CVE-2022-41619

WordPress Image Zoom Plugin <= 1.8.8 is vulnerable to Broken Access Control

Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Sedlex

Products

Image Zoom

CVE-2022-40700

Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Agence-press Arcstone Deano and 9 more

Products

Css Adder Amo For Wp - Membership Management Amp Toolbox and 12 more

CVE-2022-40975

WordPress Post Slider plugin <= 1.6.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Aazztech Post Slider.This issue affects Post Slider: from n/a through 1.6.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2022-40702

WordPress Advanced Local Pickup for WooCommerce Plugin <= 1.5.2 is vulnerable to Broken Access Control

Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.5.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Zorem

Products

Advanced Local Pickup For Woocommerce

CVE-2022-40696

WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Advancedcustomfields

Products

Advanced Custom Fields

CVE-2022-40692

WordPress Sunshine Photo Cart Plugin <= 2.9.13 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Sunshinephotocart

Products

Sunshine Photo Cart

CVE-2022-40312

WordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2022-40216

WordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability

Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordplus

Products

Better Messages

CVE-2022-40203

WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.1.5 is vulnerable to Broken Access Control

Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through 4.1.5.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Algolplus

Products

Advanced Dynamic Pricing For Woocommerce

CVE-2022-40193

WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Brinidesigner

Products

Awesome Filterable Portfolio

CVE-2022-38141

WordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access Control

Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zorem

Products

Sales Report Email For Woocommerce

CVE-2022-38074

WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection

SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Veronalabs

Products

Wp Statistics

CVE-2022-38079

WordPress Backup Scheduler plugin <= 1.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Backup Scheduler Project

Products

Backup Scheduler

CVE-2022-38057

WordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerability

Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themehunk

Products

Advanced Wordpress Search Th Advance Product Search

CVE-2022-38055

WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue affects wpForo Forum: from n/a through 2.0.9.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gvectors

Products

Wpforo Forum

CVE-2022-38063

WordPress Social Login WP Plugin <= 5.0.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Social Login Wp Project

Products

Social Login Wp

CVE-2022-36418

WordPress HREFLANG Tags Lite Plugin <= 2.0.0 is vulnerable to Broken Authentication

Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dcgws

Products

Hreflang Tags Lite

CVE-2022-36387

WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability

Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.

CVSS 3.1 · 7.6 High EPSS 1.0% KEV · Not listed

Vendors

About-me Project

Products

About-me

CVE-2022-36399

WordPress Booked Plugin < 2.4.4 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Boxystudio

Products

Booked

CVE-2022-36388

WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ydesignservices

Products

Yds Support Ticket System