Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,583 results · page 84 of 112
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4356 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023LetsRecover: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-4355 · WordPress plugins & themes · reported by WPScanHigh 7.2
The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- LetsRecover
- Fixed in
- 1.2.0
- What to do
- Update LetsRecover to 1.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4351 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Product list Widget for Woocommerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4329 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high privilege one like admin).
- Product
- Product list Widget for Woocommerce
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Product list Widget for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Wholesale Market: Does not have authorisation checkCVE-2022-4298 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
- Product
- Wholesale Market
- Fixed in
- 2.2.1
- What to do
- Update Wholesale Market to 2.2.1 or newer.
Jan 2, 2023WP AutoComplete Search: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated usersCVE-2022-4297 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- WP AutoComplete Search
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP AutoComplete Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jan 2, 2023WP-Ban: Does not sanitise and escape some of its settingsCVE-2022-4260 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP-Ban
- Fixed in
- 1.69.1
- What to do
- Update WP-Ban to 1.69.1 or newer.
Jan 2, 2023All-in-One Addons for Elementor: Does not sanitise and escape some of its settingsCVE-2022-4256 · WordPress plugins & themes · reported by WPScanMedium 4.8
The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- All-in-One Addons for Elementor
- Fixed in
- 2.4.4
- What to do
- Update All-in-One Addons for Elementor to 2.4.4 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated usersCVE-2022-4237 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available to any authenticated users, which could allow users with a role as low as subscriber to perform PHAR deserialisation when they can upload a file and a suitable gadget chain is present on the blog
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.6
- What to do
- Update Welcart e-Commerce to 2.8.6 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated usersCVE-2022-4236 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available to any authenticated users, which could allow users with a role as low as subscriber to read arbitrary files on the server.
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Jan 2, 2023Login with Cognito: Does not sanitise and escape some of its settingsCVE-2022-4200 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login with Cognito
- Affected
- up to 1.4.8
- What to do
- Affects up to 1.4.8. Update Login with Cognito to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023WP Social Sharing: Does not sanitise and escape some of its settingsCVE-2022-4198 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Social Sharing
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WP Social Sharing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurity.gentoo.orgwpscan.com
Jan 2, 2023WordPress Filter Gallery: Does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the pageCVE-2022-4142 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled.
- Product
- WordPress Filter Gallery
- Fixed in
- 0.1.6
- What to do
- Update WordPress Filter Gallery to 0.1.6 or newer.
Jan 2, 2023Welcart e-Commerce: Does not validate user input before using it to output the content of a fileCVE-2022-4140 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
- Product
- Welcart e-Commerce
- Fixed in
- 2.8.5
- What to do
- Update Welcart e-Commerce to 2.8.5 or newer.
Jan 2, 2023Image Optimizer, Resizer and CDN: Does not sanitise and escape some of its settingsCVE-2022-4119 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Optimizer, Resizer and CDN
- Fixed in
- 6.8.1
- What to do
- Update Image Optimizer, Resizer and CDN to 6.8.1 or newer.
Jan 2, 2023The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site ScripCVE-2022-4114 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scripting attacks.
- Fixed in
- 1.2.33
- What to do
- Update the plugin to 1.2.33 or newer.
Full record and what to do →NVD recordthemeforest.netwpscan.com
Jan 2, 2023Wholesale Market for WooCommerce: Does not validate user input against path traversal attacksCVE-2022-4109 · WordPress plugins & themes · reported by WPScanLow 2.7
The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users such as admin to download arbitrary logs from the server even when they should not be able to (for example in multisite)
- Product
- Wholesale Market for WooCommerce
- Fixed in
- 2.0.0
- What to do
- Update Wholesale Market for WooCommerce to 2.0.0 or newer.
Jan 2, 2023Joy Of Text Lite: Does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated usersCVE-2022-4099 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection
- Product
- Joy Of Text Lite
- Fixed in
- 2.3.1
- What to do
- Update Joy Of Text Lite to 2.3.1 or newer.
Jan 2, 2023Cryptocurrency Widgets Pack: Does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4059 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Cryptocurrency Widgets Pack
- Fixed in
- 2.0
- What to do
- Update Cryptocurrency Widgets Pack to 2.0 or newer.
Jan 2, 2023WP User: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4049 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- Product
- WP User
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WP User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Authenticator: Does not prevent subscribers from updating a site's feed access tokenCVE-2022-3994 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the functionality in certain configurations.
- Product
- Authenticator
- Fixed in
- 1.3.1
- What to do
- Update Authenticator to 1.3.1 or newer.
Jan 2, 2023Team Members: Does not sanitize and escapes some of its settingsCVE-2022-3936 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a multisite setup).
- Product
- Team Members
- Fixed in
- 5.2.1
- What to do
- Update Team Members to 5.2.1 or newer.
Jan 2, 2023iubenda: Does does not have authorisation and CSRF in an AJAX actionCVE-2022-3911 · WordPress plugins & themes · reported by WPScanHigh 8.8
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber can grant themselves any privileges, such as edit_plugins etc
- Product
- iubenda
- Fixed in
- 3.3.3
- What to do
- Update iubenda to 3.3.3 or newer.
Jan 2, 2023Visual Email Designer for WooCommerce: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3860 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author.
- Product
- Visual Email Designer for WooCommerce
- Fixed in
- 1.7.2
- What to do
- Update Visual Email Designer for WooCommerce to 1.7.2 or newer.
Jan 2, 2023Build App Online: Does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-3241 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Build App Online
- Fixed in
- 1.0.19
- What to do
- Update Build App Online to 1.0.19 or newer.
Dec 28, 2022Broken Link Checker: Does not sanitise and escape some of its settingsCVE-2022-3922 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Broken Link Checker
- Fixed in
- 1.11.20
- What to do
- Update Broken Link Checker to 1.11.20 or newer.
Dec 26, 2022Plugin Logic: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2022-4268 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Plugin Logic
- Fixed in
- 1.0.8
- What to do
- Update Plugin Logic to 1.0.8 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022Bulk Delete Users by Email: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-4267 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Bulk Delete Users by Email
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bulk Delete Users by Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Bulk Delete Users by Email: Does not have CSRF checkCVE-2022-4266 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete non admin users by knowing their email via a CSRF attack
- Product
- Bulk Delete Users by Email
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Bulk Delete Users by Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022ImageInject: Does not sanitise and escape some of its settingsCVE-2022-4243 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- ImageInject
- Affected
- up to 1.17
- What to do
- Affects up to 1.17. Update ImageInject to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2022-4242 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Google Review Slider
- Fixed in
- 11.6
- What to do
- Update WP Google Review Slider to 11.6 or newer.
Dec 26, 2022Workreap: Does not verify that an addon service belongs to the user issuing the requestCVE-2022-4239 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreap_addons_service_remove action, allowing any user to delete any post by knowing or guessing the id.
- Product
- Workreap
- Fixed in
- 2.6.4
- What to do
- Update Workreap to 2.6.4 or newer.
Dec 26, 2022Simple Basic Contact Form: Does not sanitise and escape some of its settingsCVE-2022-4226 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Basic Contact Form
- Fixed in
- 20221201
- What to do
- Update Simple Basic Contact Form to 20221201 or newer.
Dec 26, 2022Sliderby10Web: Does not sanitise and escape some of its settingsCVE-2022-4197 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Sliderby10Web
- Fixed in
- 1.2.53
- What to do
- Update Sliderby10Web to 1.2.53 or newer.
Dec 26, 2022Contest Gallery Pro: Does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-userCVE-2022-4154 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.
- Product
- Contest Gallery Pro
- Fixed in
- 19.1.5
- What to do
- Update Contest Gallery Pro to 19.1.5 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Dec 26, 2022IWS: Does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4117 · WordPress plugins & themes · reported by WPScanCritical 9.8
The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.
- Product
- IWS
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update IWS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Eventify™: Does not sanitise and escape some of its settingsCVE-2022-4110 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Eventify™
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Eventify™ to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2022Return Refund and Exchange For WooCommerce: Does not validate attachment files to be uploaded via an AJAX action available to unauthenticated usersCVE-2022-4047 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE
- Product
- Return Refund and Exchange For WooCommerce
- Fixed in
- 4.0.9
- What to do
- Update Return Refund and Exchange For WooCommerce to 4.0.9 or newer.
Dec 26, 2022Paytium: Mollie payment forms & donations: Does not sanitise and escape some of its settingsCVE-2022-4042 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paytium: Mollie payment forms & donations
- Fixed in
- 4.3.7
- What to do
- Update Paytium: Mollie payment forms & donations to 4.3.7 or newer.
Dec 26, 2022Login for Google Apps: Does not sanitise and escape some of its settingsCVE-2022-3840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login for Google Apps WordPress plugin before 3.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Login for Google Apps
- Fixed in
- 3.4.5
- What to do
- Update Login for Google Apps to 3.4.5 or newer.
Dec 26, 2022Kwayy HTML Sitemap: Does not sanitise and escape some of its settingsCVE-2022-3835 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Kwayy HTML Sitemap
- Fixed in
- 4.0
- What to do
- Update Kwayy HTML Sitemap to 4.0 or newer.
Dec 26, 2022Menu Item Visibility Control: Doesn't sanitize and validate the "Visibility logic" option for WordPress menu itemsCVE-2021-24942 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.
- Product
- Menu Item Visibility Control
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Menu Item Visibility Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2022Popup Manager: Does not have authorisation and CSRF checkCVE-2022-4125 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well
- Product
- Popup Manager
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Popup Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2022Popup Manager: Does not have authorisation and CSRF checksCVE-2022-4124 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them
- Product
- Popup Manager
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Popup Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2022Quizlord: Does not sanitise and escape some of its settingsCVE-2022-4112 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Quizlord
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Quizlord to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 19, 2022Wholesale Market for WooCommerce: Does not validate user input used to generate system pathCVE-2022-4108 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users such as admin to download arbitrary file from the server even when they should not be able to (for example in multisite)
- Product
- Wholesale Market for WooCommerce
- Fixed in
- 1.0.8
- What to do
- Update Wholesale Market for WooCommerce to 1.0.8 or newer.
Dec 19, 2022SMSA Shipping for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-4107 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be downloaded, allowing any authenticated users, such as subscriber to download arbitrary file from the server
- Product
- SMSA Shipping for WooCommerce
- Fixed in
- 1.0.5
- What to do
- Update SMSA Shipping for WooCommerce to 1.0.5 or newer.
Dec 19, 2022Wholesale Market for WooCommerce: Does not have authorisation checkCVE-2022-4106 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
- Product
- Wholesale Market for WooCommerce
- Fixed in
- 1.0.7
- What to do
- Update Wholesale Market for WooCommerce to 1.0.7 or newer.
Dec 19, 2022JobBoardWP: Does not properly validate file names and types in its file upload functionalitiesCVE-2022-4061 · WordPress plugins & themes · reported by WPScanHigh 7.5
The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary files such as PHP.
- Product
- JobBoardWP
- Fixed in
- 1.2.2
- What to do
- Update JobBoardWP to 1.2.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.