CVE-2022-40216

CVE-2022-40216 affects the WordPress Better Messages plugin. Affected versions are

CVE-2022-40130 WordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerability

Auth. subscriber+ Race Condition vulnerability in WP-Polls plugin = 2.76.0 on WordPress...

CVE-2022-40130

The CVE-2022-40130 entry documents a race-condition vulnerability in the WordPress WP-Polls plugin, affecting versions up to and including 2.76.0. The issue allows authenticated users (subscriber+ level) to tamper with poll votes due to improper synchronization. Remediation according to the sourc...

CVE-2022-41655

CVE-2022-41655 affects the WordPress plugin Phone Orders for WooCommerce (versions ≤ 3.7.1). The root issue is a sensitive data exposure that is accessible to authenticated users with subscriber-level privileges (and higher). Documented impact is exposure of Auth. (subscriber+) data. The vulnerab...

CVE-2022-41643

CVE-2022-41643 affects the WordPress Accessibility plugin (versions ≤ 1.0.3). The root cause is a stored XSS vulnerability in the plugin’s settings that requires admin+ privileges to exploit. Impact is limited to authenticated users with high privileges; CVSS vectors in the source material indica...

CVE-2022-40963 WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Auth. author+ Stored Cross-Site Scripting XSS vulnerabilities in WP Page Builder plugin = 1.2.6 on WordPress...

CVE-2022-40963

CVE-2022-40963 concerns the WordPress plugin WP Page Builder (versions ≤ 1.2.6). The vulnerability is a Stored XSS in which parameters are not properly sanitized/escaped, enabling authenticated users with Author+ privileges to inject scripts. Impact is cross-site scripting within WordPress pages ...

CVE-2022-42459

CVE-2022-42459 affects the WordPress Image Hover Effects Ultimate plugin (versions

CVE-2022-42459 WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability

Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin = 9.7.1 on WordPress...

CVE-2022-45082

The CVE-2022-45082 entries describe stored XSS in WordPress Accordions plugin versions

WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability

Auth. Broken Access Control vulnerability leading to arbitrary feed creation discovered by Tien Nguyen Anh Patchstack Alliance in the WordPress Plugin for Google Reviews plugin versions = 2.2.2. Solution Update the WordPress Plugin for Google Reviews plugin to the latest available version at leas...

Cross site scripting

Auth. Stored Cross-Site Scripting XSS vulnerability in Ezoic plugin = 2.8.8 on WordPress...

CVE-2022-45069

CVE-2022-45069 affects the WordPress Crowdsignal Dashboard plugin, versions

CVE-2022-44736

The CVE-2022-44736 entry describes a stored XSS vulnerability in the WordPress Chameleon plugin, affecting versions 1.4.3 and earlier. The root cause is improper sanitisation/escaping of settings, enabling authenticated (admin+) users to inject script into stored fields. Impact is limited to admi...

CVE-2022-41791

The CVE-2022-41791 entry concerns an authenticated CSV Injection vulnerability in the WordPress ProfileGrid plugin, affecting versions up to 5.1.6. The vulnerability is tied to ProfileGrid’s handling of CSV uploads/exports, with an impact that, per connected reports, can enable change-authorizati...

CVE-2022-41791 WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

Auth. subscriber+ CSV Injection vulnerability in ProfileGrid plugin = 5.1.6 on WordPress...

CVE-2021-36905 WordPress Quiz And Survey Master plugin <= 7.3.4 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Auth. contributor+ Stored Cross-Site Scripting XSS vulnerabilities in Quiz And Survey Master plugin = 7.3.4 on WordPress...

CVE-2021-36905

The CVE-2021-36905 entry describes a stored XSS vulnerability in the WordPress Quiz And Survey Master plugin (versions

WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

Auth. CSV Injection vulnerability discovered by Mika Patchstack Alliance in the WordPress ProfileGrid plugin versions = 5.1.6. Solution Update the WordPress ProfileGrid plugin to the latest available version at least 5.1.8...

Rocky Linux 8 : dovecot (RLSA-2022:7623)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7623 advisory. - An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args...