Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,583 results · page 86 of 112
Dec 5, 2022PostmagThemes Demo Import: Does not validate the imported fileCVE-2022-1540 · WordPress plugins & themes · reported by WPScanHigh 7.2
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.
- Product
- PostmagThemes Demo Import
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update PostmagThemes Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3865 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022Find and Replace All: Does not have CSRF checkCVE-2022-3850 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3849 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WP User Merger: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3848 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
- Product
- WP User Merger
- Fixed in
- 1.5.3
- What to do
- Update WP User Merger to 1.5.3 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022Showing URL in QR Code: Does not have CSRF checkCVE-2022-3847 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack
- Product
- Showing URL in QR Code
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update Showing URL in QR Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022Analytics for WP: Does not sanitise and escape some of its settingsCVE-2022-3839 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Analytics for WP WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Analytics for WP
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update Analytics for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Google Forms: Does not sanitise and escape some of its settingsCVE-2022-3834 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Google Forms
- Affected
- up to 0.95
- What to do
- Affects up to 0.95. Update Google Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Fancier Author Box by ThematoSoup: Does not sanitise and escape some of its settingsCVE-2022-3833 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Fancier Author Box by ThematoSoup
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Fancier Author Box by ThematoSoup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022reCAPTCHA: Does not sanitise and escape some of its settingsCVE-2022-3831 · WordPress plugins & themes · reported by WPScanMedium 4.8
The reCAPTCHA WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- reCAPTCHA
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update reCAPTCHA to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Video Thumbnails: Does not sanitise and escape some of its settingsCVE-2022-3828 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Video Thumbnails
- Affected
- up to 2.12.3
- What to do
- Affects up to 2.12.3. Update Video Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022WP Admin UI Customize: Does not sanitise and escape some of its settingsCVE-2022-3824 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Admin UI Customize
- Fixed in
- 1.5.13
- What to do
- Update WP Admin UI Customize to 1.5.13 or newer.
Nov 28, 2022Beautiful Cookie Consent Banner: Does not sanitise and escape some of its settingsCVE-2022-3823 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Beautiful Cookie Consent Banner
- Fixed in
- 2.9.1
- What to do
- Update Beautiful Cookie Consent Banner to 2.9.1 or newer.
Nov 28, 2022Donations via PayPal: Does not sanitise and escape some of its settingsCVE-2022-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Donations via PayPal
- Fixed in
- 1.9.9
- What to do
- Update Donations via PayPal to 1.9.9 or newer.
Nov 28, 2022OWM Weather: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3769 · WordPress plugins & themes · reported by WPScanHigh 8.8
The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as contributor
- Product
- OWM Weather
- Fixed in
- 5.6.9
- What to do
- Update OWM Weather to 5.6.9 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022WPSmartContracts: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3768 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author
- Product
- WPSmartContracts
- Fixed in
- 1.3.12
- What to do
- Update WPSmartContracts to 1.3.12 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022HTML Forms: Does not properly properly escape a parameter before using it in a SQL statementCVE-2022-3689 · WordPress plugins & themes · reported by WPScanHigh 7.2
The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
- Product
- HTML Forms
- Fixed in
- 1.3.25
- What to do
- Update HTML Forms to 1.3.25 or newer.
Nov 28, 2022Jeeng Push Notifications: Does not sanitise and escape some of its settingsCVE-2022-3610 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Jeeng Push Notifications
- Fixed in
- 2.0.4
- What to do
- Update Jeeng Push Notifications to 2.0.4 or newer.
Nov 28, 2022Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list: Does not validate dataCVE-2022-3603 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection.
- Product
- Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list
- Fixed in
- 2.0.69
- What to do
- Update Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list to 2.0.69 or newer.
Nov 28, 2022Image Hover Effects Css3: Does not sanitise and escape some of its settingsCVE-2022-3601 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Hover Effects Css3
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update Image Hover Effects Css3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2022Awesome Support: Does not ensure that the exported tickets archive to be downloaded belongs to the user making the requestCVE-2022-3511 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
- Product
- Awesome Support
- Fixed in
- 6.1.2
- What to do
- Update Awesome Support to 6.1.2 or newer.
Nov 28, 2022Salat Times: Does not sanitize and escapes its settingsCVE-2022-2983 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Salat Times
- Fixed in
- 3.2.2
- What to do
- Update Salat Times to 3.2.2 or newer.
Nov 28, 2022Find and Replace All: Does not sanitize and escape some parameters from its setting page before outputting them back to the userCVE-2022-2311 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 28, 2022Download: Does not properly validate a user has the required privileges to access a backup's nonce identifierCVE-2021-25059 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download a full copy of the website.
- Product
- Download
- Fixed in
- 2.0.0
- What to do
- Update Download to 2.0.0 or newer.
Nov 21, 2022Evaluate: Does not sanitize and escapes some of its settingsCVE-2022-3753 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Evaluate
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Evaluate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2022Event Monster: Does not validate and escape some parameters before using them in SQL statementsCVE-2022-3720 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injection exploitable by high privilege users
- Product
- Event Monster
- Fixed in
- 1.2.0
- What to do
- Update Event Monster to 1.2.0 or newer.
Nov 21, 2022Popup Maker: Does not sanitise and escape some of its Popup optionsCVE-2022-3690 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins
- Product
- Popup Maker
- Fixed in
- 1.16.11
- What to do
- Update Popup Maker to 1.16.11 or newer.
Nov 21, 2022WPQA Builder: Does not have CSRF checkCVE-2022-3688 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users perform such actions via CSRF attacks
- Product
- WPQA Builder
- Fixed in
- 5.9
- What to do
- Update WPQA Builder to 5.9 or newer.
Nov 21, 2022Contact Form 7 Database Addon: Does not validate dataCVE-2022-3634 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection
- Product
- Contact Form 7 Database Addon
- Fixed in
- 1.2.6.5
- What to do
- Update Contact Form 7 Database Addon to 1.2.6.5 or newer.
Nov 21, 2022Spacer: Does not sanitize and escapes some of its settingsCVE-2022-3618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Spacer
- Fixed in
- 3.0.7
- What to do
- Update Spacer to 3.0.7 or newer.
Nov 21, 2022Easy Digital Downloads: Does not validate dataCVE-2022-3600 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection.
- Product
- Easy Digital Downloads
- Fixed in
- 3.1.0.2
- What to do
- Update Easy Digital Downloads to 3.1.0.2 or newer.
Nov 21, 2022Event Monster: Does not have CSRF checkCVE-2022-3336 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack
- Product
- Event Monster
- Fixed in
- 1.2.0
- What to do
- Update Event Monster to 1.2.0 or newer.
Nov 21, 2022Five Star Restaurant Reservations: Does not have authorisationCVE-2022-0421 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
- Product
- Five Star Restaurant Reservations
- Fixed in
- 2.4.12
- What to do
- Update Five Star Restaurant Reservations to 2.4.12 or newer.
Nov 14, 2022OAuth Client by DigitialPixies: Does not have CSRF checks in some placesCVE-2022-3632 · WordPress plugins & themes · reported by WPScanMedium 6.5
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions.
- Product
- OAuth Client by DigitialPixies
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2022OAuth Client by DigitialPixies: Does not sanitize and escapes some of its settingsCVE-2022-3631 · WordPress plugins & themes · reported by WPScanMedium 4.8
The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- OAuth Client by DigitialPixies
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update OAuth Client by DigitialPixies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2022ProfileGrid: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-3578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- ProfileGrid
- Fixed in
- 5.1.1
- What to do
- Update ProfileGrid to 5.1.1 or newer.
Nov 14, 2022WPForms Pro: Does not validate its form dataCVE-2022-3574 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.
- Product
- WPForms Pro
- Fixed in
- 1.7.7
- What to do
- Update WPForms Pro to 1.7.7 or newer.
Nov 14, 2022Webmaster Tools Verification: Does not have authorisation and CSRF checksCVE-2022-3538 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
- Product
- Webmaster Tools Verification
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Webmaster Tools Verification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2022The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.CVE-2022-3484 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- What to do
- Update the plugin to the newest version.
Nov 14, 2022WP Attachments: Does not sanitize and escapes some of its settingsCVE-2022-3469 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- WP Attachments
- Fixed in
- 5.0.5
- What to do
- Update WP Attachments to 5.0.5 or newer.
Nov 14, 2022Chat Bubble: Does not sanitise and escape some contact parametersCVE-2022-3415 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message
- Product
- Chat Bubble
- Fixed in
- 2.3
- What to do
- Update Chat Bubble to 2.3 or newer.
Nov 14, 2022reSmush.it : the only free Image Optimizer & compress: Does not perform CSRF checks for any of its AJAX actionsCVE-2022-2449 · WordPress plugins & themes · reported by WPScanMedium 6.5
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
- Product
- reSmush.it : the only free Image Optimizer & compress
- Fixed in
- 0.4.4
- What to do
- Update reSmush.it : the only free Image Optimizer & compress to 0.4.4 or newer.
Nov 7, 2022Import and export users and customers: Does not properly escape dataCVE-2022-3558 · WordPress plugins & themes · reported by WPScanHigh 8
The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files.
- Product
- Import and export users and customers
- Fixed in
- 1.20.5
- What to do
- Update Import and export users and customers to 1.20.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3537 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
- Product
- Role Based Pricing for WooCommerce
- Fixed in
- 1.6.2
- What to do
- Update Role Based Pricing for WooCommerce to 1.6.2 or newer.
Nov 7, 2022Role Based Pricing for WooCommerce: Does not have authorisation and proper CSRF checksCVE-2022-3536 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blog
- Product
- Role Based Pricing for WooCommerce
- Fixed in
- 1.6.3
- What to do
- Update Role Based Pricing for WooCommerce to 1.6.3 or newer.
Nov 7, 2022WP Hide: Does not have authorisation and CSRF checks in placeCVE-2022-3489 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request
- Product
- WP Hide
- Affected
- up to 0.0.2
- What to do
- Affects up to 0.0.2. Update WP Hide to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 7, 2022WooCommerce Dropshipping: Does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated usersCVE-2022-3481 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
- Product
- WooCommerce Dropshipping
- Fixed in
- 4.4
- What to do
- Update WooCommerce Dropshipping to 4.4 or newer.
Nov 7, 2022Contact Form: Does not validate and escape fieldsCVE-2022-3463 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
- Product
- Contact Form
- Fixed in
- 4.3.13
- What to do
- Update Contact Form to 4.3.13 or newer.
Nov 7, 2022Highlight Focus: Does not sanitise and escape some of its settingsCVE-2022-3462 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Highlight Focus
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Highlight Focus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 7, 2022Product Stock Manager: Does not have authorisation and proper CSRF checks in multiple AJAX actionsCVE-2022-3451 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options
- Product
- Product Stock Manager
- Fixed in
- 1.0.5
- What to do
- Update Product Stock Manager to 1.0.5 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.