Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

585new WordPress flaws this week

391,310entries in the database

2,092 results · page 29 of 42

Dec 6, 2021WP Google Fonts: Does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributesCVE-2021-24935 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues
Product
WP Google Fonts
Fixed in
3.1.5
What to do
Update WP Google Fonts to 3.1.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 6, 2021Email Log: Does not escape the d parameter before outputting it back in an attribute in the Log pageCVE-2021-24924 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue
Product
Email Log
Fixed in
2.4.8
What to do
Update Email Log to 2.4.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 6, 2021PDF.js Viewer: Does not escape some of its shortcode and Gutenberg Block attributesCVE-2021-24759 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, which could allow users with a role as low as Contributor to to perform Cross-Site Scripting attacks
Product
PDF.js Viewer
Fixed in
2.0.2
What to do
Update PDF.js Viewer to 2.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 30, 2021Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with CVE-2021-42122 · Other software · Business-DNA Solutions GmbH · reported by vulnerability@ncsc.chMedium 4.3
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format, which makes the affected attribute non-editable.
Product
TopEase
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record confluence.topease.ch confluence.topease.ch
Nov 30, 2021Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(sCVE-2021-42121 · Other software · Business-DNA Solutions GmbH · reported by vulnerability@ncsc.chMedium 4.3
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(s) allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format into date fields, which leads to breaking the object page that the date field is present.
Product
TopEase
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record confluence.topease.ch confluence.topease.ch
Nov 30, 2021Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allowsCVE-2021-42120 · Other software · Business-DNA Solutions GmbH · reported by vulnerability@ncsc.chMedium 6.5
Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification privileges to insert arbitrarily long strings, eventually leading to exhaustion of the underlying resource.
Product
TopEase
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record confluence.topease.ch confluence.topease.ch
Nov 29, 2021Check & Log Email: Does not escape the d parameter before outputting it back in an attributeCVE-2021-24908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Check & Log Email
Fixed in
1.0.4
What to do
Update Check & Log Email to 1.0.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021Registrations for the Events Calendar: Does not escape the v parameter before outputting it back in an attributeCVE-2021-24876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
Registrations for the Events Calendar
Fixed in
2.7.5
What to do
Update Registrations for the Events Calendar to 2.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021GenerateBlocks: Does not validate the generateblocks/container block's tagName attributeCVE-2021-24751 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
GenerateBlocks
Fixed in
1.4.0
What to do
Update GenerateBlocks to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 29, 2021About Author Box: Does not sanitise and escape the Social Profiles field values before outputting them in attributesCVE-2021-24745 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
Product
About Author Box
Fixed in
1.0.2
What to do
Update About Author Box to 1.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021eCommerce Product Catalog Plugin for: Does not escape the ic-settings-search parameter before outputting it back in the page in an attributeCVE-2021-24875 · WordPress plugins & themes · reported by WPScanMedium 6.1
The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
eCommerce Product Catalog Plugin for
Fixed in
3.0.39
What to do
Update eCommerce Product Catalog Plugin for to 3.0.39 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 23, 2021Tutor LMS: Does not sanitise and escape user input before outputting back in attributes in the Student Registration pageCVE-2021-24873 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
Product
Tutor LMS
Fixed in
1.9.11
What to do
Update Tutor LMS to 1.9.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 22, 2021OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.CVE-2021-38375 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.
Product
OX App Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 17, 2021PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a LiCVE-2021-43553 · Other software · OSIsoft · reported by ics-cert@hq.dhs.govLow 3.1
PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a Limits property.
Product
PI Vision
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Nov 15, 2021IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2021-38977 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 212782.
Product
Security Key Lifecycle Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Nov 14, 2021Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.phpCVE-2021-43617 · Other software · Laravel · reported by MITRECritical 9.8
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
Product
Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com salsa.debian.org
Nov 13, 2021json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3918 · Other software · kriszyp · reported by security@huntr.devCritical 9.8
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Product
kriszyp/json-schema
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Nov 10, 2021Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-maCVE-2021-33618 · Other software · Dolibarr · reported by MITREMedium 6.1
Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org github.com
Nov 10, 2021pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.CVE-2020-23874 · Other software · Science-miner · reported by MITRECritical 9.8
pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.
Product
Pdf2xml
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwe.mitre.org github.com
Nov 8, 2021Print-O-Matic: Does not escape some of its settings before outputting them in attributeCVE-2021-24710 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Print-O-Matic
Fixed in
2.0.3
What to do
Update Print-O-Matic to 2.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 8, 2021Simple Download Monitor: Does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributesCVE-2021-24697 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Simple Download Monitor
Fixed in
3.9.5
What to do
Update Simple Download Monitor to 3.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 8, 2021School Management System – WPSchoolPress: Sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributesCVE-2021-24664 · WordPress plugins & themes · reported by WPScanMedium 4.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
Product
School Management System – WPSchoolPress
Fixed in
2.1.17
What to do
Update School Management System – WPSchoolPress to 2.1.17 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Nov 8, 2021A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester.CVE-2021-42770 · Other software · Opnsense · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester.
Product
Opnsense
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.orange.com github.com
Nov 1, 2021SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter.CVE-2021-26739 · Other software · Doyocms Project · reported by MITRECritical 9.8
SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter.
Product
Doyocms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 1, 2021BP Better Messages: Sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attributeCVE-2021-24808 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Product
BP Better Messages
Fixed in
1.9.9.41
What to do
Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 1, 2021WPeMatico RSS Feed Fetcher: Does not escape the Feed URL added to a campaign before outputting it in an attributeCVE-2021-24793 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
WPeMatico RSS Feed Fetcher
Fixed in
2.6.12
What to do
Update WPeMatico RSS Feed Fetcher to 2.6.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Cool Tag Cloud: Does not escape the style attribute of the cool_tag_cloud shortcodeCVE-2021-24682 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
Product
Cool Tag Cloud
Fixed in
2.26
What to do
Update Cool Tag Cloud to 2.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021YOP Poll: Does not escape the perpage parameter before outputting it back in an attributeCVE-2021-24885 · WordPress plugins & themes · reported by WPScanMedium 6.1
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Product
YOP Poll
Fixed in
6.1.2
What to do
Update YOP Poll to 6.1.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Oct 25, 2021Video Gallery: Does not escape the Title and Description of the videos in a gallery before outputting them in attributesCVE-2021-24515 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues
Product
Video Gallery
Fixed in
1.1.5
What to do
Update Video Gallery to 1.1.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 21, 2021IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookiesCVE-2021-29883 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 207090.
Product
Transformation Extender Advanced
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Oct 20, 2021Possible stack buffer overflow due to lack of check on the maximum number of post NAN discovery attributes while processing a NAN Match event in Snapdragon AutoCVE-2021-1967 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.3
Possible stack buffer overflow due to lack of check on the maximum number of post NAN discovery attributes while processing a NAN Match event in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Oct 18, 2021Tutor LMS: Does not escape some of its settings before outputting them in attributesCVE-2021-24740 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Tutor LMS
Fixed in
1.9.9
What to do
Update Tutor LMS to 1.9.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files: Does not sanitise and escape some of its settings before outputting them in attributesCVE-2021-24736 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.
Product
Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files
Fixed in
1.6.57
What to do
Update Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files to 1.6.57 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021Compact WP Audio Player: Does not escape some of its shortcodes attributesCVE-2021-24734 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks.
Product
Compact WP Audio Player
Fixed in
1.9.7
What to do
Update Compact WP Audio Player to 1.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021PDF Flipbook, 3D Flipbook WordPress – DearFlip: Does not escape the class attribute of its shortcode before outputting it back in an attributeCVE-2021-24732 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of its shortcode before outputting it back in an attribute, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
PDF Flipbook, 3D Flipbook WordPress – DearFlip
Fixed in
1.7.10
What to do
Update PDF Flipbook, 3D Flipbook WordPress – DearFlip to 1.7.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021One User Avatar: Does not escape the link and target attributes of its shortcodeCVE-2021-24672 · WordPress plugins & themes · reported by WPScanMedium 5.4
The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
One User Avatar
Fixed in
2.3.7
What to do
Update One User Avatar to 2.3.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 18, 2021PlanSo Forms: Does not escape the title of its Form before outputting it in attributesCVE-2021-24516 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
Product
PlanSo Forms
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update PlanSo Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 14, 2021LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy.CVE-2021-3882 · Other software · ledgersmb · reported by security@huntr.devMedium 6.8
LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be able to obtain the authentication data by capturing network traffic. LedgerSMB 1.8 and newer switched from Basic authentication to using cookie authentication with encrypted cookies. Although an attacker can't access the information inside the cookie, nor the password of the user, possession of the cookie is enough to access the application as the user from which the cookie has been obtained. In order for the attacker to obtain the cookie, first of all the server must be configured to respond to unencrypted requests, the attacker must be suitably positioned to eavesdrop on the network traffic between the client and the server *and* the user must be tricked into using unencrypted HTTP traffic. Proper audit control and separation of duties limit Integrity impact of the attack vector. Users of LedgerSMB 1.8 are urged to upgrade to known-fixed versions. Users of LedgerSMB 1.7 or 1.9 are unaffected by this vulnerability and don't need to take action.
Product
ledgersmb/ledgersmb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Oct 4, 2021Modern Events Calendar Lite: Does not escape some of its settings before outputting them in attributesCVE-2021-24687 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Modern Events Calendar Lite WordPress plugin before 5.22.2 does not escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Modern Events Calendar Lite
Fixed in
5.22.2
What to do
Update Modern Events Calendar Lite to 5.22.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 4, 2021CM Tooltip Glossary: Does not escape some glossary_tooltip shortcode attributesCVE-2021-24678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CM Tooltip Glossary WordPress plugin before 3.9.21 does not escape some glossary_tooltip shortcode attributes, which could allow users a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
CM Tooltip Glossary
Fixed in
3.9.21
What to do
Update CM Tooltip Glossary to 3.9.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021MX Time Zone Clocks: Does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcodeCVE-2021-24671 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_clocks shortcode, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
Product
MX Time Zone Clocks
Fixed in
3.4.1
What to do
Update MX Time Zone Clocks to 3.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021CoolClock: Does not escape some shortcode attributesCVE-2021-24670 · WordPress plugins & themes · reported by WPScanMedium 5.4
The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low as Contributor toperform Stored Cross-Site Scripting attacks
Product
CoolClock
Fixed in
4.3.5
What to do
Update CoolClock to 4.3.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 27, 2021WP Map Block: Does not escape some attributes of the WP Map BlockCVE-2021-24643 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Product
WP Map Block
Fixed in
1.2.3
What to do
Update WP Map Block to 1.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as lCVE-2021-24640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Slider Block Gutenslider plugin before 5.2.0 does not escape the minWidth attribute of a Gutenburg block, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
WordPress Slider Block Gutenslider
Fixed in
5.2.0
What to do
Update WordPress Slider Block Gutenslider to 5.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021WP Mapa Politico Espana: Does not sanitise or escape some of its settings before outputting them in attributesCVE-2021-24609 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Mapa Politico Espana WordPress plugin before 3.7.0 does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Product
WP Mapa Politico Espana
Fixed in
3.7.0
What to do
Update WP Mapa Politico Espana to 3.7.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Availability Calendar: Does not escape the category attribute from its shortcode before using it in a SQL statementCVE-2021-24606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
Product
Availability Calendar
Fixed in
1.2.1
What to do
Update Availability Calendar to 1.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 20, 2021Shortcodes Ultimate: Allows users with Contributor roles to perform stored XSS via shortcode attributesCVE-2021-24525 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).
Product
Shortcodes Ultimate
Fixed in
5.10.2
What to do
Update Shortcodes Ultimate to 5.10.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 17, 2021object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3805 · Other software · mariocasciaro · reported by security@huntr.devHigh 7.5
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Product
mariocasciaro/object-path
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Sep 13, 2021body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3666 · Other software · fiznool · reported by security@huntr.devCritical 9.8
body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Product
fiznool/body-parser-xml
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Sep 10, 2021merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3645 · Other software · viking04 · reported by security@huntr.devCritical 9.8
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Product
viking04/merge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.