Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,543 results · page 144 of 391
May 9, 2022WPGraphQL: Doesn't properly restrict access to information about other users' roles on the affected siteCVE-2019-25060 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
- Product
- WPGraphQL
- Fixed in
- 0.3.5
- What to do
- Update WPGraphQL to 0.3.5 or newer.
May 6, 2022In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for savinCVE-2019-12254 · Other software · TECSON · reported by info@cert.vde.comCritical 9.8
In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules.
- Product
- e-litro net
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
May 6, 2022Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for valiCVE-2022-1053 · Other software · Keylime · reported by Red HatCritical 9.1
Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. A successful attack breaks the entire chain of trust because a not validated AK is used by the verifier. This issue is worse if the validation happens first and then the agent gets added to the verifier because the timing is easier and the verifier does not validate the regcount entry being equal to 1,
- Product
- Keylime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
May 5, 2022On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing an authenticated attaCVE-2022-27634 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.5
On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1, BIG-IP APM does not properly validate configurations, allowing an authenticated attacker with high privileges to manipulate the APM policy leading to privilege escalation/remote code execution. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP APM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
May 4, 2022Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash.CVE-2022-30288 · Other software · ohler · reported by MITREHigh 7.5
Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors.
- Product
- agoo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments).CVE-2022-30284 · Other software · Python-libnmap Project · reported by MITRECritical 9
In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case
- Product
- Python-libnmap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlibnmap.readthedocs.io
May 4, 2022The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element.CVE-2022-30241 · Other software · Jquery Json-viewer Project · reported by MITREMedium 6.1
The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element.
- Product
- Jquery Json-viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022In four instances DMARS (All versions prior to v2.1.10.24) does not properly restrict references of XML external entities while processing specific project fileCVE-2022-1331 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govMedium 5.5
In four instances DMARS (All versions prior to v2.1.10.24) does not properly restrict references of XML external entities while processing specific project files, which may allow unauthorized information disclosure.
- Product
- DMARS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.CVE-2022-1292 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.3
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comgit.openssl.org
May 3, 2022The vulnerability is that IDToken verifier does not verify if token is properly signed.CVE-2021-22573 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comHigh 8.7
The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above
- Product
- Google-oauth-java-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022JerryScript Git version 14ff5bf does not sufficiently track and release allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c after RegExp, whichCVE-2021-41959 · Other software · Jerryscript · reported by MITREHigh 7.5
JerryScript Git version 14ff5bf does not sufficiently track and release allocated memory via jerry-core/ecma/operations/ecma-regexp-object.c after RegExp, which causes a memory leak.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2022Photo Gallery by 10Web: Does not properly sanitize the $_GET['image_url'] variableCVE-2022-1282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.6.3
- What to do
- Update Photo Gallery by 10Web to 1.6.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022Photo Gallery: Does not properly escape the $_POST['filter_tag'] parameterCVE-2022-1281 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
- Product
- Photo Gallery
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022Import WP: Does not validate the imported file in some casesCVE-2022-1273 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import WP WordPress plugin before 2.4.6 does not validate the imported file in some cases, allowing high privilege users such as admin to upload arbitrary files (such as PHP), leading to RCE
- Product
- Import WP
- Fixed in
- 2.4.6
- What to do
- Update Import WP to 2.4.6 or newer.
May 2, 2022Fast Flow: Does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboardCVE-2022-1269 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Fast Flow
- Fixed in
- 1.2.12
- What to do
- Update Fast Flow to 1.2.12 or newer.
May 2, 2022Import and export users and customers: Does not sanitise and escaped imported CSV dataCVE-2022-1255 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues
- Product
- Import and export users and customers
- Fixed in
- 1.19.2.1
- What to do
- Update Import and export users and customers to 1.19.2.1 or newer.
May 2, 2022LifterLMS PayPal: Does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the pageCVE-2022-1250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue
- Product
- LifterLMS PayPal
- Fixed in
- 1.4.0
- What to do
- Update LifterLMS PayPal to 1.4.0 or newer.
Full record and what to do →NVD recordmake.lifterlms.comwpscan.com
May 2, 2022HubSpot: Does not validate the proxy URL given to the proxy REST endpointCVE-2022-1239 · WordPress plugins & themes · reported by WPScanHigh 8.8
The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks
- Product
- HubSpot
- Fixed in
- 8.8.15
- What to do
- Update HubSpot to 8.8.15 or newer.
May 2, 2022Visual Form Builder: Does not sanitise and escape the form's 'Email to' fieldCVE-2022-1046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Visual Form Builder
- Fixed in
- 3.0.7
- What to do
- Update Visual Form Builder to 3.0.7 or newer.
May 2, 2022Sitemap by click5: Does not have authorisation and CSRF checksCVE-2022-0952 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.
- Product
- Sitemap by click5
- Fixed in
- 1.0.36
- What to do
- Update Sitemap by click5 to 1.0.36 or newer.
May 2, 2022Multiple Shipping Address Woocommerce: Does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated usersCVE-2022-0783 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Multiple Shipping Address Woocommerce WordPress plugin before 2.0 does not properly sanitise and escape numerous parameters before using them in SQL statements via some AJAX actions available to unauthenticated users, leading to unauthenticated SQL injections
- Product
- Multiple Shipping Address Woocommerce
- Fixed in
- 2.0
- What to do
- Update Multiple Shipping Address Woocommerce to 2.0 or newer.
May 2, 2022SiteSuperCharger: Does not validateCVE-2022-0771 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SiteSuperCharger WordPress plugin before 5.2.0 does not validate, sanitise and escape various user inputs before using them in SQL statements via AJAX actions (available to both unauthenticated and authenticated users), leading to Unauthenticated SQL Injections
- Product
- SiteSuperCharger
- Fixed in
- 5.2.0
- What to do
- Update SiteSuperCharger to 5.2.0 or newer.
May 2, 2022AdRotate: Does not sanitise and escape Advert NamesCVE-2022-0662 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- AdRotate
- Fixed in
- 5.8.23
- What to do
- Update AdRotate to 5.8.23 or newer.
May 2, 2022AdRotate: Does not escape Group NamesCVE-2022-0649 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- AdRotate
- Fixed in
- 5.8.23
- What to do
- Update AdRotate to 5.8.23 or newer.
May 2, 2022Content Egg: Does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboardCVE-2022-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Content Egg
- Fixed in
- 5.3.0
- What to do
- Update Content Egg to 5.3.0 or newer.
May 2, 2022Event List: Does not sanitise and escape some of its settingsCVE-2022-0418 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks against other admin even when the unfiltered_html is disallowed
- Product
- Event List
- Fixed in
- 0.8.8
- What to do
- Update Event List to 0.8.8 or newer.
May 2, 2022Ad Invalid Click Protector (AICP): Does not have CSRF check deleting banned usersCVE-2022-0191 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attackers to make a logged in admin remove arbitrary bans
- Product
- Ad Invalid Click Protector (AICP)
- Fixed in
- 1.2.7
- What to do
- Update Ad Invalid Click Protector (AICP) to 1.2.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
May 2, 2022All In One WP Security & Firewall: Does not validateCVE-2021-25102 · WordPress plugins & themes · reported by WPScanMedium 4.7
The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk
- Product
- All In One WP Security & Firewall
- Fixed in
- 4.4.11
- What to do
- Update All In One WP Security & Firewall to 4.4.11 or newer.
May 2, 2022Advanced Page Visit Counter: Does not sanitise and escape some input before outputting it in an admin dashboard pageCVE-2021-25086 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it
- Product
- Advanced Page Visit Counter
- Fixed in
- 6.1.2
- What to do
- Update Advanced Page Visit Counter to 6.1.2 or newer.
May 2, 2022Tipsacarrier: Does not have any authorisation check in place some functionsCVE-2021-25002 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Tipsacarrier WordPress plugin before 1.5.0.5 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL
- Product
- Tipsacarrier
- Fixed in
- 1.5.0.5
- What to do
- Update Tipsacarrier to 1.5.0.5 or newer.
May 2, 2022Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.CVE-2022-29970 · Other software · Sinatrarb · reported by MITREHigh 7.5
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
- Product
- Sinatra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
May 1, 2022Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefinCVE-2021-31674 · Other software · Cyclos · reported by MITREMedium 6.1
Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant.
- Product
- Cyclos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comtf1t.gitbook.io
May 1, 2022CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.CVE-2022-28481 · Other software · Csv-safe Project · reported by MITRECritical 9.8
CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.
- Product
- Csv-safe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds write conditioCVE-2022-1403 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds write condition.
- Product
- ASDA-Soft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read conditionCVE-2022-1402 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition.
- Product
- ASDA-Soft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provCVE-2021-43937 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 7.6
Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
- Product
- SmartPTT SCADA Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload CVE-2021-43934 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govCritical 9.8
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traveCVE-2021-43930 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govMedium 4.9
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection.CVE-2022-28101 · Other software · Lyonbros · reported by MITRECritical 9
Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection.
- Product
- Turtl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcybercitadel.com
Apr 27, 2022The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.CVE-2022-29810 · Other software · Hashicorp · reported by MITREMedium 5.5
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
- Product
- Go-getter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Donorbox: Does not sanitise and escape its Campaign URL settings before outputting it in an attributeCVE-2022-1396 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
- Product
- Donorbox
- Fixed in
- 7.1.7
- What to do
- Update Donorbox to 7.1.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 25, 2022Videos sync PDF: Does not validate the p parameter before using it in an include statementCVE-2022-1392 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues
- Product
- Videos sync PDF
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update Videos sync PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 25, 2022Cab fare calculator: Does not validate the controller parameter before using it in require statementsCVE-2022-1391 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cab fare calculator WordPress plugin before 1.0.4 does not validate the controller parameter before using it in require statements, which could lead to Local File Inclusion issues.
- Product
- Cab fare calculator
- Fixed in
- 1.0.4
- What to do
- Update Cab fare calculator to 1.0.4 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 25, 2022Admin Word Count Column: Does not validate the path parameter given to readfile()CVE-2022-1390 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Admin Word Count Column WordPress plugin through 2.2 does not validate the path parameter given to readfile(), which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique
- Product
- Admin Word Count Column
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Admin Word Count Column to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 25, 2022Opensea: Does not sanitize and escape some of its settingsCVE-2022-1228 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Opensea
- Fixed in
- 1.0.3
- What to do
- Update Opensea to 1.0.3 or newer.
Apr 25, 2022Books & Papers: Does not escape its Custom DB prefix settingsCVE-2022-1156 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Books & Papers WordPress plugin through 0.20210223 does not escape its Custom DB prefix settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Books & Papers
- Affected
- up to 0.20210223
- What to do
- Affects up to 0.20210223. Update Books & Papers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2022LayerSlider: Does not sanitise and escape Project's slug before outputting it back in various placeCVE-2022-1153 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LayerSlider WordPress plugin before 7.1.2 does not sanitise and escape Project's slug before outputting it back in various place, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- LayerSlider
- Fixed in
- 7.1.2
- What to do
- Update LayerSlider to 7.1.2 or newer.
Apr 25, 2022Menubar: Does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users)CVE-2022-1152 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Menubar WordPress plugin before 5.8 does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting
- Product
- Menubar
- Fixed in
- 5.8
- What to do
- Update Menubar to 5.8 or newer.
Apr 25, 2022amr users: Does not sanitise and escape some of its settingsCVE-2022-1094 · WordPress plugins & themes · reported by WPScanMedium 4.8
The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- amr users
- Fixed in
- 4.59.4
- What to do
- Update amr users to 4.59.4 or newer.
Apr 25, 2022myCred: Does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX actionCVE-2022-1092 · WordPress plugins & themes · reported by WPScanMedium 4.3
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog
- Product
- myCred
- Fixed in
- 2.4.3.1
- What to do
- Update myCred to 2.4.3.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.