Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 14 of 39
Dec 20, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some of its settingsCVE-2024-8968 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WordPress Button Plugin MaxButtons
- Fixed in
- 9.8.1
- What to do
- Update WordPress Button Plugin MaxButtons to 9.8.1 or newer.
Dec 20, 2024Download Manager: Does not sanitise and escape some of its settingsCVE-2024-10706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Download Manager
- Fixed in
- 3.3.03
- What to do
- Update Download Manager to 3.3.03 or newer.
Dec 20, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some of its settingsCVE-2024-10555 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WordPress Button Plugin MaxButtons
- Fixed in
- 9.8.1
- What to do
- Update WordPress Button Plugin MaxButtons to 9.8.1 or newer.
Dec 13, 2024Spam protection, AntiSpam, FireWall by CleanTalk: Missing AuthorizationCVE-2023-33996 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spam protection, AntiSpam, FireWall by CleanTalk: from n/a through 6.10.
- Product
- Spam protection, AntiSpam, FireWall by CleanTalk
- Affected
- up to 6.10
- What to do
- Affects up to 6.10. Update Spam protection, AntiSpam, FireWall by CleanTalk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Image Widget: Does not sanitise and escape some of its Image Widget settingsCVE-2024-10939 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Widget
- Fixed in
- 4.4.11
- What to do
- Update Image Widget to 4.4.11 or newer.
Dec 12, 2024LearnPress: Does not sanitise and escape some of its settingsCVE-2024-9881 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- LearnPress
- Fixed in
- 4.2.7.2
- What to do
- Update LearnPress to 4.2.7.2 or newer.
Dec 12, 2024LuckyWP Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-9641 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- LuckyWP Table of Contents
- Fixed in
- 2.1.7
- What to do
- Update LuckyWP Table of Contents to 2.1.7 or newer.
Dec 12, 2024Popup Builder: Does not sanitise and escape some of its settingsCVE-2024-9428 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Builder WordPress plugin before 4.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Popup Builder
- Fixed in
- 4.3.5
- What to do
- Update Popup Builder to 4.3.5 or newer.
Dec 12, 2024Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-10568 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ajax Search Lite
- Fixed in
- 4.12.4
- What to do
- Update Ajax Search Lite to 4.12.4 or newer.
Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Membership Plan settingsCVE-2024-10518 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Membership Plan settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.15
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.15 or newer.
Dec 12, 2024Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its Drag & Drop Builder fieldsCVE-2024-10517 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 does not sanitise and escape some of its Drag & Drop Builder fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.15
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.15 or newer.
Dec 12, 2024LearnPress: Does not sanitise and escape some of its settingsCVE-2024-10010 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- LearnPress
- Fixed in
- 4.2.7.2
- What to do
- Update LearnPress to 4.2.7.2 or newer.
Dec 12, 2024Top and footer bars for announcements, notifications, advertisements, promotions – YooBar: Stored Cross-Site ScriptingCVE-2024-11410 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Top and footer bars for announcements, notifications, advertisements, promotions – YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Top and footer bars for announcements, notifications, advertisements, promotions – YooBar
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Top and footer bars for announcements, notifications, advertisements, promotions – YooBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 10, 2024System Dashboard: Does not sanitise and escape some parametersCVE-2024-11107 · WordPress plugins & themes · reported by WPScanMedium 6.1
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- System Dashboard
- Fixed in
- 2.8.15
- What to do
- Update System Dashboard to 2.8.15 or newer.
Dec 9, 2024WCMultiShipping: Missing AuthorizationCVE-2023-48274 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCMultiShipping: from n/a through 2.3.5.
- Product
- WCMultiShipping
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update WCMultiShipping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Fluent Forms: Does not sanitise and escape some of its settingsCVE-2024-9651 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fluent Forms WordPress plugin before 5.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Fluent Forms
- Fixed in
- 5.2.1
- What to do
- Update Fluent Forms to 5.2.1 or newer.
Dec 7, 2024Simple Side Tab: Does not sanitise and escape some of its settingsCVE-2024-11183 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Side Tab WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Side Tab
- Fixed in
- 2.2.0
- What to do
- Update Simple Side Tab to 2.2.0 or newer.
Dec 6, 2024Sticky Social Icons: Does not sanitise and escape some of its settingsCVE-2024-10551 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Sticky Social Icons
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Sticky Social Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 3, 2024WP Booking Calendar: Does not sanitise and escape some of its settingsCVE-2024-10893 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Booking Calendar WordPress plugin before 10.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Booking Calendar
- Fixed in
- 10.6.5
- What to do
- Update WP Booking Calendar to 10.6.5 or newer.
Nov 29, 2024Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10704 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.8.31
- What to do
- Update Photo Gallery by 10Web to 1.8.31 or newer.
Nov 28, 2024Logo Slider: Does not sanitise and escape some of its Logo and Slider settingsCVE-2024-10896 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting
- Product
- Logo Slider
- Fixed in
- 4.5.0
- What to do
- Update Logo Slider to 4.5.0 or newer.
Nov 28, 2024adBuddy+ (AdBlocker Detection) by NetfunkDesign: Does not sanitise and escape some of its settingsCVE-2024-10510 · WordPress plugins & themes · reported by WPScanMedium 4.8
The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- adBuddy+ (AdBlocker Detection) by NetfunkDesign
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update adBuddy+ (AdBlocker Detection) by NetfunkDesign to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Logo Slider: Does not sanitise and escape some of its Logo SettingsCVE-2024-10473 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.
- Product
- Logo Slider
- Fixed in
- 4.5.0
- What to do
- Update Logo Slider to 4.5.0 or newer.
Nov 26, 2024Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-10471 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Everest Forms
- Fixed in
- 3.0.4.2
- What to do
- Update Everest Forms to 3.0.4.2 or newer.
Nov 25, 2024WPForms: Does not sanitise and escape some of its settingsCVE-2024-7056 · WordPress plugins & themes · reported by WPScanLow 3.5
The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WPForms
- Fixed in
- 1.9.1.6
- What to do
- Update WPForms to 1.9.1.6 or newer.
Nov 25, 2024Photo Gallery, Sliders, Proofing and: Does not sanitise and escape some of its Images settingsCVE-2024-6393 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.5 does not sanitise and escape some of its Images settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Photo Gallery, Sliders, Proofing and
- Fixed in
- 3.59.5
- What to do
- Update Photo Gallery, Sliders, Proofing and to 3.59.5 or newer.
Nov 25, 2024YaDisk Files: Does not sanitise and escape some of its settingsCVE-2024-10710 · WordPress plugins & themes · reported by WPScanLow 3.5
The YaDisk Files WordPress plugin through 1.2.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- YaDisk Files
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update YaDisk Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2024Formidable Forms: Does not sanitise and escape some of its settingsCVE-2024-9768 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Formidable Forms
- Fixed in
- 6.14.1
- What to do
- Update Formidable Forms to 6.14.1 or newer.
Nov 21, 2024Ditty: Does not sanitise and escape some of its settingsCVE-2024-9600 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks.
- Product
- Ditty
- Fixed in
- 3.1.47
- What to do
- Update Ditty to 3.1.47 or newer.
Nov 21, 2024Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO: Does not sanitise uploaded SVG filesCVE-2024-10482 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO
- Fixed in
- 1.5.0
- What to do
- Update Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO to 1.5.0 or newer.
Nov 19, 2024Text Advertisements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51879 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arash Heidari Text Advertisements text-advertisements allows Stored XSS.This issue affects Text Advertisements: from n/a through <= 2.1.
- Product
- Text Advertisements
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Text Advertisements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 15, 2024Jobs for: Does not sanitise and escape some of its Job settingsCVE-2024-10104 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Jobs for
- Fixed in
- 2.7.8
- What to do
- Update Jobs for to 2.7.8 or newer.
Nov 14, 2024The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.CVE-2024-10924 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
- Affected
- 9.0.0 to 9.1.1.1
- What to do
- Affects 9.0.0 to 9.1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 14, 2024Simple File List: Does not sanitise and escape a generated URL before outputting it back in an attributeCVE-2024-10146 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.
- Product
- Simple File List
- Fixed in
- 6.1.13
- What to do
- Update Simple File List to 6.1.13 or newer.
Nov 9, 2024Satisfaction Reports from Help Scout: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51778 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tevya Satisfaction Reports from Help Scout happiness-reports-for-help-scout allows Reflected XSS.This issue affects Satisfaction Reports from Help Scout: from n/a through <= 2.0.3.
- Product
- Satisfaction Reports from Help Scout
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Satisfaction Reports from Help Scout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2024Registrations for the Events Calendar: Does not sanitise and escape some parametersCVE-2024-7982 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.12.4
- What to do
- Update Registrations for the Events Calendar to 2.12.4 or newer.
Nov 7, 2024Safe SVG: Has its sanitisation code is only running for paths that call wp_handle_uploadCVE-2024-8378 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.
- Product
- Safe SVG
- Fixed in
- 2.2.6
- What to do
- Update Safe SVG to 2.2.6 or newer.
Nov 7, 2024WP Booking Calendar: Does not sanitise and escape some of its Widgets settingsCVE-2024-10027 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Booking Calendar WordPress plugin before 10.6.3 does not sanitise and escape some of its Widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Booking Calendar
- Fixed in
- 10.6.3
- What to do
- Update WP Booking Calendar to 10.6.3 or newer.
Nov 6, 2024Wp-ImageZoom: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2024-9934 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Wp-ImageZoom
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Wp-ImageZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2024WP ULike: Does not sanitise and escape some of its settingsCVE-2024-7879 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WP ULike
- Fixed in
- 4.7.5
- What to do
- Update WP ULike to 4.7.5 or newer.
Nov 5, 2024Pods: Does not sanitise and escape some of its settingsCVE-2024-9883 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pods WordPress plugin before 3.2.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pods
- Fixed in
- 3.2.7.1
- What to do
- Update Pods to 3.2.7.1 or newer.
Nov 5, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: Does not sanitise and escape some of its Notification settingsCVE-2024-7877 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Notification settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Appointment Booking Calendar — Simply Schedule Appointments Booking
- Fixed in
- 1.6.7.55
- What to do
- Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.7.55 or newer.
Nov 5, 2024Appointment Booking Calendar — Simply Schedule Appointments Booking: Does not sanitise and escape some of its Appointment Type settingsCVE-2024-7876 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escape some of its Appointment Type settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Appointment Booking Calendar — Simply Schedule Appointments Booking
- Fixed in
- 1.6.7.55
- What to do
- Update Appointment Booking Calendar — Simply Schedule Appointments Booking to 1.6.7.55 or newer.
Nov 5, 2024Table of Contents Plus: Does not sanitise and escape some of its settingsCVE-2024-5578 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Table of Contents Plus WordPress plugin through 2408 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Table of Contents Plus
- Affected
- up to 2408
- What to do
- Affects up to 2408. Update Table of Contents Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Advanced Advertising System: Deserialization of Untrusted DataCVE-2024-49624 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in smartdevth Advanced Advertising System advanced-advertising-system allows Object Injection.This issue affects Advanced Advertising System: from n/a through <= 1.3.1.
- Product
- Advanced Advertising System
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Advanced Advertising System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 9, 2024Photo Gallery by 10Web: Does not properly sanitise and escape some of its Gallery settingsCVE-2024-5968 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.8.28
- What to do
- Update Photo Gallery by 10Web to 1.8.28 or newer.
Oct 8, 2024Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to peCVE-2024-8983 · WordPress plugins & themes · reported by WPScanMedium 4.8
Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Fixed in
- 2.2.3
- What to do
- Update the plugin to 2.2.3 or newer.
Sep 30, 2024Cost Calculator Builder: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-8379 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- Cost Calculator Builder
- Fixed in
- 3.2.29
- What to do
- Update Cost Calculator Builder to 3.2.29 or newer.
Sep 30, 2024Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-8283 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Slider by 10Web
- Fixed in
- 1.2.59
- What to do
- Update Slider by 10Web to 1.2.59 or newer.
Sep 30, 2024Post Grid: Does not sanitise and escape some of its Grid settingsCVE-2024-3635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Post Grid
- Fixed in
- 7.5.0
- What to do
- Update Post Grid to 7.5.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.