Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,547 results · page 160 of 391
Oct 18, 2021MainWP Child Reports: Does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboardCVE-2021-24754 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue
- Product
- MainWP Child Reports
- Fixed in
- 2.0.8
- What to do
- Update MainWP Child Reports to 2.0.8 or newer.
Oct 18, 2021Tutor LMS: Does not escape some of its settings before outputting them in attributesCVE-2021-24740 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Tutor LMS
- Fixed in
- 1.9.9
- What to do
- Update Tutor LMS to 1.9.9 or newer.
Oct 18, 2021Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files: Does not sanitise and escape some of its settings before outputting them in attributesCVE-2021-24736 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.
- Product
- Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files
- Fixed in
- 1.6.57
- What to do
- Update Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files to 1.6.57 or newer.
Oct 18, 2021Compact WP Audio Player: Does not implement nonce checksCVE-2021-24735 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers to make a logged in admin change the "Disable Simultaneous Play" setting via a CSRF attack.
- Product
- Compact WP Audio Player
- Fixed in
- 1.9.7
- What to do
- Update Compact WP Audio Player to 1.9.7 or newer.
Oct 18, 2021Compact WP Audio Player: Does not escape some of its shortcodes attributesCVE-2021-24734 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Compact WP Audio Player
- Fixed in
- 1.9.7
- What to do
- Update Compact WP Audio Player to 1.9.7 or newer.
Oct 18, 2021PDF Flipbook, 3D Flipbook WordPress – DearFlip: Does not escape the class attribute of its shortcode before outputting it back in an attributeCVE-2021-24732 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- PDF Flipbook, 3D Flipbook WordPress – DearFlip
- Fixed in
- 1.7.10
- What to do
- Update PDF Flipbook, 3D Flipbook WordPress – DearFlip to 1.7.10 or newer.
Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
- Product
- LearnPress
- Fixed in
- 4.1.3.1
- What to do
- Update LearnPress to 4.1.3.1 or newer.
Oct 18, 2021Find My Blocks: Does not have authorisation checks in its REST APICVE-2021-24677 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles.
- Product
- Find My Blocks
- Fixed in
- 3.4.0
- What to do
- Update Find My Blocks to 3.4.0 or newer.
Oct 18, 2021One User Avatar: Does not check for CSRFCVE-2021-24675 · WordPress plugins & themes · reported by WPScanMedium 6.5
The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [avatar_upload] shortcode is embed. As a result, attackers could make logged in user change their avatar via a CSRF attack
- Product
- One User Avatar
- Fixed in
- 2.3.7
- What to do
- Update One User Avatar to 2.3.7 or newer.
Oct 18, 2021One User Avatar: Does not escape the link and target attributes of its shortcodeCVE-2021-24672 · WordPress plugins & themes · reported by WPScanMedium 5.4
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- One User Avatar
- Fixed in
- 2.3.7
- What to do
- Update One User Avatar to 2.3.7 or newer.
Oct 18, 2021Scroll Baner: Does not have CSRF check in placeCVE-2021-24642 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS
- Product
- Scroll Baner
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Scroll Baner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Customer Service Software & Support Ticket System: Does not sanitize or escape form fields before outputting it in the ListCVE-2021-24622 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Customer Service Software & Support Ticket System
- Fixed in
- 5.10.4
- What to do
- Update Customer Service Software & Support Ticket System to 5.10.4 or newer.
Oct 18, 2021GamePress: Does not escape the op_edit POST parameter before outputting it back in multiple Game Option pagesCVE-2021-24617 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues
- Product
- GamePress
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update GamePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Wechat Reward: Does not sanitise or escape its QR settingsCVE-2021-24615 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.
- Product
- Wechat Reward
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Wechat Reward to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Sociable: Does not sanitise or escape some of its settings before outputting them in the admins dashboardCVE-2021-24612 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in the admins dashboard, allowing high privilege users to perform Cross-Site Scripting attacks against other users even when the unfiltered_html capability is disallowed
- Product
- Sociable
- Affected
- up to 4.3.4.1
- What to do
- Affects up to 4.3.4.1. Update Sociable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021PlanSo Forms: Does not escape the title of its Form before outputting it in attributesCVE-2021-24516 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
- Product
- PlanSo Forms
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update PlanSo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021StreamCast – Radio Player for: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24416 · WordPress plugins & themes · reported by WPScanMedium 5.4
The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- StreamCast – Radio Player for
- Fixed in
- 2.1.1
- What to do
- Update StreamCast – Radio Player for to 2.1.1 or newer.
Oct 18, 2021Polo Video Gallery – Best wordpress video gallery: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24415 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Polo Video Gallery – Best wordpress video gallery
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Polo Video Gallery – Best wordpress video gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2021Easy Twitter Feed: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24413 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Easy Twitter Feed
- Fixed in
- 1.2
- What to do
- Update Easy Twitter Feed to 1.2 or newer.
Oct 18, 2021Html5 Audio Player – Audio Player for: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24412 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- Html5 Audio Player – Audio Player for
- Fixed in
- 2.1.3
- What to do
- Update Html5 Audio Player – Audio Player for to 2.1.3 or newer.
Oct 15, 2021Easytest bulletin board management function of online learning platform does not filter special characters.CVE-2021-42335 · Other software · Huachu Digital Technology Co.,Ltd. · reported by twcert@cert.org.twMedium 5.4
Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack.
- Product
- Easytest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 15, 2021The “Study Edit” function of ShinHer StudyOnline System does not perform permission control.CVE-2021-42331 · Other software · ShinHer Information Co., LTD. · reported by twcert@cert.org.twMedium 5.4
The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.
- Product
- ShinHer StudyOnline System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 15, 2021The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control.CVE-2021-42330 · Other software · ShinHer Information Co., LTD. · reported by twcert@cert.org.twHigh 8.8
The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.
- Product
- ShinHer StudyOnline System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 15, 2021The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter.CVE-2021-42329 · Other software · ShinHer Information Co., LTD. · reported by twcert@cert.org.twMedium 5.4
The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.
- Product
- ShinHer StudyOnline System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 14, 2021LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy.CVE-2021-3882 · Other software · ledgersmb · reported by security@huntr.devMedium 6.8
LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the authentication data by capturing network traffic. LedgerSMB 1.8 and newer switched from Basic authentication to using cookie authentication with encrypted cookies. Although an attacker can't access the information inside the cookie, nor the password of the user, possession of the cookie is enough to access the application as the user from which the cookie has been obtained. In order for the attacker to obtain the cookie, first of all the server must be configured to respond to unencrypted requests, the attacker must be suitably positioned to eavesdrop on the network traffic between the client and the server *and* the user must be tricked into using unencrypted HTTP traffic. Proper audit control and separation of duties limit Integrity impact of the attack vector. Users of LedgerSMB 1.8 are urged to upgrade to known-fixed versions. Users of LedgerSMB 1.7 or 1.9 are unaffected by this vulnerability and don't need to take action.
- Product
- ledgersmb/ledgersmb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2021checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string.CVE-2021-42341 · Other software · Openrc Project · reported by MITREHigh 7.5
checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.
- Product
- Openrc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.gentoo.orggithub.com
Oct 13, 2021Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request wasCVE-2021-20126 · Network & remote access · Draytek · reported by vulnreport@tenable.comHigh 8.8
Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
- Product
- Vigorconnect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Oct 13, 2021The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle attackers to eavesdropCVE-2021-20833 · Other software · SODA, Inc. · reported by vultures@jpcert.or.jpHigh 7.4
The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle attackers to eavesdrop on and/or alter encrypted communication via a crafted certificate.
- Product
- SNKRDUNK Market Place App for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2021SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a mCVE-2021-38183 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in Cross-Site Scripting vulnerability.
- Product
- SAP NetWeaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Oct 11, 2021Comments – wpDiscuz: Does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the pageCVE-2021-24737 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Comments – wpDiscuz
- Affected
- up to 7.3.0
- What to do
- Affects up to 7.3.0. Update Comments – wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2021Appointment Hour Booking: Does not properly sanitize values usedCVE-2021-24712 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Appointment Hour Booking WordPress plugin before 1.3.17 does not properly sanitize values used when creating new calendars.
- Product
- Appointment Hour Booking
- Fixed in
- 1.3.17
- What to do
- Update Appointment Hour Booking to 1.3.17 or newer.
Oct 11, 2021del_reistered_domains AJAX action of the Software License Manager: Does not have any CSRF checksCVE-2021-24711 · WordPress plugins & themes · reported by WPScanHigh 8.8
The del_reistered_domains AJAX action of the Software License Manager WordPress plugin before 4.5.1 does not have any CSRF checks, and is vulnerable to a CSRF attack
- Product
- del_reistered_domains AJAX action of the Software License Manager
- Fixed in
- 4.5.1
- What to do
- Update del_reistered_domains AJAX action of the Software License Manager to 4.5.1 or newer.
Oct 11, 2021Weather Effect: Does not properly validate and escape some of its settings (like *_size_leafCVE-2021-24709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Weather Effect WordPress plugin before 1.3.6 does not properly validate and escape some of its settings (like *_size_leaf, *_flakes_leaf, *_speed) which could lead to Stored Cross-Site Scripting issues
- Product
- Weather Effect
- Fixed in
- 1.3.6
- What to do
- Update Weather Effect to 1.3.6 or newer.
Oct 11, 2021Quiz And Survey Master: Does not escape the Quiz Url Slug setting before outputting it in some pagesCVE-2021-24691 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz And Survey Master WordPress plugin before 7.3.2 does not escape the Quiz Url Slug setting before outputting it in some pages, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Quiz And Survey Master
- Fixed in
- 7.3.2
- What to do
- Update Quiz And Survey Master to 7.3.2 or newer.
Oct 11, 2021Chained Quiz: Does not properly sanitize or escape inputs in the plugin's settingsCVE-2021-24690 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Chained Quiz WordPress plugin before 1.2.7.2 does not properly sanitize or escape inputs in the plugin's settings.
- Product
- Chained Quiz
- Fixed in
- 1.2.7.2
- What to do
- Update Chained Quiz to 1.2.7.2 or newer.
Oct 11, 2021Weather Effect: Does not have any CSRF checks in placeCVE-2021-24683 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do not validate or escape them, which could lead to Stored Cross-Site Scripting issue.
- Product
- Weather Effect
- Fixed in
- 1.3.4
- What to do
- Update Weather Effect to 1.3.4 or newer.
Oct 11, 2021Duplicate Page: Does not sanitise or escape the Duplicate Post Suffix settings before outputting itCVE-2021-24681 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before outputting it, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Duplicate Page
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update Duplicate Page to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 11, 2021Simple Social Media Share Buttons: Does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used)CVE-2021-24656 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outputting it in the frontend pages or posts (depending on the settings used), allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Simple Social Media Share Buttons
- Fixed in
- 3.2.4
- What to do
- Update Simple Social Media Share Buttons to 3.2.4 or newer.
Oct 11, 2021Coming soon and Maintenance mode: Does not properly sanitize inputs submitted by authenticated usersCVE-2021-24577 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.
- Product
- Coming soon and Maintenance mode
- Fixed in
- 3.5.3
- What to do
- Update Coming soon and Maintenance mode to 3.5.3 or newer.
Oct 11, 2021Easy Accordion: Does not properly sanitize inputsCVE-2021-24576 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion.
- Product
- Easy Accordion
- Fixed in
- 2.0.22
- What to do
- Update Easy Accordion to 2.0.22 or newer.
Oct 11, 2021Frontend Uploader: Does not prevent HTML files from being uploaded via its formCVE-2021-24563 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
- Product
- Frontend Uploader
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Frontend Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Oct 11, 2021Gutenberg Block Editor Toolkit – EditorsKit: Does not sanitise and validate the Conditional Logic of the Custom Visibility settingsCVE-2021-24546 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code
- Product
- Gutenberg Block Editor Toolkit – EditorsKit
- Fixed in
- 1.31.6
- What to do
- Update Gutenberg Block Editor Toolkit – EditorsKit to 1.31.6 or newer.
Oct 11, 2021WP HTML Author Bio: Does not sanitise the HTML allowed in the Bio of usersCVE-2021-24545 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against users, which could potentially lead to privilege escalation when an admin view the related post/s.
- Product
- WP HTML Author Bio
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update WP HTML Author Bio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 8, 2021Tad Book3 editing book page does not perform identity verification.CVE-2021-41974 · Other software · Tad · reported by twcert@cert.org.twCritical 9.1
Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission.
- Product
- Tad Book3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 8, 2021TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging CVE-2021-41565 · Other software · Tad · reported by twcert@cert.org.twMedium 6.1
TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks.
- Product
- TadTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 8, 2021Tad Book3 editing book function does not filter special characters.CVE-2021-41563 · Other software · Tad · reported by twcert@cert.org.twMedium 6.1
Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
- Product
- Tad Book3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 7, 2021IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonateCVE-2021-20473 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 196944.
- Product
- Sterling File Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 7, 2021Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file.CVE-2021-3834 · Other software · Ártica · reported by cve-coordination@incibe.esMedium 5.4
Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).
- Product
- Integria IMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordintegriaims.comincibe.es
Oct 7, 2021In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the roCVE-2021-33903 · Other software · Lancom-systems · reported by MITREHigh 8.8
In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change the password of the root user for SNMPv3 access. (However, changing the password of the root user via LANconfig does change the password of the root user for SNMPv3 access.)
- Product
- Lcos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2021Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, rCVE-2021-21684 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Git Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.