Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,523 results · page 131 of 391
Oct 17, 2022Meks Easy Social Share: Does not sanitise and escape some of its settingsCVE-2022-2574 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Meks Easy Social Share WordPress plugin before 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Meks Easy Social Share
- Fixed in
- 1.2.8
- What to do
- Update Meks Easy Social Share to 1.2.8 or newer.
Oct 17, 2022Tutor LMS: Does not escape some course parametersCVE-2022-2563 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Tutor LMS
- Fixed in
- 2.0.10
- What to do
- Update Tutor LMS to 2.0.10 or newer.
Oct 16, 2022Gitea before 1.17.3 does not sanitize and escape refs in the git backend.CVE-2022-42968 · Other software · Gitea · reported by MITRECritical 9.8
Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022Reader.Read does not set a limit on the maximum size of file headers.CVE-2022-2879 · Other software · Go standard library · reported by security@golang.orgHigh 7.5
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
- Product
- archive/tar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well.CVE-2022-41209 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.2
SAP Customer Data Cloud (Gigya mobile app for Android) - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks.
- Product
- SAP Customer Data Cloud (Gigya)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Oct 11, 2022The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being served to other userCVE-2022-35297 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being served to other users, thereby expanding the attack scope, resulting in Stored Cross-Site Scripting (XSS) vulnerability leading to limited impact on Confidentiality, Integrity and Availability.
- Product
- SAP Enable Now
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Oct 10, 2022Advanced Comment Form: Does not sanitise and escape its settingsCVE-2022-3220 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Advanced Comment Form
- Fixed in
- 1.2.1
- What to do
- Update Advanced Comment Form to 1.2.1 or newer.
Oct 10, 2022soledad: Does not sanitise the {idCVE-2022-3209 · WordPress plugins & themes · reported by WPScanMedium 6.1
The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
- Product
- soledad
- Fixed in
- 8.2.5
- What to do
- Update soledad to 8.2.5 or newer.
Oct 10, 2022Simple File List: Does not implement nonce checksCVE-2022-3208 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack.
- Product
- Simple File List
- Fixed in
- 4.4.12
- What to do
- Update Simple File List to 4.4.12 or newer.
Oct 10, 2022Simple File List: Does not sanitise and escape some of its settingsCVE-2022-3207 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple File List
- Fixed in
- 4.4.12
- What to do
- Update Simple File List to 4.4.12 or newer.
Oct 10, 2022Taskbuilder: Does not validate and sanitise task's attachmentsCVE-2022-3137 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file
- Product
- Taskbuilder
- Fixed in
- 1.0.8
- What to do
- Update Taskbuilder to 1.0.8 or newer.
Oct 10, 2022Social Rocket: Does not sanitise and escape some of its settingsCVE-2022-3136 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Rocket
- Fixed in
- 1.3.3
- What to do
- Update Social Rocket to 1.3.3 or newer.
Oct 10, 2022IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the CVE-2022-34334 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 229704.
- Product
- Sterling Partner Engagement Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 10, 2022Download Monitor: Does not ensure that files to be downloaded are inside the blog foldersCVE-2022-2981 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened environment or multisite setup.
- Product
- Download Monitor
- Fixed in
- 4.5.98
- What to do
- Update Download Monitor to 4.5.98 or newer.
Oct 10, 2022Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its Gallery Image parametersCVE-2022-2823 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Slider, Gallery, and Carousel by MetaSlider
- Fixed in
- 3.27.9
- What to do
- Update Slider, Gallery, and Carousel by MetaSlider to 3.27.9 or newer.
Oct 10, 2022Top Bar: Does not sanitise and escape some of its settings before outputting them in frontend pagesCVE-2022-2629 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Top Bar
- Fixed in
- 3.0.4
- What to do
- Update Top Bar to 3.0.4 or newer.
Oct 10, 2022Enable Media Replace: Does not ensure that renamed files are moved to the Upload folderCVE-2022-2554 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example
- Product
- Enable Media Replace
- Fixed in
- 4.0.0
- What to do
- Update Enable Media Replace to 4.0.0 or newer.
Oct 10, 2022reSmush.it: Does not sanitise and escape some of its settingsCVE-2022-2448 · WordPress plugins & themes · reported by WPScanMedium 4.8
The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- reSmush.it
- Fixed in
- 0.4.6
- What to do
- Update reSmush.it to 0.4.6 or newer.
Oct 10, 2022Disable User Login: Does not have authorisation and CSRF checksCVE-2022-2350 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attackers to block (or unblock) users at will.
- Product
- Disable User Login
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Disable User Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2022Cryptocurrency Pricing list and Ticker: Does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embedCVE-2021-25044 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpw_setpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue
- Product
- Cryptocurrency Pricing list and Ticker
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Cryptocurrency Pricing list and Ticker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 7, 2022IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the systeCVE-2022-41291 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 236699.
- Product
- InfoSphere Information Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 7, 2022IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information disclosure.CVE-2022-22480 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information disclosure. IBM X-Force ID: 225889.
- Product
- QRadar SIEM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 3, 2022Goolytics: Does not sanitise and escape some of its settingsCVE-2022-3132 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Goolytics
- Fixed in
- 1.1.2
- What to do
- Update Goolytics to 1.1.2 or newer.
Oct 3, 2022Donation Thermometer: Does not sanitise and escape some of its settingsCVE-2022-3128 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Donation Thermometer
- Fixed in
- 2.1.3
- What to do
- Update Donation Thermometer to 2.1.3 or newer.
Oct 3, 2022Zephyr Project Manager: Does not have any authorisationCVE-2022-2839 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
- Product
- Zephyr Project Manager
- Fixed in
- 3.2.55
- What to do
- Update Zephyr Project Manager to 3.2.55 or newer.
Oct 3, 2022WP Socializer: Does not sanitise and escape some of its Icons settingsCVE-2022-2763 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Socializer WordPress plugin before 7.3 does not sanitise and escape some of its Icons settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Socializer
- Fixed in
- 7.3
- What to do
- Update WP Socializer to 7.3 or newer.
Oct 3, 2022DSGVO All in one for WP: Does not sanitise and escape some of its settingsCVE-2022-2628 · WordPress plugins & themes · reported by WPScanMedium 4.8
The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DSGVO All in one for WP
- Fixed in
- 4.2
- What to do
- Update DSGVO All in one for WP to 4.2 or newer.
Sep 30, 2022sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack.CVE-2022-2529 · Other software · Cloudflare · reported by cna@cloudflare.comHigh 7.5
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
- Product
- goflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when inCVE-2022-41828 · Other software · Amazon · reported by MITREHigh 8.1
In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Factory does not check the class type when instantiating an object from a class name.
- Product
- Amazon Web Services Redshift Java Database Connectivity Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.CVE-2020-27602 · Other software · Bigbluebutton · reported by MITRECritical 9.8
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats.CVE-2020-27601 · Other software · Bigbluebutton · reported by MITRELow 3.5
In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resCVE-2022-2760 · Other software · Octopus Deploy · reported by security@octopus.comMedium 4.3
In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have access to view in an error message when a resource is part of another Space.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Sep 28, 2022The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “AdCVE-2022-32170 · Other software · bytebase · reported by vulnerabilitylab@mend.ioMedium 4.3
The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userId}”.
- Product
- bytebase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues CVE-2022-32169 · Other software · bytebase · reported by vulnerabilitylab@mend.ioMedium 4.3
The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.
- Product
- bytebase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022SEO Smart Links: Does not sanitise and escape some of its settingsCVE-2022-3135 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SEO Smart Links
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update SEO Smart Links to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022OAuth client Single Sign On: Does not have authorisation and CSRFCVE-2022-3119 · WordPress plugins & themes · reported by WPScanHigh 7.5
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address
- Product
- OAuth client Single Sign On
- Fixed in
- 3.0.4
- What to do
- Update OAuth client Single Sign On to 3.0.4 or newer.
Sep 26, 2022Login Block IPs: Does not have CSRF check in placeCVE-2022-3098 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Login Block IPs
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Login Block IPs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Slider Hero: Does not escape the slider NameCVE-2022-3074 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
- Product
- Slider Hero
- Fixed in
- 8.4.4
- What to do
- Update Slider Hero to 8.4.4 or newer.
Sep 26, 2022Generate PDF: Does not sanitise and escape its settingsCVE-2022-3070 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Generate PDF
- Fixed in
- 3.6
- What to do
- Update Generate PDF to 3.6 or newer.
Sep 26, 2022WordLift: Does not sanitise and escape its settingsCVE-2022-3069 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordLift
- Fixed in
- 3.37.2
- What to do
- Update WordLift to 3.37.2 or newer.
Sep 26, 2022Simple File List: Does not escape parameters before outputting them back in attributesCVE-2022-3062 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
- Product
- Simple File List
- Fixed in
- 4.4.12
- What to do
- Update Simple File List to 4.4.12 or newer.
Sep 26, 2022Bitcoin / Altcoin Faucet: Does not have any CSRF checkCVE-2022-3025 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- Bitcoin / Altcoin Faucet
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Bitcoin / Altcoin Faucet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Simple Bitcoin Faucets: Does not have any authorisation and CSRF in an AJAX actionCVE-2022-3024 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
- Product
- Simple Bitcoin Faucets
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update Simple Bitcoin Faucets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 26, 2022Ldap WP Login / Active Directory Integration: Does not have any authorisation and CSRF checksCVE-2022-2987 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication
- Product
- Ldap WP Login / Active Directory Integration
- Fixed in
- 3.0.2
- What to do
- Update Ldap WP Login / Active Directory Integration to 3.0.2 or newer.
Sep 26, 2022Download Manager: Does not validate one of its settingsCVE-2022-2926 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory
- Product
- Download Manager
- Fixed in
- 3.2.55
- What to do
- Update Download Manager to 3.2.55 or newer.
Sep 26, 2022WP Popup Builder: Does not have authorisation and CSRF check in an AJAX actionCVE-2022-2405 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subscribers to delete arbitrary Popup
- Product
- WP Popup Builder
- Fixed in
- 1.2.9
- What to do
- Update WP Popup Builder to 1.2.9 or newer.
Sep 26, 2022WP Popup Builder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-2404 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- WP Popup Builder
- Fixed in
- 1.2.9
- What to do
- Update WP Popup Builder to 1.2.9 or newer.
Sep 26, 2022Post SMTP Mailer/Email Log: Does not have proper authorisation in some AJAX actionsCVE-2022-2352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
- Product
- Post SMTP Mailer/Email Log
- Fixed in
- 2.1.7
- What to do
- Update Post SMTP Mailer/Email Log to 2.1.7 or newer.
Sep 26, 2022SVG Support: Does not properly handle SVG added via an URLCVE-2022-1755 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks
- Product
- SVG Support
- Fixed in
- 2.5
- What to do
- Update SVG Support to 2.5 or newer.
Sep 26, 2022Scripts Organizer: Does not have capability and CSRF checks in the saveScript AJAX actionCVE-2021-24890 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file
- Product
- Scripts Organizer
- Fixed in
- 3.0
- What to do
- Update Scripts Organizer to 3.0 or newer.
Full record and what to do →NVD recorddplugins.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.