CVE-2022-45067

WordPress Exclusive Addons Elementor Plugin <= 2.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in DevsCred Exclusive Addons Elementor plugin <= 2.6.1 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Devscred

Products

Exclusive Addons For Elementor

CVE-2022-44595

WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability

Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Melapress

Products

Wp 2fa

CVE-2022-44633

WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerability

Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2022-44590

WordPress Simple Video Embedder plugin <= 2.2 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Simple Video Embedder Project

Products

Simple Video Embedder

CVE-2022-44626

WordPress Squirrly SEO (Peaks) plugin <= 12.1.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Squirrly

Products

Seo Plugin By Squirrly Seo

CVE-2022-44589

WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Google Authenticator

CVE-2022-44629

WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Catalystconnect

Products

Catalyst Connect Zoho Crm Client Portal

CVE-2022-44628

WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jumpdemand

Products

4ecps Web Forms

CVE-2022-43480

WordPress Homepage Pop-up Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Magneticlab

Products

Homepage Pop-up

CVE-2022-42884

WordPress WIP Custom Login Plugin <= 1.2.7 is vulnerable to Broken Access Control

Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Themeinprogress

Products

Wip Custom Login

CVE-2022-43450

WordPress Stream Plugin <= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xwp

Products

Stream

CVE-2022-42888

WordPress ARMember Plugin <= 5.5.1 is vulnerable to Privilege Escalation

Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Armemberplugin

Products

Armember

CVE-2022-42699

WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)

Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.

CVSS 3.1 · 9.1 Critical EPSS 1.5% KEV · Not listed

Vendors

Wp-ecommerce

Products

Easy Wp Smtp

CVE-2022-41990

WordPress 3D Tag Cloud Plugin <= 3.8 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza 3D Tag Cloud allows Stored XSS.This issue affects 3D Tag Cloud: from n/a through 3.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cardozatechnologies

Products

Cardoza-3d-tag-cloud

CVE-2022-41791

WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Metagauss

Products

Profilegrid

CVE-2022-41786

WordPress WP Job Portal Plugin <= 2.0.1 is vulnerable to Broken Access Control

Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpjobportal

Products

Wp Job Portal

CVE-2022-41685

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szállítási címkék WooCommerce-hez plugin <= 1.9.0.2 on WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Visztpeter

Products

Integration For Szamlazz.hu \& Woocommerce Package Points And Shipping Labels For Woocommerce

CVE-2022-41790

WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control

Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Wp Time Slots Booking Form

CVE-2022-41695

WordPress Traffic Manager Plugin <= 1.4.5 is vulnerable to Broken Access Control

Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Sedlex

Products

Traffic Manager

CVE-2022-41698

WordPress If Menu – Visibility control for Menus plugin <= 0.16.3 - Broken Access Control

Missing Authorization vulnerability in Layered If Menu.This issue affects If Menu: from n/a through 0.16.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress