Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,547 results · page 151 of 391
Feb 21, 2022Image Photo Gallery Final Tiles Grid: Does not sanitise and escape the Description fieldCVE-2022-0186 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.5.3
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.5.3 or newer.
Feb 21, 2022Coming soon and Maintenance mode: Does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX actionCVE-2022-0164 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.5.3
- What to do
- Update Coming soon and Maintenance mode to 3.5.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022AnyComment: Does not have CSRF checks in the Import and Revert HyperComments featuresCVE-2022-0134 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Feb 21, 2022ExportFeed: Does not sanitise and escape the product_id POST parameter before using it in a SQL statementCVE-2021-4208 · WordPress plugins & themes · reported by WPScanHigh 7.2
The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using it in a SQL statement, leading to a SQL injection vulnerability exploitable by high privilege users
- Product
- ExportFeed
- Affected
- up to 2.0.1.0
- What to do
- Affects up to 2.0.1.0. Update ExportFeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Anti-Malware Security and Brute-Force Firewall: Does not sanitise and escape the POST data before outputting it back in attributes of an admin pageCVE-2021-25101 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputting it back in attributes of an admin page, leading to a Reflected Cross-Site scripting. Due to the presence of specific parameter value, available to admin users, this can only be exploited by an admin against another admin user.
- Product
- Anti-Malware Security and Brute-Force Firewall
- Fixed in
- 4.20.94
- What to do
- Update Anti-Malware Security and Brute-Force Firewall to 4.20.94 or newer.
Feb 21, 2022GiveWP: Does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboardCVE-2021-25100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms dashboard, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022GiveWP: Does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX actionCVE-2021-25099 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an unauthenticated request via the give_checkout_login AJAX action, leading to a Reflected Cross-Site Scripting
- Product
- GiveWP
- Fixed in
- 2.17.3
- What to do
- Update GiveWP to 2.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Popup Builder: Does not validate and sanitise the sgpb_type parameter before using it in a require statementCVE-2021-25082 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it in a require statement, leading to a Local File Inclusion issue. Furthermore, since the beginning of the string can be controlled, the issue can lead to RCE vulnerability via wrappers such as PHAR
- Product
- Popup Builder
- Fixed in
- 4.0.7
- What to do
- Update Popup Builder to 4.0.7 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Duplicate Page or Post: Does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX actionCVE-2021-25075 · WordPress plugins & themes · reported by WPScanLow 3.5
The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues
- Product
- Duplicate Page or Post
- Fixed in
- 1.5.1
- What to do
- Update Duplicate Page or Post to 1.5.1 or newer.
Feb 21, 2022Download Manager: Does not sanitise and escape the package_ids parameter before using it in a SQL statementCVE-2021-25069 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using it in a SQL statement, leading to a SQL injection, which can also be exploited to cause a Reflected Cross-Site Scripting issue
- Product
- Download Manager
- Fixed in
- 3.2.34
- What to do
- Update Download Manager to 3.2.34 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 21, 2022Five Star Business Profile and Schema: Does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX actionCVE-2021-25060 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues
- Product
- Five Star Business Profile and Schema
- Fixed in
- 2.1.7
- What to do
- Update Five Star Business Profile and Schema to 2.1.7 or newer.
Feb 21, 2022Advanced Database Cleaner: Does not sanitise and escape $_GET keys and values before outputting them back in attributesCVE-2021-24921 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Advanced Database Cleaner
- Fixed in
- 3.0.4
- What to do
- Update Advanced Database Cleaner to 3.0.4 or newer.
Feb 20, 2022In Alluxio before 2.7.3, the logserver does not validate the input stream.CVE-2022-23848 · Other software · Alluxio · reported by MITRECritical 9.8
In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44228 Log4j vulnerability.
- Product
- Alluxio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perforCVE-2022-21196 · Other software · Airspan Networks · reported by ics-cert@hq.dhs.govCritical 10
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.
- Product
- MMP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properCVE-2022-21176 · Other software · Airspan Networks · reported by ics-cert@hq.dhs.govHigh 8.6
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input, which may allow an attacker to perform a SQL injection and obtain sensitive information.
- Product
- MMP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properCVE-2022-21143 · Other software · Airspan Networks · reported by ics-cert@hq.dhs.govHigh 7.5
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input on several locations, which may allow an attacker to inject arbitrary commands.
- Product
- MMP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perforCVE-2022-21141 · Other software · Airspan Networks · reported by ics-cert@hq.dhs.govCritical 10
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functions and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.
- Product
- MMP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user CVE-2021-38935 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 210892.
- Product
- Maximo Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 17, 2022The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.CVE-2022-24953 · Other software · Pear · reported by MITREMedium 5.3
The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
- Product
- Crypt GPG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022The Quick Edit module does not properly check entity access in some circumstances.CVE-2022-25270 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2022-25209 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins Chef Sinatra Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers CVE-2022-25203 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
- Product
- Jenkins Team Views Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vuCVE-2022-25202 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.8
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
- Product
- Jenkins Promoted Builds (Simple) Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSCVE-2022-25191 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Agent Server Parameter Plugin 1.0 and earlier does not escape parameter names of agent server parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Agent Server Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scriptiCVE-2022-25189 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Custom Checkbox Parameter Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/ConfigureCVE-2022-25188 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Fortify Plugin 20.2.34 and earlier does not sanitize the appName and appVersion parameters of its Pipeline steps, allowing attackers with Item/Configure permission to write or overwrite .xml files on the Jenkins controller file system with content not controllable by the attacker.
- Product
- Jenkins Fortify Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 15, 2022Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.CVE-2022-25187 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle.
- Product
- Jenkins Support Core Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS)CVE-2022-25185 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Generic Webhook Trigger Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 15, 2022Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, alloCVE-2022-25178 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
- Product
- Jenkins Pipeline: Shared Groovy Libraries Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the CVE-2022-23317 · Other software · Helpsystems · reported by MITREHigh 7.5
CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL.
- Product
- Cobalt Strike
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddonghuangt1.comdonghuangt1.com
Feb 14, 2022SpiderCalendar: Does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0212 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
- Product
- SpiderCalendar
- Affected
- up to 1.5.65
- What to do
- Affects up to 1.5.65. Update SpiderCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 14, 2022MapPress Maps for: Does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error messageCVE-2022-0208 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
- Product
- MapPress Maps for
- Fixed in
- 2.73.4
- What to do
- Update MapPress Maps for to 2.73.4 or newer.
Feb 14, 2022NewStatPress: Does not properly escape the whatX parameters before outputting them back in attributesCVE-2022-0206 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- NewStatPress
- Fixed in
- 1.3.6
- What to do
- Update NewStatPress to 1.3.6 or newer.
Feb 14, 2022Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themiCVE-2022-0200 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- Fixed in
- 1.1.7
- What to do
- Update the plugin to 1.1.7 or newer.
Feb 14, 2022Complianz: Does not escape the s parameter before outputting it back in an attribute in an admin pageCVE-2022-0193 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Complianz
- Fixed in
- 6.0.0
- What to do
- Update Complianz to 6.0.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022PowerPack Lite for Beaver Builder: Does not sanitise and escape the tab parameter before outputting it back in an admin pageCVE-2022-0176 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- PowerPack Lite for Beaver Builder
- Fixed in
- 1.2.9.3
- What to do
- Update PowerPack Lite for Beaver Builder to 1.2.9.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022Form Store to DB: Does not sanitise and escape parameter keys before outputting it back in the created entryCVE-2021-25107 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
- Product
- Form Store to DB
- Fixed in
- 1.1.1
- What to do
- Update Form Store to DB to 1.1.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022Remove Footer Credit: Does properly sanitise its settingsCVE-2021-25050 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
- Product
- Remove Footer Credit
- Fixed in
- 1.0.11
- What to do
- Update Remove Footer Credit to 1.0.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022WordPress Newsletter: Does not validate the to parameter before redirecting the user to its given valueCVE-2021-25033 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
- Product
- WordPress Newsletter
- Fixed in
- 1.6.5
- What to do
- Update WordPress Newsletter to 1.6.5 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 14, 2022PPOM for WooCommerce: Does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX actionCVE-2021-25018 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
- Product
- PPOM for WooCommerce
- Fixed in
- 24.0
- What to do
- Update PPOM for WooCommerce to 24.0 or newer.
Feb 14, 2022Ibtana: Does not have authorisation and CSRF checks in the ive_save_general_settings AJAX actionCVE-2021-25014 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.
- Product
- Ibtana
- Fixed in
- 1.1.4.9
- What to do
- Update Ibtana to 1.1.4.9 or newer.
Feb 14, 2022Mortgage Calculators WP: Does not implement any sanitisation on the color setting of the background of a calculatorCVE-2021-24904 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Mortgage Calculators WP
- Fixed in
- 1.56
- What to do
- Update Mortgage Calculators WP to 1.56 or newer.
Feb 14, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the lang and pid parameter before outputting them back in attributesCVE-2021-24874 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
- Product
- Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
- Fixed in
- 3.1.31
- What to do
- Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.31 or newer.
Feb 14, 2022Remove Footer Credit: Does not have CSRF check in placeCVE-2021-24446 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
- Product
- Remove Footer Credit
- Fixed in
- 1.0.6
- What to do
- Update Remove Footer Credit to 1.0.6 or newer.
Feb 11, 2022The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue.CVE-2022-24975 · Other software · Git-scm · reported by MITREHigh 7.5
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
- Product
- GIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlore.kernel.org
Feb 11, 2022ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，CVE-2021-39658 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，resulting in permission leaks。Third-party apps can use this service to arbitrarily modify and set system properties。Product: AndroidVersions: Android SoCAndroid ID: A-207479207
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 11, 2022ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissioCVE-2021-39635 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.1
ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 11, 2022Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass.CVE-2020-13677 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.CVE-2020-13676 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible datCVE-2020-13674 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
- Product
- Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.