CVE-2022-45845

WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextendweb

Products

Smart Slider 3

CVE-2022-45839

WordPress WHA Puzzle Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA WHA Puzzle plugin <= 1.0.9 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webhelpagency

Products

Wha Puzzle

CVE-2022-45835

WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions.This issue affects PhonePe Payment Solutions: from n/a through 1.0.15.

CVSS 3.1 · 5.8 Medium EPSS 37.7% KEV · Not listed

Vendors

Phonepe

Products

Phonepe

CVE-2022-45809

WordPress Thumbs Rating Plugin <= 5.0.0 is vulnerable to Race Condition

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.0.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Quicoto

Products

Thumbs Rating

CVE-2022-45807

WordPress WP Mail Log Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpvibes

Products

Wp Mail Log

CVE-2022-45804

WordPress Robo Gallery Plugin <= 3.2.9 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy change, included plugin deactivate & activate.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Robogallery

Products

Robo Gallery

CVE-2022-45377

WordPress Drag and Drop Multiple File Upload for WooCommerce Plugin <= 1.0.8 is vulnerable to Multiple Vulnerabilities

Unrestricted Upload of File with Dangerous Type vulnerability in Glen Don L. Mongaya Drag and Drop Multiple File Upload for WooCommerce.This issue affects Drag and Drop Multiple File Upload for WooCommerce: from n/a through 1.0.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Codedropz

Products

Drag And Drop Multiple File Upload For Woocommerce

CVE-2022-45365

WordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Stock Ticker allows Reflected XSS.This issue affects Stock Ticker: from n/a through 3.23.2.

CVSS 3.1 · 7.1 High EPSS 49.6% KEV · Not listed

Vendors

Urosevic

Products

Stock Ticker

CVE-2022-45356

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Muffingroup

Products

Betheme

CVE-2022-45354

WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60.

CVSS 3.1 · 5.3 Medium EPSS 38.1% KEV · Not listed

Vendors

Wpchill

Products

Download Monitor

CVE-2022-45362

WordPress Paytm Payment Gateway Plugin <= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.

CVSS 3.1 · 7.2 High EPSS 42.0% KEV · Not listed

Vendors

Paytm

Products

Payment Gateway

CVE-2022-45353

WordPress Betheme theme <= 26.6.1 is vulnerable to Broken Access Control

Broken Access Control in Betheme theme <= 26.6.1 on WordPress.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Muffingroup

Products

Betheme

CVE-2022-45084

WordPress Loginizer Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Loginizer

Products

Loginizer

CVE-2022-45083

WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.3.2.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Properfraction

Products

Profilepress

CVE-2022-45352

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Muffingroup

Products

Betheme

CVE-2022-45349

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Muffingroup

Products

Betheme

CVE-2022-45351

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Muffingroup

Products

Betheme

CVE-2022-45079

WordPress Loginizer Plugin <= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Loginizer

Products

Loginizer

CVE-2022-45078

WordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Solwininfotech

Products

User Blocker

CVE-2022-45068

WordPress Mercado Pago payments for WooCommerce Plugin <= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mercadopago

Products

Mercado Pago Payments For Woocommerce