Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,583 results · page 90 of 112
Aug 8, 2022Auto More Tag: Does not sanitise and escape some of its settingsCVE-2022-2411 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Auto More Tag WordPress plugin through 4.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Auto More Tag
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Auto More Tag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022mTouch Quiz: Does not sanitise and escape some of its settingsCVE-2022-2410 · WordPress plugins & themes · reported by WPScanMedium 4.8
The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- mTouch Quiz
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update mTouch Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022Rough Chart: Does not properly escape chart data labelCVE-2022-2409 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Rough Chart WordPress plugin through 1.0.0 does not properly escape chart data label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Rough Chart
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Rough Chart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 8, 2022WordPress Comments Fields: Does not escape Field Error MessageCVE-2022-2398 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WordPress Comments Fields
- Fixed in
- 4.1
- What to do
- Update WordPress Comments Fields to 4.1 or newer.
Aug 8, 2022weForms: Does not sanitise and escape its settingsCVE-2022-2395 · WordPress plugins & themes · reported by WPScanMedium 4.8
The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- weForms
- Fixed in
- 1.6.14
- What to do
- Update weForms to 1.6.14 or newer.
Aug 8, 2022The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript iCVE-2022-2391 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.
- Fixed in
- 7.2.3
- What to do
- Update the plugin to 7.2.3 or newer.
Aug 8, 2022Crowdsignal Dashboard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2386 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Crowdsignal Dashboard
- Fixed in
- 3.0.8
- What to do
- Update Crowdsignal Dashboard to 3.0.8 or newer.
Aug 8, 2022YaySMTP: Does not sanitise and escape some of its settingsCVE-2022-2372 · WordPress plugins & themes · reported by WPScanMedium 4.8
The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- YaySMTP
- Fixed in
- 2.2.2
- What to do
- Update YaySMTP to 2.2.2 or newer.
Aug 8, 2022YaySMTP: Does not have proper authorisationCVE-2022-2371 · WordPress plugins & themes · reported by WPScanMedium 5.4
The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well.
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 8, 2022Frontend File Manager & Sharing: Does not filter file extensionsCVE-2022-2356 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Frontend File Manager & Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.
- Product
- Frontend File Manager & Sharing
- Fixed in
- 1.1.3
- What to do
- Update Frontend File Manager & Sharing to 1.1.3 or newer.
Aug 8, 2022Easy Username Updater: Does not implement CSRF checksCVE-2022-2355 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Easy Username Updater WordPress plugin before 1.0.5 does not implement CSRF checks, which could allow attackers to make a logged in admin change any user's username includes the admin
- Product
- Easy Username Updater
- Fixed in
- 1.0.5
- What to do
- Update Easy Username Updater to 1.0.5 or newer.
Aug 8, 2022Website File Changes Monitor: Does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins)CVE-2022-2269 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection
- Product
- Website File Changes Monitor
- Fixed in
- 1.8.3
- What to do
- Update Website File Changes Monitor to 1.8.3 or newer.
Aug 1, 2022YaySMTP: Does not have capability check before displaying the Mailer Credentials in JS code for the settingsCVE-2022-2370 · WordPress plugins & themes · reported by WPScanMedium 6.5
The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 1, 2022YaySMTP: Does not have capability check in an AJAX actionCVE-2022-2369 · WordPress plugins & themes · reported by WPScanMedium 4.3
The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin
- Product
- YaySMTP
- Fixed in
- 2.2.1
- What to do
- Update YaySMTP to 2.2.1 or newer.
Aug 1, 2022Flexi Quote Rotator: Does not sanitise and escape its settingsCVE-2022-2328 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flexi Quote Rotator
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Flexi Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Invitation Based Registrations: Does not sanitise and escape some of its settingsCVE-2022-2325 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Invitation Based Registrations
- Affected
- up to 2.2.84
- What to do
- Affects up to 2.2.84. Update Invitation Based Registrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022WordPress Popup: Does not sanitise and escape some of its settingsCVE-2022-2305 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Popup
- Affected
- up to 1.9.3.8
- What to do
- Affects up to 1.9.3.8. Update WordPress Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Featured Image from URL (FIFU): Does not validateCVE-2022-2278 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Featured Image from URL (FIFU)
- Fixed in
- 4.0.1
- What to do
- Update Featured Image from URL (FIFU) to 4.0.1 or newer.
Aug 1, 2022Simple Membership: Does not properly validate the membership_level parameterCVE-2022-2273 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.
- Product
- Simple Membership
- Fixed in
- 4.1.3
- What to do
- Update Simple Membership to 4.1.3 or newer.
Aug 1, 2022GiveWP: Does not have CSRF in placeCVE-2022-2260 · WordPress plugins & themes · reported by WPScanMedium 6.5
The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU.
- Product
- GiveWP
- Fixed in
- 2.21.3
- What to do
- Update GiveWP to 2.21.3 or newer.
Aug 1, 2022Featured Image from URL (FIFU): Does not have CSRF check in placeCVE-2022-2241 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of validation, sanitisation and escaping in some of them, it could also lead to Stored XSS issues
- Product
- Featured Image from URL (FIFU)
- Fixed in
- 4.0.1
- What to do
- Update Featured Image from URL (FIFU) to 4.0.1 or newer.
Aug 1, 2022GiveWP: Does not properly sanitise and escape the currency settingsCVE-2022-2215 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- GiveWP
- Fixed in
- 2.21.3
- What to do
- Update GiveWP to 2.21.3 or newer.
Aug 1, 2022Advanced WordPress Reset: Does not escape some generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2181 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced WordPress Reset
- Fixed in
- 1.6
- What to do
- Update Advanced WordPress Reset to 1.6 or newer.
Aug 1, 2022Microsoft Advertising Universal Event Tracking (UET): Does not sanitise and escape its settingsCVE-2022-2170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage.
- Product
- Microsoft Advertising Universal Event Tracking (UET)
- Fixed in
- 1.0.4
- What to do
- Update Microsoft Advertising Universal Event Tracking (UET) to 1.0.4 or newer.
Aug 1, 2022Youzify: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-1950 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
- Product
- Youzify
- Fixed in
- 1.2.0
- What to do
- Update Youzify to 1.2.0 or newer.
Aug 1, 2022Copyright Proof: Does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated usersCVE-2022-1906 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting when a specific setting is enabled.
- Product
- Copyright Proof
- Affected
- up to 4.16
- What to do
- Affects up to 4.16. Update Copyright Proof to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Project Source Code Download: Does not protect its backup generation and download functionalitiesCVE-2022-1585 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
- Product
- Project Source Code Download
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Project Source Code Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Event Timeline: Does not sanitize and escape Timeline TextCVE-2022-1324 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Event Timeline
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Event Timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2022Login with phone number: Does not sanitise and escape plugin settingsCVE-2022-0598 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Login with phone number
- Fixed in
- 1.3.8
- What to do
- Update Login with phone number to 1.3.8 or newer.
Jul 25, 2022Simple Page Transition: Does not sanitise and escape some of its settingsCVE-2022-2341 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Page Transition
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Simple Page Transition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 25, 2022W-DALIL: Does not sanitise and escape some of its fieldsCVE-2022-2340 · WordPress plugins & themes · reported by WPScanMedium 4.8
The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- W-DALIL
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update W-DALIL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 25, 2022Allow SVG Files: Does not sanitise uploaded SVG filesCVE-2022-2299 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
- Product
- Allow SVG Files
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Allow SVG Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 25, 2022Request a Quote: Does not validate uploaded CSV filesCVE-2022-2240 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it
- Product
- Request a Quote
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 25, 2022Request a Quote: Does not sanitise and escape some of its settingsCVE-2022-2239 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Request a Quote
- Fixed in
- 2.3.9
- What to do
- Update Request a Quote to 2.3.9 or newer.
Jul 25, 2022Unyson: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2219 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Unyson
- Fixed in
- 2.7.27
- What to do
- Update Unyson to 2.7.27 or newer.
Jul 25, 2022WP Video Lightbox: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- WP Video Lightbox
- Fixed in
- 1.9.5
- What to do
- Update WP Video Lightbox to 1.9.5 or newer.
Jul 25, 2022Popup Anything: Does not sanitise and escape a parameter before outputting it back in a frontend pageCVE-2022-2115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting
- Product
- Popup Anything
- Fixed in
- 2.1.7
- What to do
- Update Popup Anything to 2.1.7 or newer.
Jul 25, 2022Name Directory: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2072 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well
- Product
- Name Directory
- Fixed in
- 1.25.3
- What to do
- Update Name Directory to 1.25.3 or newer.
Jul 25, 2022Name Directory: Does not have CSRF checkCVE-2022-2071 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them.
- Product
- Name Directory
- Fixed in
- 1.25.4
- What to do
- Update Name Directory to 1.25.4 or newer.
Jul 25, 2022Exports and Reports: Does not sanitize and validate dataCVE-2022-1539 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.
- Product
- Exports and Reports
- Fixed in
- 0.9.2
- What to do
- Update Exports and Reports to 0.9.2 or newer.
Jul 25, 2022Header Footer Code Manager: Does not escape generated URLs before outputting them back in attributes in an admin pageCVE-2022-0899 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.
- Product
- Header Footer Code Manager
- Fixed in
- 1.1.24
- What to do
- Update Header Footer Code Manager to 1.1.24 or newer.
Jul 25, 2022Professional Social Sharing Buttons, Icons & Related Posts: Does not have proper authorisation check in one of the AJAX actionCVE-2022-0594 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
- Product
- Professional Social Sharing Buttons, Icons & Related Posts
- Fixed in
- 9.7.6
- What to do
- Update Professional Social Sharing Buttons, Icons & Related Posts to 9.7.6 or newer.
Jul 17, 2022Download Monitor: Does not ensure that files to be downloaded are inside the blog foldersCVE-2022-2222 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
- Product
- Download Monitor
- Fixed in
- 4.5.91
- What to do
- Update Download Monitor to 4.5.91 or newer.
Jul 17, 2022Accept Stripe Payments: Does not sanitize and escape some of its settingsCVE-2022-2194 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Accept Stripe Payments
- Fixed in
- 2.0.64
- What to do
- Update Accept Stripe Payments to 2.0.64 or newer.
Jul 17, 2022Contact Form 7 Captcha: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2022-2187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- Contact Form 7 Captcha
- Fixed in
- 0.1.2
- What to do
- Update Contact Form 7 Captcha to 0.1.2 or newer.
Jul 17, 2022Simple Post Notes: Does not sanitise and escape its settingsCVE-2022-2186 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Post Notes
- Fixed in
- 1.7.6
- What to do
- Update Simple Post Notes to 1.7.6 or newer.
Jul 17, 2022Advanced Database Cleaner: Does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pagesCVE-2022-2173 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
- Product
- Advanced Database Cleaner
- Fixed in
- 3.1.1
- What to do
- Update Advanced Database Cleaner to 3.1.1 or newer.
Jul 17, 2022Loading Page with Loading Screen: Does not escape its settingsCVE-2022-2169 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Loading Page with Loading Screen
- Fixed in
- 1.0.83
- What to do
- Update Loading Page with Loading Screen to 1.0.83 or newer.
Jul 17, 2022Download Manager: Does not escape a generated URL before outputting it back in an attribute of the history dashboardCVE-2022-2168 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting
- Product
- Download Manager
- Fixed in
- 3.2.44
- What to do
- Update Download Manager to 3.2.44 or newer.
Jul 17, 2022Best Contact Management Software: Does not sanitise and escape its settingsCVE-2022-2151 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Best Contact Management Software
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Best Contact Management Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.