Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,583 results · page 88 of 112
Oct 3, 2022Zephyr Project Manager: Does not have any authorisationCVE-2022-2839 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.55
- What to do
- Update Zephyr Project Manager to 3.2.55 or newer.
Oct 3, 2022WP Socializer: Does not sanitise and escape some of its Icons settingsCVE-2022-2763 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Socializer
- Fixed in
- 7.3
- What to do
- Update WP Socializer to 7.3 or newer.
Oct 3, 2022DSGVO All in one for WP: Does not sanitise and escape some of its settingsCVE-2022-2628 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DSGVO All in one for WP
- Fixed in
- 4.2
- What to do
- Update DSGVO All in one for WP to 4.2 or newer.
Sep 26, 2022SEO Smart Links: Does not sanitise and escape some of its settingsCVE-2022-3135 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SEO Smart Links
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update SEO Smart Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022OAuth client Single Sign On: Does not have authorisation and CSRFCVE-2022-3119 · WordPress plugins & themes · reported by WPScanHigh 7.5
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address
- Product
- OAuth client Single Sign On
- Fixed in
- 3.0.4
- What to do
- Update OAuth client Single Sign On to 3.0.4 or newer.
Sep 26, 2022Login Block IPs: Does not have CSRF check in placeCVE-2022-3098 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Login Block IPs
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Login Block IPs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Slider Hero: Does not escape the slider NameCVE-2022-3074 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
- Product
- Slider Hero
- Fixed in
- 8.4.4
- What to do
- Update Slider Hero to 8.4.4 or newer.
Sep 26, 2022Generate PDF: Does not sanitise and escape its settingsCVE-2022-3070 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Generate PDF
- Fixed in
- 3.6
- What to do
- Update Generate PDF to 3.6 or newer.
Sep 26, 2022WordLift: Does not sanitise and escape its settingsCVE-2022-3069 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordLift
- Fixed in
- 3.37.2
- What to do
- Update WordLift to 3.37.2 or newer.
Sep 26, 2022Simple File List: Does not escape parameters before outputting them back in attributesCVE-2022-3062 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Simple File List
- Fixed in
- 4.4.12
- What to do
- Update Simple File List to 4.4.12 or newer.
Sep 26, 2022Bitcoin / Altcoin Faucet: Does not have any CSRF checkCVE-2022-3025 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- Bitcoin / Altcoin Faucet
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Bitcoin / Altcoin Faucet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Simple Bitcoin Faucets: Does not have any authorisation and CSRF in an AJAX actionCVE-2022-3024 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- Simple Bitcoin Faucets
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Simple Bitcoin Faucets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Ldap WP Login / Active Directory Integration: Does not have any authorisation and CSRF checksCVE-2022-2987 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication
- Product
- Ldap WP Login / Active Directory Integration
- Fixed in
- 3.0.2
- What to do
- Update Ldap WP Login / Active Directory Integration to 3.0.2 or newer.
Sep 26, 2022Download Manager: Does not validate one of its settingsCVE-2022-2926 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory
- Product
- Download Manager
- Fixed in
- 3.2.55
- What to do
- Update Download Manager to 3.2.55 or newer.
Sep 26, 2022WP Popup Builder: Does not have authorisation and CSRF check in an AJAX actionCVE-2022-2405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup
- Product
- WP Popup Builder
- Fixed in
- 1.2.9
- What to do
- Update WP Popup Builder to 1.2.9 or newer.
Sep 26, 2022WP Popup Builder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2404 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Popup Builder
- Fixed in
- 1.2.9
- What to do
- Update WP Popup Builder to 1.2.9 or newer.
Sep 26, 2022Post SMTP Mailer/Email Log: Does not have proper authorisation in some AJAX actionsCVE-2022-2352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.7
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.7 or newer.
Sep 26, 2022SVG Support: Does not properly handle SVG added via an URLCVE-2022-1755 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks
- Product
- SVG Support
- Fixed in
- 2.5
- What to do
- Update SVG Support to 2.5 or newer.
Sep 26, 2022Scripts Organizer: Does not have capability and CSRF checks in the saveScript AJAX actionCVE-2021-24890 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file
- Product
- Scripts Organizer
- Fixed in
- 3.0
- What to do
- Update Scripts Organizer to 3.0 or newer.
Full record and what to do →NVD recorddplugins.comwpscan.com
Sep 19, 2022NEX-Forms: Does not properly sanitise and escape user input before using it in SQL statementsCVE-2022-3142 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
- Product
- NEX-Forms
- Fixed in
- 7.9.7
- What to do
- Update NEX-Forms to 7.9.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.commedium.com
Sep 19, 2022Gettext override translations: Does not sanitise and escape some of its settingsCVE-2022-3036 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Gettext override translations
- Fixed in
- 2.0.0
- What to do
- Update Gettext override translations to 2.0.0 or newer.
Sep 19, 2022Slickr Flickr: Does not sanitise and escape its settingsCVE-2022-3021 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Slickr Flickr
- Affected
- up to 2.8.1
- What to do
- Affects up to 2.8.1. Update Slickr Flickr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022BadgeOS: Does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated usersCVE-2022-2958 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections
- Product
- BadgeOS
- Fixed in
- 3.7.1.3
- What to do
- Update BadgeOS to 3.7.1.3 or newer.
Sep 19, 2022Zephyr Project Manager: Does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated usersCVE-2022-2840 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.5
- What to do
- Update Zephyr Project Manager to 3.2.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Sep 19, 2022Ketchup Restaurant Reservations: Does not validate and escape some reservation parameters before using them in SQL statementsCVE-2022-2754 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements, which could allow unauthenticated attackers to perform SQL Injection attacks
- Product
- Ketchup Restaurant Reservations
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ketchup Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022Ketchup Restaurant Reservations: Does not sanitise and escape some of the reservation user inputsCVE-2022-2753 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made
- Product
- Ketchup Restaurant Reservations
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ketchup Restaurant Reservations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022Scroll To Top: Does not escape some of its settingsCVE-2022-2710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Scroll To Top
- Fixed in
- 1.4.1
- What to do
- Update Scroll To Top to 1.4.1 or newer.
Sep 19, 2022Float to Top Button: Does not escape some of its settingsCVE-2022-2709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Float to Top Button
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Float to Top Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 19, 2022Form Builder CP: Does not sanitise and escape some of its form settingsCVE-2022-2567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Form Builder CP
- Fixed in
- 1.2.32
- What to do
- Update Form Builder CP to 1.2.32 or newer.
Sep 19, 2022WordPress Ping Optimizer: Does not have CSRF check in placeCVE-2022-1591 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WordPress Ping Optimizer
- Fixed in
- 2.35.1.3.0
- What to do
- Update WordPress Ping Optimizer to 2.35.1.3.0 or newer.
Sep 19, 2022Site Offline Or Coming Soon Or Maintenance Mode: Prevents users from accessing a website but does not do so if the URL contained certain keywordsCVE-2022-1580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
- Product
- Site Offline Or Coming Soon Or Maintenance Mode
- Fixed in
- 1.5.3
- What to do
- Update Site Offline Or Coming Soon Or Maintenance Mode to 1.5.3 or newer.
Sep 16, 2022Login No Captcha reCAPTCHA: Doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screenCVE-2022-2913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen.
- Product
- Login No Captcha reCAPTCHA
- Fixed in
- 1.7
- What to do
- Update Login No Captcha reCAPTCHA to 1.7 or newer.
Sep 16, 2022Craw Data: Does not implement nonce checksCVE-2022-2912 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF).
- Product
- Craw Data
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Craw Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2022WP Server Health Stats: Does not escape some of its settingsCVE-2022-2887 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WP Server Health Stats
- Fixed in
- 1.7.0
- What to do
- Update WP Server Health Stats to 1.7.0 or newer.
Sep 16, 2022Titan Anti-spam & Security: Does not properly checks HTTP headers in order to validate the origin IP addressCVE-2022-2877 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers.
- Product
- Titan Anti-spam & Security
- Fixed in
- 7.3.1
- What to do
- Update Titan Anti-spam & Security to 7.3.1 or newer.
Sep 16, 2022Migration, Backup, Staging: Does not sanitise and validate a parameter before using it to read the content of a fileCVE-2022-2863 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.76
- What to do
- Update Migration, Backup, Staging to 0.9.76 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 16, 2022Affiliates Manager: Does not sanitise and escape some of its settingsCVE-2022-2799 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Affiliates Manager
- Fixed in
- 2.9.14
- What to do
- Update Affiliates Manager to 2.9.14 or newer.
Sep 16, 2022Affiliates Manager: Does not validate and sanitise the affiliate dataCVE-2022-2798 · WordPress plugins & themes · reported by WPScanHigh 8
The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection attacks against an admin exporting the data
- Product
- Affiliates Manager
- Fixed in
- 2.9.14
- What to do
- Update Affiliates Manager to 2.9.14 or newer.
Sep 16, 2022WP STAGING: Does not sanitise and escape some of its settingsCVE-2022-2737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP STAGING
- Fixed in
- 2.9.18
- What to do
- Update WP STAGING to 2.9.18 or newer.
Sep 16, 2022WP Taxonomy Import: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2669 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Taxonomy Import
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update WP Taxonomy Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 16, 2022Classified Listing Pro: Does not escape a generated URL before outputting it back in an attribute in an admin pageCVE-2022-2655 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Classified Listing Pro
- Fixed in
- 2.0.20
- What to do
- Update Classified Listing Pro to 2.0.20 or newer.
Sep 16, 2022Autoptimize: Does not sanitise and escape some of its settingsCVE-2022-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Autoptimize
- Fixed in
- 3.1.1
- What to do
- Update Autoptimize to 3.1.1 or newer.
Sep 16, 2022WBW Currency Switcher for WooCommerce: Does not sanitise and escape some of its settingsCVE-2022-2575 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WBW Currency Switcher for WooCommerce
- Fixed in
- 1.6.6
- What to do
- Update WBW Currency Switcher for WooCommerce to 1.6.6 or newer.
Sep 16, 2022Post SMTP Mailer/Email Log: Does not escape some of its settings before outputting them in the admins dashboardCVE-2022-2351 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.4
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.4 or newer.
Sep 16, 2022Mobile Events Manager: Does not properly escape the Enquiry source fieldCVE-2022-1194 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability.
- Product
- Mobile Events Manager
- Fixed in
- 1.4.8
- What to do
- Update Mobile Events Manager to 1.4.8 or newer.
Sep 5, 2022Fast Flow: Does not sanitise and escape some of its Widget settingsCVE-2022-2775 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Fast Flow WordPress plugin before 1.2.13 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fast Flow
- Fixed in
- 1.2.13
- What to do
- Update Fast Flow to 1.2.13 or newer.
Sep 5, 2022Visual Portfolio, Photo Gallery & Post Grid: Does not have proper authorisation checks in some of its REST endpointsCVE-2022-2597 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts
- Product
- Visual Portfolio, Photo Gallery & Post Grid
- Fixed in
- 2.19.0
- What to do
- Update Visual Portfolio, Photo Gallery & Post Grid to 2.19.0 or newer.
Sep 5, 2022Simple Payment Donations & Subscriptions: Does not sanitise and escape user input given in its formsCVE-2022-2565 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given in its forms, which could allow unauthenticated attackers to perform Cross-Site Scripting attacks against admins
- Product
- Simple Payment Donations & Subscriptions
- Fixed in
- 4.2.1
- What to do
- Update Simple Payment Donations & Subscriptions to 4.2.1 or newer.
Sep 5, 2022Visual Portfolio, Photo Gallery & Post Grid: Does not have proper authorisation checks in some of its REST endpointsCVE-2022-2543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts
- Product
- Visual Portfolio, Photo Gallery & Post Grid
- Fixed in
- 2.18.0
- What to do
- Update Visual Portfolio, Photo Gallery & Post Grid to 2.18.0 or newer.
Sep 5, 2022WP Database Backup: Does not escape some of its settingsCVE-2022-2271 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Database Backup
- Fixed in
- 5.9
- What to do
- Update WP Database Backup to 5.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.