Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,092 results · page 27 of 42
Jul 4, 2022Redirection for Contact Form 7: Does not escape a link generated before outputting it in an attributeCVE-2022-0250 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Redirection for Contact Form 7
- Fixed in
- 2.5.0
- What to do
- Update Redirection for Contact Form 7 to 2.5.0 or newer.
Jun 30, 2022deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').CVE-2021-40663 · Other software · Deep.assign Project · reported by MITRECritical 9.8
deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
- Product
- Deep.assign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Jun 29, 2022Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php.CVE-2021-40642 · Other software · Textpattern · reported by MITREMedium 4.3
Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is 0, it will cause a division by 0 exception.CVE-2021-33651 · Other software · Mindspore · reported by securities@openeuler.orgHigh 7.5
When performing the analytical operation of the DepthwiseConv2D operator, if the attribute depth_multiplier is 0, it will cause a division by 0 exception.
- Product
- Mindspore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list.CVE-2022-33114 · Other software · Jflyfox · reported by MITREHigh 7.2
Jfinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via the attrVal parameter at /jfinal_cms/system/dict/list.
- Product
- Jfinal CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022In getUniqueUsagesWithLabels of PermissionUsageHelper.java, there is a possible incorrect permission attribution due to a logic error in the code.CVE-2022-20193 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In getUniqueUsagesWithLabels of PermissionUsageHelper.java, there is a possible incorrect permission attribution due to a logic error in the code. This could lead to local escalation of privilege by conflating apps with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-212434116
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 13, 2022Mitsol Social Post Feed: Does not escape some of its settings before outputting them back in attributesCVE-2022-0209 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Mitsol Social Post Feed
- Fixed in
- 1.11
- What to do
- Update Mitsol Social Post Feed to 1.11 or newer.
Jun 13, 2022Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a RCVE-2022-1532 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Fixed in
- 1.3.8
- What to do
- Update the plugin to 1.3.8 or newer.
May 26, 2022This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocCVE-2021-28509 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.1
This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is that, in certain conditions, TerminAttr might leak MACsec sensitive data in clear text in CVP to other authorized users, which could cause MACsec traffic to be decrypted or modified by other authorized users on the device.
- Product
- Arista EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocCVE-2021-28508 · Other software · Arista Networks · reported by psirt@arista.comMedium 6.8
This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is that, in certain conditions, TerminAttr might leak IPsec sensitive data in clear text in CVP to other authorized users, which could cause IPsec traffic to be decrypted or modified by other authorized users on the device.
- Product
- Arista EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attriCVE-2022-27777 · Other software · Rubyonrails · reported by support@hackerone.comMedium 6.1
A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.
- Product
- Actionpack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.rubyonrails.orglists.debian.org
May 26, 2022A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.CVE-2022-30784 · Other software · Tuxera · reported by MITREHigh 7.8
A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
- Product
- Ntfs-3g
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022Check & Log Email: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1547 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Check & Log Email
- Fixed in
- 1.0.6
- What to do
- Update Check & Log Email to 1.0.6 or newer.
May 23, 2022Gwyn's Imagemap Selector: Does not sanitise and escape some parameters before outputting them back in attributesCVE-2022-1221 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting.
- Product
- Gwyn's Imagemap Selector
- Affected
- up to 0.3.3
- What to do
- Affects up to 0.3.3. Update Gwyn's Imagemap Selector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2022Domain Replace: Does not sanitise and escape a parameter before outputting it back in an attribute in an admin pageCVE-2022-1218 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Domain Replace
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update Domain Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Clipr: Does not sanitise and escape its API Key settings before outputting it in an attributeCVE-2022-1559 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
- Product
- Clipr
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Clipr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 16, 2022WPC Smart Wishlist for WooCommerce: Does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX actionCVE-2022-1465 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue.
- Product
- WPC Smart Wishlist for WooCommerce
- Fixed in
- 2.9.9
- What to do
- Update WPC Smart Wishlist for WooCommerce to 2.9.9 or newer.
May 16, 2022Call Now Button: Does not escape a parameter before outputting it back in an attribute of a hidden inputCVE-2022-1455 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled
- Product
- Call Now Button
- Fixed in
- 1.1.2
- What to do
- Update Call Now Button to 1.1.2 or newer.
May 16, 2022VikBooking Hotel Booking Engine & PMS: Does not escape various settings before outputting them in attributesCVE-2022-1408 · WordPress plugins & themes · reported by WPScanMedium 4.8
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- VikBooking Hotel Booking Engine & PMS
- Fixed in
- 1.5.8
- What to do
- Update VikBooking Hotel Booking Engine & PMS to 1.5.8 or newer.
May 16, 2022Custom TinyMCE Shortcode Button: Does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin pageCVE-2022-1217 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
- Product
- Custom TinyMCE Shortcode Button
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Custom TinyMCE Shortcode Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2022Advanced Image Sitemap: Does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin pageCVE-2022-1216 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting.
- Product
- Advanced Image Sitemap
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Advanced Image Sitemap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 10, 2022Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to ovCVE-2021-26370 · Other software · AMD · reported by psirt@amd.comHigh 7.1
Improper validation of destination address in SVC_LOAD_FW_IMAGE_BY_INSTANCE and SVC_LOAD_BINARY_BY_ATTRIB in a malicious UApp or ABL may allow an attacker to overwrite arbitrary bootloader memory with SPI ROM contents resulting in a loss of integrity and availability.
- Product
- 2nd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2022Vertical scroll recent post: Does not sanitise and escape a parameter before outputting it back in an attributeCVE-2022-1171 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Vertical scroll recent post
- Fixed in
- 14.0
- What to do
- Update Vertical scroll recent post to 14.0 or newer.
May 9, 2022Themify Post Type Builder Search Addon: Does not properly escape the current page URL before reusing it in a HTML attributeCVE-2022-1047 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability.
- Product
- Themify Post Type Builder Search Addon
- Fixed in
- 1.4.0
- What to do
- Update Themify Post Type Builder Search Addon to 1.4.0 or newer.
May 2, 2022Fast Flow: Does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboardCVE-2022-1269 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in an attribute in an admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Fast Flow
- Fixed in
- 1.2.12
- What to do
- Update Fast Flow to 1.2.12 or newer.
May 2, 2022Content Egg: Does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboardCVE-2022-0428 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Content Egg
- Fixed in
- 5.3.0
- What to do
- Update Content Egg to 5.3.0 or newer.
May 1, 2022All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magicalCVE-2022-25301 · Other software · Jsgui-lang-essentials Project · reported by report@snyk.ioHigh 7.7
All versions of package jsgui-lang-essentials are vulnerable to Prototype Pollution due to allowing all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype.
- Product
- Jsgui-lang-essentials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Donorbox: Does not sanitise and escape its Campaign URL settings before outputting it in an attributeCVE-2022-1396 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
- Product
- Donorbox
- Fixed in
- 7.1.7
- What to do
- Update Donorbox to 7.1.7 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 25, 2022Pricing Table by Supsystic: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46782 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pricing Table by Supsystic WordPress plugin before 1.9.5 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Pricing Table by Supsystic
- Fixed in
- 1.9.5
- What to do
- Update Pricing Table by Supsystic to 1.9.5 or newer.
Apr 25, 2022Coming Soon by Supsystic: Does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46781 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Coming Soon by Supsystic WordPress plugin before 1.7.6 does not sanitise and escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Coming Soon by Supsystic
- Fixed in
- 1.7.6
- What to do
- Update Coming Soon by Supsystic to 1.7.6 or newer.
Apr 25, 2022Easy Google Maps: Does not escape the tab parameter before outputting it back in an attribute in the admin dashboardCVE-2021-46780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Easy Google Maps
- Fixed in
- 1.9.32
- What to do
- Update Easy Google Maps to 1.9.32 or newer.
Apr 24, 2022Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0.CVE-2022-1452 · Other software · radareorg · reported by security@huntr.devHigh 7.1
Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
- Product
- radareorg/radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2022Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0.CVE-2022-1451 · Other software · radareorg · reported by security@huntr.devHigh 7.1
Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data past the end 2f the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. More details see [CWE-125: Out-of-bounds read](https://cwe.mitre.org/data/definitions/125.html).
- Product
- radareorg/radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022OSIsoft PI Vision 2020 versions prior to 3.5.0 could disclose information to a user with insufficient privileges for an AF attribute.CVE-2020-25167 · Other software · OSIsoft · reported by ics-cert@hq.dhs.govMedium 4.9
OSIsoft PI Vision 2020 versions prior to 3.5.0 could disclose information to a user with insufficient privileges for an AF attribute.
- Product
- PI Vision
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022In AttributionSource of AttributionSource.java, there is a possible permission bypass due to improper input validation.CVE-2021-39799 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In AttributionSource of AttributionSource.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-200288596
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 11, 2022Post Grid: Does not escape the keyword parameter before outputting it back in an attributeCVE-2021-24986 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form
- Product
- Post Grid
- Fixed in
- 2.1.16
- What to do
- Update Post Grid to 2.1.16 or newer.
Apr 8, 2022GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a use-after-free vulnerability in function gf_node_get_attribute_by_tag.CVE-2022-27147 · Other software · Gpac · reported by MITREMedium 5.5
GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a use-after-free vulnerability in function gf_node_get_attribute_by_tag.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2022Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password sCVE-2022-24681 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.
- Product
- Manageengine Adselfservice Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.comraxis.com
Apr 4, 2022Easy Social Icons: Does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statementCVE-2022-0887 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.
- Product
- Easy Social Icons
- Fixed in
- 3.1.4
- What to do
- Update Easy Social Icons to 3.1.4 or newer.
Apr 4, 2022Insights from Google PageSpeed: Does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboardCVE-2022-0431 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
- Product
- Insights from Google PageSpeed
- Fixed in
- 4.0.4
- What to do
- Update Insights from Google PageSpeed to 4.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 28, 2022Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POSCVE-2022-0427 · Websites & servers · GitLab · reported by cve@gitlab.comHigh 7.7
Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022Social Sharing: Does not escape the viewed post URL before outputting it back in onclick attributesCVE-2021-24746 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scripting issue.
- Product
- Social Sharing
- Fixed in
- 3.3.40
- What to do
- Update Social Sharing to 3.3.40 or newer.
Mar 27, 2022OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.CVE-2021-44211 · Other software · Open-xchange · reported by MITREMedium 5.4
OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopen-xchange.com
Mar 21, 2022SEO Plugin by Squirrly SEO: Does not escape the type parameter before outputting it back in an attribute in an admin pageCVE-2021-25019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- SEO Plugin by Squirrly SEO
- Fixed in
- 11.1.12
- What to do
- Update SEO Plugin by Squirrly SEO to 11.1.12 or newer.
Mar 14, 2022WordPress Multisite Content Copier/Updater: Does not sanitise and escape the s parameter before outputting it back in an attributeCVE-2022-0503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in the network dashboard
- Product
- WordPress Multisite Content Copier/Updater
- Fixed in
- 2.1.2
- What to do
- Update WordPress Multisite Content Copier/Updater to 2.1.2 or newer.
Mar 14, 2022Cookie Information | Free GDPR Consent Solution: Does not escape user data before outputting it back in attributes in the admin dashboardCVE-2022-0147 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Cookie Information | Free GDPR Consent Solution
- Fixed in
- 2.0.8
- What to do
- Update Cookie Information | Free GDPR Consent Solution to 2.0.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Persian Woocommerce: Does not escape the s parameter before outputting it back in an attribute in the admin dashboardCVE-2021-24940 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue
- Product
- Persian Woocommerce
- Affected
- up to 5.8.0
- What to do
- Affects up to 5.8.0. Update Persian Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022Cybersoldier: Does not sanitise and escape the URL settings before outputting it in an attributeCVE-2021-24895 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Cybersoldier WordPress plugin before 1.7.0 does not sanitise and escape the URL settings before outputting it in an attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Cybersoldier
- Fixed in
- 1.7.0
- What to do
- Update Cybersoldier to 1.7.0 or newer.
Mar 7, 2022WP Cerber Security, Anti-spam & Malware Scan: Does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboardCVE-2022-0429 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
- Product
- WP Cerber Security, Anti-spam & Malware Scan
- Fixed in
- 8.9.6
- What to do
- Update WP Cerber Security, Anti-spam & Malware Scan to 8.9.6 or newer.
Mar 7, 2022Product Feed PRO for WooCommerce: Does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user)CVE-2022-0426 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
- Product
- Product Feed PRO for WooCommerce
- Fixed in
- 11.2.3
- What to do
- Update Product Feed PRO for WooCommerce to 11.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.