Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,543 results · page 138 of 391
Jun 30, 2022PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests.CVE-2022-23719 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comHigh 7.2
PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 30, 2022Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/CVE-2022-34818 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
- Product
- Jenkins Failed Job Deactivator Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReaCVE-2022-34814 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
- Product
- Jenkins Request Rename Or Delete Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permiCVE-2022-34798 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
- Product
- Jenkins Deployment Dashboard Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scriCVE-2022-34795 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
- Product
- Jenkins Deployment Dashboard Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-34793 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins Recipe Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scriCVE-2022-34791 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Validating Email Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulneraCVE-2022-34790 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins eXtreme Feedback Panel Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability explCVE-2022-34788 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
- Product
- Jenkins Matrix Reloaded Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulCVE-2022-34787 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control the reason a queue item is blocked.
- Product
- Jenkins Project Inheritance Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS)CVE-2022-34786 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
- Product
- Jenkins Rich Text Publisher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to oCVE-2022-34785 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
- Product
- Jenkins build-metrics Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploCVE-2022-34784 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.
- Product
- Jenkins build-metrics Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackerCVE-2022-34783 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Plot Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-CVE-2022-34777 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins GitLab Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack.CVE-2020-26877 · Other software · Apifest · reported by MITREMedium 6.1
ApiFest OAuth 2.0 Server 0.3.1 does not validate the redirect URI in accordance with RFC 6749 and is susceptible to an open redirector attack. Specifically, it directly sends an authorization code to the redirect URI submitted with the authorization request, without checking whether the redirect URI is registered by the client who initiated the request. This allows an attacker to craft a request with a manipulated redirect URI (redirect_uri parameter), which is under the attacker's control, and consequently obtain the leaked authorization code when the server redirects the client to the manipulated redirect URI with an authorization code. NOTE: this is similar to CVE-2019-3778.
- Product
- Oauth 2.0 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022DCMTK through 3.6.6 does not handle memory free properly.CVE-2021-41690 · Other software · Offis · reported by MITREHigh 7.5
DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack.
- Product
- Dcmtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022DCMTK through 3.6.6 does not handle string copy properly.CVE-2021-41689 · Other software · dcmtk · reported by MITREHigh 7.5
DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.
- Product
- dcmtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022DCMTK through 3.6.6 does not handle memory free properly.CVE-2021-41688 · Other software · Offis · reported by MITREHigh 7.5
DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack.
- Product
- Dcmtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022DCMTK through 3.6.6 does not handle memory free properly.CVE-2021-41687 · Other software · Offis · reported by MITREHigh 7.5
DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack.
- Product
- Dcmtk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.CVE-2022-2140 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 8.8
Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.
- Product
- SmartICS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attackCVE-2022-2106 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govLow 3.8
Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.
- Product
- SmartICS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022Brizy: Does not sanitise and escape some element contentCVE-2022-2041 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- Brizy
- Fixed in
- 2.4.2
- What to do
- Update Brizy to 2.4.2 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Jun 27, 2022Brizy: Does not sanitise and escape some element URLCVE-2022-2040 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- Brizy
- Fixed in
- 2.4.2
- What to do
- Update Brizy to 2.4.2 or newer.
Full record and what to do →NVD recordwpscan.comfortiguard.com
Jun 27, 2022Malware Scanner: Does not sanitise and escape some of its settingsCVE-2022-1995 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- Malware Scanner
- Fixed in
- 4.5.2
- What to do
- Update Malware Scanner to 4.5.2 or newer.
Jun 27, 2022Login With OTP Over SMS, Email, WhatsApp and Google Authenticator: Does not escape its settingsCVE-2022-1994 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Login With OTP Over SMS, Email, WhatsApp and Google Authenticator
- Fixed in
- 1.0.8
- What to do
- Update Login With OTP Over SMS, Email, WhatsApp and Google Authenticator to 1.0.8 or newer.
Jun 27, 2022Nested Pages: Does not escape and sanitize the some of its settingsCVE-2022-1990 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltered_html is disallowed
- Product
- Nested Pages
- Fixed in
- 3.1.21
- What to do
- Update Nested Pages to 3.1.21 or newer.
Jun 27, 2022Import Export All WordPress Images, Users & Post Types: Does not fully validate the file to be imported via an URL before making an HTTP request to itCVE-2022-1977 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks
- Product
- Import Export All WordPress Images, Users & Post Types
- Fixed in
- 6.5.3
- What to do
- Update Import Export All WordPress Images, Users & Post Types to 6.5.3 or newer.
Jun 27, 2022NextCellent Gallery: Does not sanitise and escape some of its image settingsCVE-2022-1971 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- NextCellent Gallery
- Affected
- up to 1.9.35
- What to do
- Affects up to 1.9.35. Update NextCellent Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Easy SVG Support: Does not sanitise uploaded SVG filesCVE-2022-1964 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
- Product
- Easy SVG Support
- Fixed in
- 3.3.0
- What to do
- Update Easy SVG Support to 3.3.0 or newer.
Jun 27, 2022MyCSS: Does not have CSRF check in placeCVE-2022-1960 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- MyCSS
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MyCSS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: Does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenCVE-2022-1916 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected cross-Site Scripting
- Product
- Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
- Fixed in
- 1.0.5
- What to do
- Update Active Products Tables for WooCommerce. Professional products tables for WooCommerce store to 1.0.5 or newer.
Jun 27, 2022Clean-Contact: Does not have CSRF check in placeCVE-2022-1914 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS due to the lack of sanitisation and escaping as well
- Product
- Clean-Contact
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Clean-Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Add Post URL: Does not have CSRF check in placeCVE-2022-1913 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
- Product
- Add Post URL
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Add Post URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Pricing Tables: Does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated)CVE-2022-1904 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any user (both authenticated and unauthenticated) when a specific setting is enabled, leading to a Reflected Cross-Site Scripting
- Product
- Pricing Tables
- Fixed in
- 3.2.1
- What to do
- Update Pricing Tables to 3.2.1 or newer.
Jun 27, 2022Cimy Header Image Rotator: Does not have CSRF check in placeCVE-2022-1885 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Cimy Header Image Rotator
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update Cimy Header Image Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Rotating Posts: Does not have CSRF check in placeCVE-2022-1847 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Rotating Posts
- Affected
- up to 1.11
- What to do
- Affects up to 1.11. Update Rotating Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Tiny Contact Form: Does not have CSRF check in placeCVE-2022-1846 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Tiny Contact Form
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Tiny Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022WP Post Styling: Does not have CSRF checks in various actionsCVE-2022-1845 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks
- Product
- WP Post Styling
- Fixed in
- 1.3.1
- What to do
- Update WP Post Styling to 1.3.1 or newer.
Jun 27, 2022WP Sentry: Does not have CSRF check in placeCVE-2022-1844 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- WP Sentry
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update WP Sentry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022MailPress: Does not have CSRF checks in various placesCVE-2022-1843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks
- Product
- MailPress
- Affected
- up to 7.2.1
- What to do
- Affects up to 7.2.1. Update MailPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022OpenBook Book Data: Does not have CSRF check in placeCVE-2022-1842 · WordPress plugins & themes · reported by WPScanMedium 4.3
The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- OpenBook Book Data
- Affected
- up to 3.5.2
- What to do
- Affects up to 3.5.2. Update OpenBook Book Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022Popups, Welcome Bar, Optins and Lead Generation: Does not sanitize and escape some campaign parametersCVE-2022-1776 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Popups, Welcome Bar, Optins and Lead Generation
- Fixed in
- 2.1.8
- What to do
- Update Popups, Welcome Bar, Optins and Lead Generation to 2.1.8 or newer.
Jun 27, 2022Social Share Buttons by Supsystic: Does not perform CSRF checks in it's ajax endpoints and admin pagesCVE-2022-1653 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks.
- Product
- Social Share Buttons by Supsystic
- Fixed in
- 2.2.4
- What to do
- Update Social Share Buttons by Supsystic to 2.2.4 or newer.
Jun 27, 2022My Private Site: Does not have CSRF check in placeCVE-2022-1627 · WordPress plugins & themes · reported by WPScanMedium 4.3
The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- My Private Site
- Fixed in
- 3.0.8
- What to do
- Update My Private Site to 3.0.8 or newer.
Jun 27, 2022New User Approve: Does not have CSRF check in placeCVE-2022-1625 · WordPress plugins & themes · reported by WPScanMedium 4.3
The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.
- Product
- New User Approve
- Fixed in
- 2.4
- What to do
- Update New User Approve to 2.4 or newer.
Jun 27, 2022Site Offline or Coming Soon: Does not have CSRF check in placeCVE-2022-1593 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation as well as escaping in some of them. As a result, attackers could make a logged in admin change them and put Cross-Site Scripting payloads in them via a CSRF attack
- Product
- Site Offline or Coming Soon
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Site Offline or Coming Soon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022HTML2WP: Does not have authorisation and CSRF checksCVE-2022-1574 · WordPress plugins & themes · reported by WPScanCritical 9.8
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022HTML2WP: Does not have CSRF check in placeCVE-2022-1573 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2022HTML2WP: Does not have authorisation and CSRF checks in an AJAX actionCVE-2022-1572 · WordPress plugins & themes · reported by WPScanHigh 8.1
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file
- Product
- HTML2WP
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update HTML2WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.