WordPress CVEs

CVE-2023-2549 May 31, 2023

The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions starting from 1.0.7 up to, and including, 1.1.1. This is due to missing nonce validation in the 'createTempAccountLink' function.… Full details

HIGH 8.8

CVE-2023-2547 May 31, 2023

The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1.… Full details

MEDIUM 5.4

CVE-2023-2545 May 31, 2023

The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1.… Full details

HIGH 8.8

CVE-2023-2436 May 31, 2023

The Blog-in-Blog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blog_in_blog' shortcode in versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes.… Full details

MEDIUM 4.4

CVE-2023-2435 May 31, 2023

The Blog-in-Blog plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.0 via a shortcode attribute. This allows editor-level, and above, attackers to include and execute arbitrary files… Full details

HIGH 7.2

CVE-2015-10107 May 31, 2023

A vulnerability was found in Simplr Registration Form Plus+ Plugin up to 2.3.4 on WordPress and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack… Full details

MEDIUM 6.1

CVE-2014-125103 May 31, 2023

A vulnerability was found in BestWebSoft Twitter Plugin up to 1.3.2 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function twttr_settings_page of the file twitter.php. The manipulation of… Full details

MEDIUM 6.1

CVE-2012-10015 May 31, 2023

A vulnerability was found in BestWebSoft Twitter Plugin up to 2.14 on WordPress. It has been classified as problematic. Affected is the function twttr_settings_page of the file twitter.php of the component Settings Page. The… Full details

HIGH 8.8

CVE-2023-2518 May 30, 2023

The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape a parameter before outputting it back in the page when the debug option is enabled, leading to a Reflected Cross-Site… Full details

MEDIUM 6.1

CVE-2023-2470 May 30, 2023

The Add to Feedly WordPress plugin through 1.2.11 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Full details

MEDIUM 4.8

CVE-2023-2296 May 30, 2023

The Loginizer WordPress plugin before 1.7.9 does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as… Full details

MEDIUM 6.1

CVE-2023-2288 May 30, 2023

The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream… Full details

HIGH 8.8

CVE-2023-2287 May 30, 2023

The Orbit Fox by ThemeIsle WordPress plugin before 2.10.24 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a… Full details

MEDIUM 4.3

CVE-2023-2256 May 30, 2023

The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting. Full details

MEDIUM 6.1

CVE-2023-2223 May 30, 2023

The Login rebuilder WordPress plugin before 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the… Full details

MEDIUM 4.8

CVE-2023-2117 May 30, 2023

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files… Full details

LOW 2.7

CVE-2023-2113 May 30, 2023

The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel,… Full details

MEDIUM 4.8

CVE-2023-2111 May 30, 2023

The Fast & Effective Popups & Lead-Generation for WordPress plugin before 2.1.4 concatenates user input into an SQL query without escaping it first in the plugin's report API endpoint, which could allow administrators in… Full details

MEDIUM 4.9

CVE-2023-2023 May 30, 2023

The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. Full details

MEDIUM 6.1

CVE-2023-1938 May 30, 2023

The WP Fastest Cache WordPress plugin before 1.1.5 does not have CSRF check in an AJAX action, and does not validate user input before using it in the wp_remote_get() function, leading to a Blind… Full details

HIGH 8.8

CVE-2023-1524 May 30, 2023

The Download Manager WordPress plugin before 3.2.71 does not adequately validate passwords for password-protected files. Upon validation, a master key is generated and exposed to the user, which may be used to download any… Full details

MEDIUM 6.5

CVE-2023-0766 May 30, 2023

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page… Full details

HIGH 8.8

CVE-2023-0733 May 30, 2023

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks Full details

MEDIUM 6.1

CVE-2023-0443 May 30, 2023

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount.… Full details

MEDIUM 5.3

CVE-2023-0329 May 30, 2023

The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection… Full details

HIGH 7.2

CVE-2022-4676 May 30, 2023

The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Full details

MEDIUM 5.4

CVE-2014-125102 May 29, 2023

A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information… Full details

HIGH 7.5

CVE-2014-125101 May 28, 2023

A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the… Full details

CRITICAL 9.8

CVE-2022-47174 May 25, 2023

Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin Full details

HIGH 8.8

CVE-2022-47136 May 25, 2023

Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin Full details

HIGH 8.8

CVE-2022-38356 May 25, 2023

Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin Full details

HIGH 8.8

CVE-2022-47177 May 25, 2023

Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin Full details

HIGH 8.8

CVE-2022-47161 May 25, 2023

Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin Full details

HIGH 8.8

CVE-2023-2734 May 25, 2023

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from… Full details

CRITICAL 9.8

CVE-2023-2733 May 25, 2023

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST… Full details

CRITICAL 9.8

CVE-2023-2732 May 25, 2023

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST… Full details

CRITICAL 9.8

CVE-2023-2500 May 25, 2023

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.3.19 via deserialization of untrusted input from the 'go_pricing' shortcode 'data'… Full details

HIGH 8.8

CVE-2022-47447 May 24, 2023

Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin Full details

HIGH 8.8

CVE-2022-47446 May 24, 2023

Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin Full details

HIGH 8.8

CVE-2023-2498 May 24, 2023

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.19 due to insufficient input sanitization and output escaping.… Full details

MEDIUM 5.4

CVE-2023-2496 May 24, 2023

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validate_upload' function in versions up to, and including,… Full details

HIGH 7.5

CVE-2023-2494 May 24, 2023

The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including,… Full details

HIGH 8.8

CVE-2023-23705 May 23, 2023

Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin Full details

HIGH 8.8

CVE-2023-23706 May 23, 2023

Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin Full details

HIGH 8.8

CVE-2023-2276 May 20, 2023

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled… Full details

CRITICAL 9.8

CVE-2023-2736 May 20, 2023

The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation in the 'ajax_edit_contact' function. This makes it possible for… Full details

HIGH 8

CVE-2023-2735 May 20, 2023

The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping on user supplied attributes.… Full details

MEDIUM 5.4

CVE-2023-2717 May 20, 2023

The Groundhogg plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.9.8. This is due to missing nonce validation on the 'enable_safe_mode' function. This makes it possible for… Full details

MEDIUM 4.3

CVE-2023-2716 May 20, 2023

The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload_file' function in versions up to, and including, 2.7.9.8. This… Full details

MEDIUM 5.4

CVE-2023-2715 May 20, 2023

The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for… Full details

MEDIUM 4.3