Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,374 results · page 16 of 48
Jan 30, 2025MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics: Unauthorized modification of data that can lead to privilege escalationCVE-2024-10591 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hubwoo_save_updates() function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics
- Affected
- up to 1.5.9
- What to do
- Affects up to 1.5.9. Update MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 29, 2025mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information.CVE-2025-20061 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.3
mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025WP Contact Form7 Email Spam Blocker: Reflected Cross-Site ScriptingCVE-2024-13467 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Contact Form7 Email Spam Blocker
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP Contact Form7 Email Spam Blocker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 24, 2025Contact Form Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-24727 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through <= 1.3.52.
- Product
- Contact Form Email
- Affected
- up to 1.3.52
- What to do
- Affects up to 1.3.52. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 24, 2025Email Subscription Popup: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-24587 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nks Email Subscription Popup email-subscribe allows Blind SQL Injection.This issue affects Email Subscription Popup: from n/a through <= 1.2.23.
- Product
- Email Subscription Popup
- Affected
- up to 1.2.23
- What to do
- Affects up to 1.2.23. Update Email Subscription Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sourceCVE-2024-55929 · Other software · Xerox · reported by 10b61619-3869-496c-8a1e-f291b0e71e3fMedium 5.3
A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources.
- Product
- Xerox Workplace Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritydocs.business.xerox.com
Jan 22, 2025LH Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23676 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH Email lh-email allows Reflected XSS.This issue affects LH Email: from n/a through <= 1.12.
- Product
- LH Email
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update LH Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the field id_email_check_btn.CVE-2024-57542 · Network & remote access · Linksys · reported by MITREHigh 8.8
Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via the field id_email_check_btn.
- Product
- E8450 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail.CVE-2024-57539 · Network & remote access · Linksys · reported by MITREHigh 8.2
Linksys E8450 v1.2.00.360516 was discovered to contain a command injection vulnerability via userEmail.
- Product
- E8450 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integrationCVE-2025-24458 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.1
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
- Product
- YouTrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Email Capture & Lead Generation: Missing AuthorizationCVE-2025-23929 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wishfulthemes Email Capture & Lead Generation email-capture-lead-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email Capture & Lead Generation: from n/a through <= 1.0.2.
- Product
- Email Capture & Lead Generation
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Email Capture & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Email on Publish: Cross-Site Request Forgery (CSRF)CVE-2025-23673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in dkukral Email on Publish email-on-publish allows Stored XSS.This issue affects Email on Publish: from n/a through <= 1.5.
- Product
- Email on Publish
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Email on Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Comment-Emailer: Cross-Site Request Forgery (CSRF)CVE-2025-23627 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in frenchsquared Comment-Emailer comment-emailer allows Stored XSS.This issue affects Comment-Emailer: from n/a through <= 1.0.5.
- Product
- Comment-Emailer
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Comment-Emailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025EmailShroud: Cross-Site Request Forgery (CSRF)CVE-2025-23456 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Oddthinking EmailShroud emailshroud allows Reflected XSS.This issue affects EmailShroud: from n/a through <= 2.2.1.
- Product
- EmailShroud
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update EmailShroud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 14, 2025WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg: Arbitrary file uploadsCVE-2025-0394 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
- Affected
- up to 3.7.3.5
- What to do
- Affects up to 3.7.3.5. Update WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 13, 2025Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function.CVE-2023-42226 · Other software · Zucchetti · reported by MITREHigh 7.5
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via Email/SaveAttachment function.
- Product
- Helpdeskadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its Workflow settingsCVE-2024-12568 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its form settingsCVE-2024-12567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of form settingsCVE-2024-12566 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its Text Block optionsCVE-2024-11636 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 9, 2025Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.CVE-2024-13256 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
- Product
- Email Contact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2025Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22802 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through <= 2.1.4.
- Product
- Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Emailing Subscription: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22540 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in seballero Emailing Subscription email-suscripcion allows Blind SQL Injection.This issue affects Emailing Subscription: from n/a through <= 1.4.1.
- Product
- Emailing Subscription
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Emailing Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (ReDCVE-2024-46242 · Other software · reported by MITREHigh 7.5
An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (ReDoS) via supplying a crafted string as e-mail address during registration.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025SpeakOut! Email Petitions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22309 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RopeSwingHld SpeakOut! Email Petitions speakout allows DOM-Based XSS.This issue affects SpeakOut! Email Petitions: from n/a through <= 4.4.2.
- Product
- SpeakOut! Email Petitions
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update SpeakOut! Email Petitions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Email Reminders: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56292 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Email Reminders email-reminders allows Stored XSS.This issue affects Email Reminders: from n/a through <= 2.0.5.
- Product
- Email Reminders
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Email Reminders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025SmartEmailing.cz: Reflected Cross-Site ScriptingCVE-2024-12261 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SmartEmailing.cz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'se-lists-updated' parameter in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- SmartEmailing.cz
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update SmartEmailing.cz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 6, 2025Email Subscribers by Icegram Express: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12311 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.44
- What to do
- Update Email Subscribers by Icegram Express to 5.7.44 or newer.
Jan 2, 2025Email Address Encoder: Cross-Site Request Forgery (CSRF)CVE-2024-43927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects Email Address Encoder: from n/a through <= 1.0.23.
- Product
- Email Address Encoder
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Email Address Encoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Metorik – Reports & Email Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-38691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Metorik Metorik – Reports & Email Automation for WooCommerce metorik-helper allows Cross Site Request Forgery.This issue affects Metorik – Reports & Email Automation for WooCommerce: from n/a through <= 1.7.1.
- Product
- Metorik – Reports & Email Automation for WooCommerce
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Metorik – Reports & Email Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests CVE-2024-53647 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.5
Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests without any restriction, potentially leading to abuse or denial of service.
- Product
- Trend Micro ID Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.com
Dec 19, 2024A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting dCVE-2024-12727 · Network & remote access · Sophos · reported by security-alert@sophos.comCritical 9.8
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.
- Product
- Sophos Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailiCVE-2024-55104 · Websites & servers · Phpgurukul · reported by MITREHigh 7.2
Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailid parameters.
- Product
- Online Nurse Hiring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Dec 16, 2024Multiple Admin Emails: Cross-Site Request Forgery (CSRF)CVE-2024-54388 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through <= 1.0.
- Product
- Multiple Admin Emails
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Multiple Admin Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Woo Custom Emails: Missing AuthorizationCVE-2023-32507 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in wp3sixty Woo Custom Emails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Custom Emails: from n/a through 2.2.
- Product
- Woo Custom Emails
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Woo Custom Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024BP Email Assign Templates: Reflected Cross-Site ScriptingCVE-2024-12441 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2025-24631 is likely a duplicate of this.
- Product
- BP Email Assign Templates
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 10, 2024Email Reminders: Stored Cross-Site ScriptingCVE-2024-11945 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Reminders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Email Reminders
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Email Reminders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2024An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages seCVE-2024-12174 · Other software · Tenable · reported by vulnreport@tenable.comLow 2.7
An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024GoDaddy Email Marketing: Missing AuthorizationCVE-2023-49156 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GoDaddy GoDaddy Email Marketing godaddy-email-marketing-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDaddy Email Marketing: from n/a through <= 1.4.3.
- Product
- GoDaddy Email Marketing
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update GoDaddy Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024BlossomThemes Email Newsletter: Missing AuthorizationCVE-2023-47849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Blossom Themes BlossomThemes Email Newsletter blossomthemes-email-newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through <= 2.2.4.
- Product
- BlossomThemes Email Newsletter
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update BlossomThemes Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Welcome Email Editor: Missing AuthorizationCVE-2023-47756 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Vongries Welcome Email Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcome Email Editor: from n/a through 5.0.6.
- Product
- Welcome Email Editor
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Welcome Email Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Reflected Cross-Site ScriptingCVE-2024-11436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Affected
- up to 1.4.19
- What to do
- Affects up to 1.4.19. Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 4, 2024Email Address Obfuscation: Stored Cross-Site ScriptingCVE-2024-11935 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Email Address Obfuscation
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Email Address Obfuscation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 2, 2024Post By Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52463 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Westwood Post By Email post-by-email allows Reflected XSS.This issue affects Post By Email: from n/a through <= 1.0.4b.
- Product
- Post By Email
- Affected
- up to 1.0.4b
- What to do
- Affects up to 1.0.4b. Update Post By Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024WP e-Commerce Style Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52462 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Reflected XSS.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
- Product
- WP e-Commerce Style Email
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2024A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected intCVE-2024-11990 · Other software · NetWin · reported by cve-coordination@incibe.esMedium 4.6
A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected into vulnerable parameters.
- Product
- SurgeMail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2024Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticaCVE-2024-11599 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comHigh 8.2
Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024sp-php-email-handler is a PHP package for handling contact form submissions.CVE-2024-53860 · Other software · Spencer14420 · reported by GitHubHigh 8.6
sp-php-email-handler is a PHP package for handling contact form submissions. Messages sent using this script are vulnerable to abuse, as the script allows anybody to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable malicious actors to use your server to send spam, phishing emails, or other malicious content, potentially damaging your domain's reputation and leading to blacklisting by email providers. Patched in version 1.0.0 by removing user-provided content from confirmation emails. All pre-release versions (alpha and beta) are vulnerable to this issue and should not be used. There are no workarounds for this issue. Users must upgrade to version 1.0.0 to mitigate the vulnerability.
- Product
- SPEmailHandler-PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.cCVE-2024-42333 · Other software · Zabbix · reported by security@zabbix.comLow 2.7
The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Nov 27, 2024Hustle – Email Marketing, Lead Generation, Optins, Popups: Unauthorized form submissionsCVE-2024-10580 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability check on the submit_form() function in all versions up to, and including, 7.8.5. This makes it possible for unauthenticated attackers to submit unpublished forms.
- Product
- Hustle – Email Marketing, Lead Generation, Optins, Popups
- Affected
- up to 7.8.5
- What to do
- Affects up to 7.8.5. Update Hustle – Email Marketing, Lead Generation, Optins, Popups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.