Archive

18 November 2022

Vulnerabilities first published on this day (UTC), newest first.

← October 2022 2022 / November /18 December 2022 →

All Critical High Medium Low Exploited only Public exploit

105 results · Feed

Medium 6.4

CVE-2022-41609

WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability

Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress.

wordplus Better Messages (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.3

CVE-2022-41155

WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability

Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress.

Pascal iQ Block Country (WordPress) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-40216

WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability

Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.

wordplus Better Messages (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-40130

WordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerability

Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress.

Lester 'GaMerZ' Chan WP-Polls (WordPress plugin) Web / CMS

Nov 18, 2022
Low 3.7

CVE-2022-41618

WordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerability

Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.

David Lingren Media Library Assistant (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 6.1

CVE-2022-41615

WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.

Agile Logix Store Locator WordPress (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-41634

WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

Max Foundry Media Library Folders (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 6.5

CVE-2022-41135

WordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability

Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.

WP Chill Modula Image Gallery (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-41655

WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability

Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress.

Algolplus Phone Orders for WooCommerce (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.8

CVE-2022-41643

WordPress Accessibility plugin <= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress.

Octa Code Accessibility (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.8

CVE-2022-40963

WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress.

Themeum WP Page Builder (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-41685

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

Viszt Péter Integration for Szamlazz.hu & WooCommerce (WordPress plugin) Csomagpontok és szállítási címkék WooCommerce-hez (WordPress plugin) Web / CMS

Nov 18, 2022
High 7.2

CVE-2022-42459

WordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability

Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.

Biplob Adhikari Image Hover Effects Ultimate (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-40695

WordPress SEO Redirection Plugin plugin <= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities

Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.

wp-buy SEO Redirection Plugin – 301 Redirect Manager (WordPress plugin) Web / CMS

Nov 18, 2022
Critical 9.8

CVE-2022-42698

WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary File Upload vulnerability

Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.

API2Cart Api2Cart Bridge Connector (WordPress plugin) Web / CMS

Nov 18, 2022
Critical 10.0

CVE-2022-42497

WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.

API2Cart Api2Cart Bridge Connector (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-41788

WordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress.

PenciDesign Soledad (WordPress theme) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-43492

WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability

Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress.

gVectors Team Comments – wpDiscuz (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-44740

WordPress Creative Mail plugin <= 1.5.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.

Constant Contact Creative Mail (WordPress plugin) Web / CMS

Nov 18, 2022
High 7.5

CVE-2022-44583

WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability

Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.

WhatArmy WatchTowerHQ (WordPress plugin) Web / CMS

Nov 18, 2022
Critical 9.1

CVE-2022-44584

WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Deletion vulnerability

Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.

WhatArmy WatchTowerHQ (WordPress plugin) Web / CMS

Nov 18, 2022
Low 3.4

CVE-2022-45082

WordPress Accordions plugin <= 2.0.3 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin <= 2.0.3 on WordPress via &addons-style-name and &accordions_or_faqs_license_key.

Biplob Adhikari Accordions – Multiple Accordions or FAQs Builder (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.9

CVE-2022-44634

WordPress S2W – Import Shopify to WooCommerce plugin <= 1.1.12 - Auth. Arbitrary File Read vulnerability

Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress.

villatheme S2W – Import Shopify to WooCommerce (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-45369

WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability

Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress.

richplugins Plugin for Google Reviews (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.3

CVE-2022-41839

WordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings.

WPBrigade LoginPress | Custom Login Page Customizer (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.3

CVE-2022-42883

WordPress Quiz And Survey Master plugin <= 7.3.10 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress.

ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-40698

WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability

Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-45073

WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.

miniOrange WordPress REST API Authentication (WordPress plugin) Web / CMS

Nov 18, 2022
High 7.8

CVE-2022-38395

HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Pe…

HP HP Support Assistant

Nov 18, 2022
High 7.5

CVE-2022-2794

Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.

HP Certain HP PageWide Pro printers

Nov 18, 2022
Medium 5.4

CVE-2022-42461

WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

miniOrange miniOrange's Google Authenticator (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-43482

WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerability

Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.

codepeople Appointment Booking Calendar (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 6.5

CVE-2022-41781

WordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerability

Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.

Maciej Bis Permalink Manager Lite

Nov 18, 2022
Medium 6.1

CVE-2022-38075

WordPress Mantenimiento web plugin <= 0.13 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.

Carlos Doral Mantenimiento web (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.3

CVE-2022-41692

WordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerability

Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.

codepeople Appointment Hour Booking (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 4.8

CVE-2022-43463

WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.9 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress.

YIKES Custom Product Tabs for WooCommerce (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-40687

WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

Constant Contact Creative Mail (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-41805

WordPress Booster for WooCommerce plugin <= 5.6.6 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress.

Pluggabl Booster for WooCommerce (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 5.4

CVE-2022-40686

WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

Constant Contact Creative Mail (WordPress plugin) Web / CMS

Nov 18, 2022
Medium 6.5

CVE-2022-41652

WordPress Quiz And Survey Master plugin <= 7.3.10 - Bypass vulnerability

Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.

ExpressTech Systems Quiz And Survey Master (WordPress plugin) Web / CMS

Nov 18, 2022