Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
58 results · page 2 of 2
Mar 26, 2024Radio Player: Missing AuthorizationCVE-2024-2906 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
- Product
- Radio Player
- Affected
- up to 2.0.73
- What to do
- Affects up to 2.0.73. Update Radio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in WP Military WP Radio plugin <= 3.1.9 versions.CVE-2023-46150 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WP Military WP Radio plugin <= 3.1.9 versions.
- Affected
- up to 3.1.9
- What to do
- Affects up to 3.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 1, 2023Radio Buttons for Taxonomies: Cross-Site Request ForgeryCVE-2020-36740 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Radio Buttons for Taxonomies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the save_single_term() function. This makes it possible for unauthenticated attackers to save terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Radio Buttons for Taxonomies
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Radio Buttons for Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Nov 1, 2021MP3 Audio Player for Music, Radio & Podcast by Sonaar: Does not properly sanitize or escape data in some of its Playlist settingsCVE-2021-24624 · WordPress plugins & themes · reported by WPScanMedium 4.8
The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks
- Product
- MP3 Audio Player for Music, Radio & Podcast by Sonaar
- Fixed in
- 2.4.2
- What to do
- Update MP3 Audio Player for Music, Radio & Podcast by Sonaar to 2.4.2 or newer.
Oct 18, 2021StreamCast – Radio Player for: Does not sanitise or validate the parameters from its shortcodeCVE-2021-24416 · WordPress plugins & themes · reported by WPScanMedium 5.4
The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- Product
- StreamCast – Radio Player for
- Fixed in
- 2.1.1
- What to do
- Update StreamCast – Radio Player for to 2.1.1 or newer.
Aug 2, 2021OnAir2: And QT KenthaRadio WordPress plugin before 2CVE-2021-24472 · WordPress plugins & themes · reported by WPScanCritical 9.8
The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.
- Product
- OnAir2
- Fixed in
- 3.9.9.2
- What to do
- Update OnAir2 to 3.9.9.2 or newer.
May 14, 2021settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons: Did not properly sanitise the tab parameter before outputting it backCVE-2021-24287 · WordPress plugins & themes · reported by WPScanMedium 6.1
The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue
- Product
- settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
- Fixed in
- 1.3.2
- What to do
- Update settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons to 1.3.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Mar 3, 2014Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settiCVE-2014-2040 · WordPress plugins & themes · reported by MITRELow 2.1
Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file.
- Product
- Media File Renamer
- Affected
- 1.7.0 to 1.7.0
- What to do
- Affects 1.7.0 to 1.7.0. Update Media File Renamer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.