Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

978 results · page 14 of 20

Jul 7, 2022AdminLTE is a Pi-hole Dashboard for stats and configuration.CVE-2022-31029 · Other software · pi-hole · reported by GitHubMedium 5.9
AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XSS")</script>` in the field marked with "Domain to look for" and hitting <kbd>enter</kbd> (or clicking on any of the buttons) will execute the script. The user must be logged in to use this vulnerability. Usually only administrators have login access to pi-hole, minimizing the risks. Users are advised to upgrade. There are no known workarounds for this issue.
Product
AdminLTE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 30, 2022Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be CVE-2022-34799 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Product
Jenkins Deployment Dashboard Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
Jun 30, 2022Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permiCVE-2022-34798 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified credentials.
Product
Jenkins Deployment Dashboard Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
Jun 30, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specifiedCVE-2022-34797 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to connect to an attacker-specified HTTP URL using attacker-specified credentials.
Product
Jenkins Deployment Dashboard Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
Jun 30, 2022A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs CVE-2022-34796 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Product
Jenkins Deployment Dashboard Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
Jun 30, 2022Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scriCVE-2022-34795 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
Product
Jenkins Deployment Dashboard Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
Jun 24, 2022XSS in /dashboard/blocks/stacks/view_details/ - old browsers only.CVE-2022-30120 · Other software · Concretecms · reported by support@hackerone.comMedium 6.1
XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output. Credit to Credit to Bogdan Tiron from FORTBRIDGE (https://www.fortbridge.co.uk/ ) for reporting
Product
Concrete CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.concretecms.org documentation.concretecms.org
Jun 24, 2022XSS in /dashboard/reports/logs/view - old browsers only.CVE-2022-30119 · Other software · Concretecms · reported by support@hackerone.comMedium 6.1
XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.
Product
Concrete CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.concretecms.org documentation.concretecms.org
Jun 24, 2022Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS proCVE-2022-30118 · Other software · Concretecms · reported by support@hackerone.comMedium 6.1
Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.
Product
Concrete CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.concretecms.org documentation.concretecms.org
Jun 24, 2022A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1.CVE-2017-20092 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely.
Product
Google Analytics Dashboard Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org vuldb.com
Jun 17, 2022Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI.CVE-2022-32276 · Other software · Grafana · reported by MITREHigh 7.5
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability
Product
Grafana
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 15, 2022Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a CVE-2022-32154 · Other software · Splunk, Inc · reported by prodsec@splunk.comMedium 6.8
Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will.
Product
Splunk Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.splunk.com docs.splunk.com
Jun 8, 2022Note Press: Does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboardCVE-2022-1688 · WordPress plugins & themes · reported by WPScanLow 2.7
The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections
Product
Note Press
Affected
up to 0.1.10
What to do
Affects up to 0.1.10. Update Note Press to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record bulletin.iese.de wpscan.com
Jun 6, 2022Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/..CVE-2022-32275 · Other software · grafana · reported by MITREHigh 7.5
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content
Product
grafana
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 30, 2022HPB Dashboard: Does not sanitise and escape some of its settingsCVE-2022-1542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
HPB Dashboard
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update HPB Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Fast Flow: Does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboardCVE-2022-1269 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Fast Flow
Fixed in
1.2.12
What to do
Update Fast Flow to 1.2.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Content Egg: Does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboardCVE-2022-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Content Egg
Fixed in
5.3.0
What to do
Update Content Egg to 5.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2022Advanced Page Visit Counter: Does not sanitise and escape some input before outputting it in an admin dashboard pageCVE-2021-25086 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it
Product
Advanced Page Visit Counter
Fixed in
6.1.2
What to do
Update Advanced Page Visit Counter to 6.1.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 28, 2022Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main pCVE-2021-43932 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govCritical 9
Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page.
Product
SmartPTT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 27, 2022IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of CVE-2021-29776 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of that user. IBM X-Force ID: 203030.
Product
QRadar SIEM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Apr 25, 2022Pricing Table by Supsystic: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46782 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table by Supsystic WordPress plugin before 1.9.5 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Pricing Table by Supsystic
Fixed in
1.9.5
What to do
Update Pricing Table by Supsystic to 1.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Coming Soon by Supsystic: Does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46781 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Coming Soon by Supsystic
Fixed in
1.7.6
What to do
Update Coming Soon by Supsystic to 1.7.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 25, 2022Easy Google Maps: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
Product
Easy Google Maps
Fixed in
1.9.32
What to do
Update Easy Google Maps to 1.9.32 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 11, 2022Favicon by RealFaviconGenerator: Does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboardCVE-2022-0471 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Favicon by RealFaviconGenerator
Fixed in
1.3.23
What to do
Update Favicon by RealFaviconGenerator to 1.3.23 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 4, 2022Directus is a real-time API and App dashboard for managing SQL database content.CVE-2022-24814 · Other software · directus · reported by GitHubHigh 8.8
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. This issue was resolved in version 9.7.0. As a workaround, disable the live embed in the what-you-see-is-what-you-get by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface.
Product
directus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 4, 2022Insights from Google PageSpeed: Does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboardCVE-2022-0431 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
Product
Insights from Google PageSpeed
Fixed in
4.0.4
What to do
Update Insights from Google PageSpeed to 4.0.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Apr 1, 2022IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) may be vulnerable to deCVE-2022-22404 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) may be vulnerable to denial of service due to excessive rate limiting.
Product
App Connect Enterprise Certified Container
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Apr 1, 2022A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) toCVE-2022-21947 · Other software · SUSE · reported by meissner@suse.deHigh 8.3
A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V.
Product
Rancher
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.suse.com bugzilla.suse.com
Mar 31, 2022Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) PostCVE-2021-34257 · Other software · Wpanel CMS Project · reported by MITREHigh 8.8
Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
Product
Wpanel CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com latestpcsolution.wordpress.com
Mar 28, 2022Popup Builder: Does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboardCVE-2022-0479 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
Product
Popup Builder
Fixed in
4.1.1
What to do
Update Popup Builder to 4.1.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 28, 2022Pz-LinkCard: Does not sanitise and escape multiple parameters before outputting them back in admin dashboard pagesCVE-2021-25012 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
Product
Pz-LinkCard
Affected
up to 2.4.4.4
What to do
Affects up to 2.4.4.4. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface.CVE-2021-46434 · Other software · Emqx · reported by MITREMedium 5.3
EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the application returns different results depending on whether the account is correct, that allowed an attacker to determine if a given username was valid
Product
Emqx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 15, 2022Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resultiCVE-2022-27213 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
Product
Jenkins Environment Dashboard Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Mar 15, 2022Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scriCVE-2022-27197 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
Product
Jenkins Dashboard View Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Product
WordPress Zero Spam
Fixed in
5.2.11
What to do
Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
Cookie Information | Free GDPR Consent Solution
Fixed in
2.0.8
What to do
Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 14, 2022MOLIE: Does not escape the course_id parameter before outputting it back in the admin dashboardCVE-2021-25006 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Product
MOLIE
Affected
up to 0.5
What to do
Affects up to 0.5. Update MOLIE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 14, 2022Persian Woocommerce: Does not escape the s parameter before outputting it back in an attribute in the admin dashboardCVE-2021-24940 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue
Product
Persian Woocommerce
Affected
up to 5.8.0
What to do
Affects up to 5.8.0. Update Persian Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022WP Cerber Security, Anti-spam & Malware Scan: Does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboardCVE-2022-0429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
Product
WP Cerber Security, Anti-spam & Malware Scan
Fixed in
8.9.6
What to do
Update WP Cerber Security, Anti-spam & Malware Scan to 8.9.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 7, 2022RegistrationMagic: Does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboardCVE-2022-0420 · WordPress plugins & themes · reported by WPScanHigh 7.2
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
Product
RegistrationMagic
Fixed in
5.0.2.2
What to do
Update RegistrationMagic to 5.0.2.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user.CVE-2022-25014 · Other software · Icehrm · reported by MITREMedium 6.1
Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. This vulnerability allows attackers to compromise session credentials via user interaction with a crafted link.
Product
Icehrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 28, 2022WHMCS Bridge: Does not sanitise and escape the error parameter before outputting it back in admin dashboardCVE-2021-25112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting
Product
WHMCS Bridge
Fixed in
6.4b
What to do
Update WHMCS Bridge to 6.4b or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022WP Cloudy, weather: Does not escape the post_id parameter before using it in a SQL statement in the admin dashboardCVE-2021-24864 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue
Product
WP Cloudy, weather
Fixed in
4.4.9
What to do
Update WP Cloudy, weather to 4.4.9 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 24, 2022A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5.CVE-2021-29217 · Other software · HPE · reported by security-alert@hpe.comMedium 6.1
A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to resolve this vulnerability in HPE OneView Global Dashboard.
Product
Oneview Global Dashboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 24, 2022A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5.CVE-2021-29216 · Other software · HPE · reported by security-alert@hpe.comMedium 6.1
A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has provided a software update to resolve this vulnerability in HPE OneView Global Dashboard.
Product
Oneview Global Dashboard
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Feb 21, 2022Database Backup for: Does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboardCVE-2022-0255 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
Product
Database Backup for
Fixed in
2.5.1
What to do
Update Database Backup for to 2.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 21, 2022GiveWP: Does not escape the json parameter before outputting it back in an attribute in the Import admin dashboardCVE-2022-0252 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
Product
GiveWP
Fixed in
2.17.3
What to do
Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022Popup Builder: Does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboardCVE-2022-0228 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Product
Popup Builder
Fixed in
4.0.7
What to do
Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
Product
GiveWP
Fixed in
2.17.3
What to do
Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 1, 2022NextScripts: Social Networks Auto-Poster: Does not sanitise and escape logged requests before outputting them in the related admin dashboardCVE-2021-24975 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests before outputting them in the related admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting issue
Product
NextScripts: Social Networks Auto-Poster
Fixed in
4.3.24
What to do
Update NextScripts: Social Networks Auto-Poster to 4.3.24 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.