9.7
- What to do
- Update NEX-Forms to 7.9.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.commedium.com
Sep 19, 2022BadgeOS: Does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated usersCVE-2022-2958 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections
- Product
- BadgeOS
- Fixed in
- 3.7.1.3
- What to do
- Update BadgeOS to 3.7.1.3 or newer.
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.5
- What to do
- Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 19, 2022Ketchup Restaurant Reservations: Does not validate and escape some reservation parameters before using them in SQL statementsCVE-2022-2754 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements, which could allow unauthenticated attackers to perform SQL Injection attacks
- Product
- Ketchup Restaurant Reservations
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ketchup Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022Site Offline Or Coming Soon Or Maintenance Mode: Prevents users from accessing a website but does not do so if the URL contained certain keywordsCVE-2022-1580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
- Product
- Site Offline Or Coming Soon Or Maintenance Mode
- Fixed in
- 1.5.3
- What to do
- Update Site Offline Or Coming Soon Or Maintenance Mode to 1.5.3 or newer.
Sep 16, 2022Migration, Backup, Staging: Does not sanitise and validate a parameter before using it to read the content of a fileCVE-2022-2863 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.76
- What to do
- Update Migration, Backup, Staging to 0.9.76 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 6, 2022Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress.CVE-2022-37344 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Missing Access Control vulnerability in PHP Crafts Accommodation System plugin <= 1.0.1 at WordPress.
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 6, 2022About Rentals: Missing Access ControlCVE-2022-36427 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin <= 1.5 at WordPress.
- Product
- About Rentals
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update About Rentals to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Sep 5, 2022Simple Single Sign On: Leaks its OAuth client_secretCVE-2022-2083 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the site.
- Product
- Simple Single Sign On
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Simple Single Sign On to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2022Simply Schedule Appointments: Is missing authorisation in a REST endpointCVE-2022-2373 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address
- Product
- Simply Schedule Appointments
- Fixed in
- 1.5.7.7
- What to do
- Update Simply Schedule Appointments to 1.5.7.7 or newer.
Aug 29, 2022WPIDE: Does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboardCVE-2022-2261 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue.
- Product
- WPIDE
- Fixed in
- 3.0
- What to do
- Update WPIDE to 3.0 or newer.
Aug 22, 2022Duplicator: Discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the pluginCVE-2022-2551 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
- Product
- Duplicator
- Fixed in
- 1.4.7
- What to do
- Update Duplicator to 1.4.7 or newer.
Aug 22, 2022Transposh WordPress Translation: Does not sanitise and escape the order and orderby parameters before using them in a SQL statementCVE-2022-25811 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection
- Product
- Transposh WordPress Translation
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Transposh WordPress Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
- Product
- Website File Changes Monitor
- Fixed in
- 1.8.3
- What to do
- Update Website File Changes Monitor to 1.8.3 or newer.
Aug 8, 2022Discy: Lacks authorization checks then processing ajax requests to the discy_update_options actionCVE-2022-1323 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request.
- Product
- Discy
- Fixed in
- 5.0
- What to do
- Update Discy to 5.0 or newer.
Aug 1, 2022Microsoft Advertising Universal Event Tracking (UET): Does not sanitise and escape its settingsCVE-2022-2170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
- Product
- Microsoft Advertising Universal Event Tracking (UET)
- Fixed in
- 1.0.4
- What to do
- Update Microsoft Advertising Universal Event Tracking (UET) to 1.0.4 or newer.
Aug 1, 2022Youzify: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1950 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- Youzify
- Fixed in
- 1.2.0
- What to do
- Update Youzify to 1.2.0 or newer.
Jul 18, 2022The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, anCVE-2022-1565 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 17, 2022OAuth Single Sign On: Doesn't validate that OAuth access token requests are legitimateCVE-2022-2133 · WordPress plugins & themes · reported by WPScanMedium 5.3
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.
- Product
- OAuth Single Sign On
- Fixed in
- 6.22.6
- What to do
- Update OAuth Single Sign On to 6.22.6 or newer.
Jul 11, 2022Pricing Deals for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1057 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- Pricing Deals for WooCommerce
- Affected
- up to 2.0.2.02
- What to do
- Affects up to 2.0.2.02. Update Pricing Deals for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022ARMember: Is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated usersCVE-2022-1903 · WordPress plugins & themes · reported by WPScanHigh 8.1
The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX action available to unauthenticated users, allowing them to change the password of arbitrary users by knowing their username
- Product
- ARMember
- Fixed in
- 3.4.8
- What to do
- Update ARMember to 3.4.8 or newer.
Jun 27, 2022Login using WordPress Users ( WP as SAML IDP ): Does not sanitise and escape some of its settingsCVE-2022-1010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Login using WordPress Users ( WP as SAML IDP )
- Fixed in
- 1.13.4
- What to do
- Update Login using WordPress Users ( WP as SAML IDP ) to 1.13.4 or newer.
Jun 20, 2022Events Made Easy: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1905 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Events Made Easy
- Fixed in
- 2.2.81
- What to do
- Update Events Made Easy to 2.2.81 or newer.
Jun 20, 2022underConstruction: Does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting itCVE-2022-1896 · WordPress plugins & themes · reported by WPScanMedium 4.8
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletred_html capability is disallowed.
- Product
- underConstruction
- Fixed in
- 1.21
- What to do
- Update underConstruction to 1.21 or newer.
Jun 13, 2022Private Files: Is missing CSRF checkCVE-2022-1793 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public
- Product
- Private Files
- Affected
- up to 0.40
- What to do
- Affects up to 0.40. Update Private Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2022Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.CVE-2022-1788 · WordPress plugins & themes · reported by WPScanMedium 6.5
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.