WordPress CVEs

CVE-2022-4443 January 23, 2023

The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Full details

MEDIUM 6.5

CVE-2022-4383 January 23, 2023

The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a… Full details

CRITICAL 9.8

CVE-2022-4346 January 23, 2023

The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address. Full details

MEDIUM 5.3

CVE-2022-4323 January 23, 2023

The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present Full details

HIGH 7.2

CVE-2022-4307 January 23, 2023

The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users… Full details

MEDIUM 6.1

CVE-2022-4305 January 23, 2023

The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid… Full details

CRITICAL 9.8

CVE-2022-4303 January 23, 2023

The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms. Full details

HIGH 7.5

CVE-2022-4230 January 23, 2023

The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manage_options… Full details

HIGH 8.8

CVE-2022-4017 January 23, 2023

The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely… Full details

HIGH 8.8

CVE-2022-3811 January 23, 2023

The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks… Full details

MEDIUM 4.8

CVE-2022-3425 January 23, 2023

The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. Full details

HIGH 7.2

CVE-2022-0316 January 23, 2023

The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from… Full details

CRITICAL 9.8

CVE-2021-24881 January 23, 2023

The Passster WordPress plugin before 3.5.5.9 does not properly check for password, as well as that the post to be viewed is public, allowing unauthenticated users to bypass the protection offered by the plugin,… Full details

HIGH 7.5

CVE-2021-24837 January 23, 2023

The Passster WordPress plugin before 3.5.5.8 does not escape the area parameter of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. Full details

MEDIUM 5.4

CVE-2023-23492 January 20, 2023

The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action. Full details

HIGH 8.8

CVE-2023-23491 January 20, 2023

The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' parameter of its 'qem_ajax_calendar' action. Full details

MEDIUM 6.1

CVE-2023-23490 January 20, 2023

The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action. Full details

HIGH 8.8

CVE-2023-23489 January 20, 2023

The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action. Full details

CRITICAL 9.8

CVE-2023-23488 January 20, 2023

The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route. Full details

CRITICAL 9.8

CVE-2023-0404 January 19, 2023

The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes… Full details

MEDIUM 5.4

CVE-2023-0403 January 19, 2023

The Social Warfare plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on several AJAX actions. This makes… Full details

MEDIUM 5.4

CVE-2023-0402 January 19, 2023

The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated… Full details

MEDIUM 5.4

CVE-2023-0385 January 18, 2023

The Custom 404 Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.7.1. This is due to missing or incorrect nonce validation on the custom_404_pro_admin_init function. This… Full details

MEDIUM 4.3

CVE-2022-4658 January 16, 2023

The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Full details

MEDIUM 5.4

CVE-2022-4655 January 16, 2023

The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site… Full details

MEDIUM 5.4

CVE-2022-4653 January 16, 2023

The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. Full details

MEDIUM 5.4

CVE-2022-4648 January 16, 2023

The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4578 January 16, 2023

The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as… Full details

MEDIUM 5.4

CVE-2022-4571 January 16, 2023

The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details

MEDIUM 5.4

CVE-2022-4549 January 16, 2023

The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Full details

MEDIUM 4.3

CVE-2022-4547 January 16, 2023

The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by [high privilege… Full details

HIGH 7.2

CVE-2022-4544 January 16, 2023

The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor… Full details

MEDIUM 5.4

CVE-2022-4508 January 16, 2023

The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a… Full details

MEDIUM 5.4

CVE-2022-4507 January 16, 2023

The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details

MEDIUM 5.4

CVE-2022-4487 January 16, 2023

The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4486 January 16, 2023

The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4484 January 16, 2023

The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users… Full details

MEDIUM 5.4

CVE-2022-4483 January 16, 2023

The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4482 January 16, 2023

The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a… Full details

MEDIUM 5.4

CVE-2022-4481 January 16, 2023

The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4480 January 16, 2023

The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details

MEDIUM 5.4

CVE-2022-4478 January 16, 2023

The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4477 January 16, 2023

The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role… Full details

MEDIUM 5.4

CVE-2022-4476 January 16, 2023

The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4469 January 16, 2023

The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4465 January 16, 2023

The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low… Full details

MEDIUM 5.4

CVE-2022-4464 January 16, 2023

Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4460 January 16, 2023

The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as… Full details

MEDIUM 5.4

CVE-2022-4453 January 16, 2023

The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4

CVE-2022-4451 January 16, 2023

The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as… Full details

MEDIUM 5.4