Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,543 results · page 142 of 391
May 30, 2022Call&Book Mobile Bar: Does not sanitize and escape some of its settingsCVE-2022-1644 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Call&Book Mobile Bar
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Call&Book Mobile Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Birthdays Widget: Does not sanitise and escape some of its fieldsCVE-2022-1643 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Birthdays Widget
- Affected
- up to 1.7.18
- What to do
- Affects up to 1.7.18. Update Birthdays Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Bulk Page Creator: Does not protect its page creation functionalities with nonce checksCVE-2022-1611 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF.
- Product
- Bulk Page Creator
- Fixed in
- 1.1.4
- What to do
- Update Bulk Page Creator to 1.1.4 or newer.
May 30, 2022Change wp-admin login: Does not properly check for authorisation and is also missing CSRF checkCVE-2022-1589 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector
- Product
- Change wp-admin login
- Fixed in
- 1.1.0
- What to do
- Update Change wp-admin login to 1.1.0 or newer.
May 30, 2022External Links in New Window / New Tab: Does not ensure windowCVE-2022-1583 · WordPress plugins & themes · reported by WPScanMedium 6.5
The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.
- Product
- External Links in New Window / New Tab
- Fixed in
- 1.43
- What to do
- Update External Links in New Window / New Tab to 1.43 or newer.
May 30, 2022External Links in New Window / New Tab: Does not properly escape URLs it concatenates to onclick event handlersCVE-2022-1582 · WordPress plugins & themes · reported by WPScanMedium 6.1
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
- Product
- External Links in New Window / New Tab
- Fixed in
- 1.43
- What to do
- Update External Links in New Window / New Tab to 1.43 or newer.
May 30, 2022Team Members: Does not escape some of its Team settingsCVE-2022-1568 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Team Members
- Fixed in
- 5.1.1
- What to do
- Update Team Members to 5.1.1 or newer.
May 30, 2022Quotes llama: Does not sanitise and escape QuotesCVE-2022-1566 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file
- Product
- Quotes llama
- Fixed in
- 1.0.0
- What to do
- Update Quotes llama to 1.0.0 or newer.
May 30, 2022Form Maker by 10Web: Does not sanitize and escape the Custom Text settingsCVE-2022-1564 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Form Maker by 10Web
- Fixed in
- 1.14.12
- What to do
- Update Form Maker by 10Web to 1.14.12 or newer.
May 30, 2022Enable SVG: Does not sanitise uploaded SVG filesCVE-2022-1562 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
- Product
- Enable SVG
- Fixed in
- 1.4.0
- What to do
- Update Enable SVG to 1.4.0 or newer.
May 30, 2022StaffList: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-1556 · WordPress plugins & themes · reported by WPScanCritical 9.8
The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection
- Product
- StaffList
- Fixed in
- 3.1.5
- What to do
- Update StaffList to 3.1.5 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 30, 2022HPB Dashboard: Does not sanitise and escape some of its settingsCVE-2022-1542 · WordPress plugins & themes · reported by WPScanMedium 4.8
The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- HPB Dashboard
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update HPB Dashboard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022VikBooking Hotel Booking Engine & PMS: Does not escape the current URL before putting it back in a JavaScript contextCVE-2022-1528 · WordPress plugins & themes · reported by WPScanMedium 6.1
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.9
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.9 or newer.
May 30, 2022WP 2FA: Does not sanitise and escape a parameter before outputting it back in an admin pageCVE-2022-1527 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- WP 2FA
- Fixed in
- 2.2.1
- What to do
- Update WP 2FA to 2.2.1 or newer.
May 30, 2022Poll Maker: Does not sanitise and escape some settingsCVE-2022-1456 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfiltered_html is disallowed
- Product
- Poll Maker
- Fixed in
- 4.0.2
- What to do
- Update Poll Maker to 4.0.2 or newer.
May 30, 2022Easy FAQ with Expanding Text: Does not sanitise and escape its settingsCVE-2022-1395 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- Easy FAQ with Expanding Text
- Affected
- up to 3.2.8.3.1
- What to do
- Affects up to 3.2.8.3.1. Update Easy FAQ with Expanding Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022No Future Posts: Does not escape its settingsCVE-2022-1387 · WordPress plugins & themes · reported by WPScanMedium 4.8
The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
- Product
- No Future Posts
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update No Future Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Slideshow: Does not sanitize and escape some of its default slideshow settingsCVE-2022-1299 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Slideshow
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Slideshow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022IMDB info box: Does not sanitize and escape some of its settingsCVE-2022-1294 · WordPress plugins & themes · reported by WPScanMedium 4.8
The IMDB info box WordPress plugin through 2.0 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- IMDB info box
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update IMDB info box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022BannerMan: Does not sanitize or escape its settingsCVE-2022-1275 · WordPress plugins & themes · reported by WPScanMedium 4.8
The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed (such as in multisite)
- Product
- BannerMan
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update BannerMan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 30, 2022Content Mask: Does not have authorisation and CSRF checks in various AJAX actionsCVE-2022-1203 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options
- Product
- Content Mask
- Fixed in
- 1.8.4.1
- What to do
- Update Content Mask to 1.8.4.1 or newer.
May 30, 2022Smush: Does not sanitise and escape a configuration parameter before outputting it back in an admin pageCVE-2022-1009 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
- Product
- Smush
- Fixed in
- 3.9.9
- What to do
- Update Smush to 3.9.9 or newer.
May 30, 2022JivoChat Live Chat: Does not properly check CSRF tokens on POST requests to the plugins admin pageCVE-2022-0642 · WordPress plugins & themes · reported by WPScanMedium 5.4
The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
- Product
- JivoChat Live Chat
- Fixed in
- 1.3.5.4
- What to do
- Update JivoChat Live Chat to 1.3.5.4 or newer.
May 30, 2022User Meta: Does not sanitise and escape the Form NameCVE-2022-0376 · WordPress plugins & themes · reported by WPScanMedium 4.8
The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- User Meta
- Fixed in
- 2.4.3
- What to do
- Update User Meta to 2.4.3 or newer.
May 25, 2022Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.CVE-2022-27305 · Other software · Gibbonedu · reported by MITREHigh 8.8
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
- Product
- Gibbon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022Curtain: Does not sanitise and escape some of its settingsCVE-2022-1558 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Curtain
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Curtain to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 23, 2022Check & Log Email: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1547 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Check & Log Email
- Fixed in
- 1.0.6
- What to do
- Update Check & Log Email to 1.0.6 or newer.
May 23, 2022Sliderby10Web: Does not properly sanitize and escape some of its settingsCVE-2022-1320 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Sliderby10Web
- Fixed in
- 1.2.52
- What to do
- Update Sliderby10Web to 1.2.52 or newer.
May 23, 2022Tabs: Does not sanitise and escape Tab descriptionsCVE-2022-1298 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Tabs
- Fixed in
- 2.2.8
- What to do
- Update Tabs to 2.2.8 or newer.
May 23, 2022Donate Extra: Does not sanitise and escape a parameter before outputting it back in the responseCVE-2022-1268 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Donate Extra WordPress plugin through 2.02 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected cross-Site Scripting
- Product
- Donate Extra
- Affected
- up to 2.02
- What to do
- Affects up to 2.02. Update Donate Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Gwyn's Imagemap Selector: Does not sanitise and escape some parameters before outputting them back in attributesCVE-2022-1221 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting.
- Product
- Gwyn's Imagemap Selector
- Affected
- up to 0.3.3
- What to do
- Affects up to 0.3.3. Update Gwyn's Imagemap Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Domain Replace: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1218 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Domain Replace
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update Domain Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Turn off all comments: Does not sanitise and escape the rows parameter before outputting it back in an admin pageCVE-2022-1192 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Turn off all comments
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Turn off all comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022WP Meta SEO: Does not sanitise or escape the breadcrumb separator before outputting it to the pageCVE-2022-1093 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed.
- Product
- WP Meta SEO
- Fixed in
- 4.4.7
- What to do
- Update WP Meta SEO to 4.4.7 or newer.
May 23, 2022Nirweb support: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users)CVE-2022-0781 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection
- Product
- Nirweb support
- Fixed in
- 2.8.2
- What to do
- Update Nirweb support to 2.8.2 or newer.
May 23, 2022XML Sitemap Generator for Google: Does not validate a parameterCVE-2022-0346 · WordPress plugins & themes · reported by WPScanMedium 6.1
The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.
- Product
- XML Sitemap Generator for Google
- Fixed in
- 2.0.4
- What to do
- Update XML Sitemap Generator for Google to 2.0.4 or newer.
May 20, 2022The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used.CVE-2022-28660 · Other software · Grafana · reported by MITRECritical 9.8
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comsecurity.netapp.com
May 17, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a CVE-2022-28187 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a resource after its effective lifetime has ended, which may lead to denial of service.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
May 17, 2022IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually associated with the CVE-2021-29726 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually associated with the host due to improper validation of certificates. IBM X-Force ID: 201104.
- Product
- Secure External Authentication Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
May 17, 2022Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-30971 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins Storable Configs Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a storeCVE-2022-30968 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins vboxwrapper Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parametCVE-2022-30967 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Selection tasks Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resuCVE-2022-30966 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Random String Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, rCVE-2022-30965 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Promoted Builds (Simple) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resultinCVE-2022-30964 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Multiselect parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored crCVE-2022-30963 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins JDK Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displayinCVE-2022-30962 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Global Variable String Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying CVE-2022-30961 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Autocomplete Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resultingCVE-2022-30960 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Application Detector Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulneraCVE-2022-30956 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.
- Product
- Jenkins Rundeck Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.