Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
280 results · page 3 of 6
Jun 8, 2026Snipe-IT is an IT asset/license management system.CVE-2026-48507 · Other software · grokability · reported by GitHubHigh 7.1
Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Post Snippets: Stored Cross-Site ScriptingCVE-2026-7430 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Post Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.0.19. This is due to insufficient output escaping of imported snippet content when rendering JavaScript variables in the post editor. Specifically, the `jqueryUiDialog()` method in `WPEditor.php` embeds snippet content directly into JavaScript string literals without escaping double quotes (the quote-escaping code on line 214 is commented out). When snippets are imported via the Import/Export feature, the content bypasses WordPress's `wp_magic_quotes()` (which would otherwise add protective backslashes), allowing double quotes in snippet content to break out of the JavaScript string context. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts via a malicious import file that execute whenever any administrator accesses a post editor page. Please note that this does not affect single-site installations as administrators already have the `unfiltered_html` capability.
- Product
- Post Snippets
- Affected
- up to 4.0.19
- What to do
- Affects up to 4.0.19. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 27, 2026WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager: Remote Code ExecutionCVE-2026-8832 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capability_type or capability restrictions in the wpcode_register_post_type() function, allowing WordPress core to fall back to standard post capabilities for all creation paths including XML-RPC. This makes it possible for authenticated attackers, with author-level access and above, to create and publish executable PHP snippet posts via XML-RPC wp.newPost, which are then executed server-side via eval() in the run_eval() function when the snippet is rendered through the [wpcode] shortcode.
- Product
- WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 26, 2026Snipe-IT is an IT asset/license management system.CVE-2026-44833 · Other software · grokability · reported by GitHubMedium 5.9
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable. This vulnerability is fixed in 8.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Snipe-IT is an IT asset/license management system.CVE-2026-44832 · Other software · grokability · reported by GitHubHigh 8.7
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Snipe-IT is an IT asset/license management system.CVE-2026-44831 · Other software · grokability · reported by GitHubMedium 4.8
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, users with component view access could be impacted by an unescaped notes column, resulting in cross-site scripting (XSS). This vulnerability is fixed in 8.4.1.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbCVE-2026-37709 · Other software · Snipeitapp · reported by MITRECritical 9.8
Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context.CVE-2026-6019 · Other software · Python Software Foundation · reported by cna@python.orgLow 2.1
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026Text Snippets: Stored Cross-Site ScriptingCVE-2026-5748 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Text Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ts` shortcode in all versions up to, and including, 0.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Text Snippets
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update Text Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 14, 2026Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.CVE-2026-33829 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comgithub.com
Apr 14, 2026Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locCVE-2026-32183 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to mCVE-2026-38533 · Other software · Snipeitapp · reported by MITREMedium 6.5
An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify sensitive authentication and account-state fields of other non-admin users via supplying a crafted PUT request.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsnipeitapp.com
Apr 13, 2026Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowestCVE-2025-63743 · Other software · reported by MITREMedium 5.4
Cross-Site Scripting vulnerability in the Snipe-IT web-based asset management system v8.3.0 to up and including v8.3.1 allows authenticated attacker with lowest privileges sufficient only to log in, to inject arbitrary JavaScript code via "Name" and "Surname" fields. The JavaScript code is executed whenever "Activity Report" or modified profile is viewed directly by any user with sufficient permissions. Successful exploitation of this issue requires that the profile's "Display Name" is not set. The vulnerability is fixed in v8.3.2.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026DSGVO snippet for Leaflet Map and its Extensions: Stored Cross-Site ScriptingCVE-2026-4389 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DSGVO snippet for Leaflet Map and its Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `leafext-cookie-time` and `leafext-delete-cookie` shortcodes in all versions up to, and including, 3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes (`unset`, `before`, `after`). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- DSGVO snippet for Leaflet Map and its Extensions
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update DSGVO snippet for Leaflet Map and its Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2026Woody ad snippets: Improper Control of Generation of Code ('Code Injection')CVE-2026-25366 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.
- Product
- Woody ad snippets
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update Woody ad snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2026Post Snippets: Improper Control of Generation of Code ('Code Injection')CVE-2026-25001 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through <= 4.0.12.
- Product
- Post Snippets
- Affected
- up to 4.0.12
- What to do
- Affects up to 4.0.12. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 21, 2026Post Snippits: Cross-Site Request ForgeryCVE-2026-2723 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Post Snippits plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings page handlers for saving, adding, and deleting snippets. This makes it possible for unauthenticated attackers to modify plugin settings and inject malicious scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Post Snippits
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Post Snippits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 6, 2026Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment.CVE-2025-15602 · Other software · Grokability, Inc. · reported by VulnCheckHigh 8.7
Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsnipeitapp.com
Feb 6, 2026Code Snippets: Cross-Site Request ForgeryCVE-2026-1785 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce validation on the cloud snippet download and update actions in the Cloud_Search_List_Table class. This makes it possible for unauthenticated attackers to force logged-in administrators to download or update cloud snippets without their consent via a crafted request, granted they can trick an administrator into visiting a malicious page.
- Product
- Code Snippets
- Affected
- up to 3.9.4
- What to do
- Affects up to 3.9.4. Update Code Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Feb 3, 2026Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embedded JavaScript.CVE-2019-25264 · Other software · Snipeitapp · reported by VulnCheckMedium 5.1
Snipe-IT 4.7.5 contains a persistent cross-site scripting vulnerability that allows authorized users to upload malicious SVG files with embedded JavaScript. Attackers can craft SVG files with script tags to execute arbitrary JavaScript when the accessory is viewed by other users.
- Product
- IT Open Source Asset Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsnipeitapp.com
Jan 16, 2026SnipCommand 0.1.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into command snippets.CVE-2021-47841 · Other software · gurayyarar · reported by VulnCheckMedium 5.1
SnipCommand 0.1.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into command snippets. Attackers can execute arbitrary code by embedding malicious JavaScript that triggers remote command execution through file or title inputs.
- Product
- SnipCommand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025Post Snippets: Cross-Site Request Forgery (CSRF)CVE-2025-63040 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Post Snippets post-snippets allows Cross Site Request Forgery.This issue affects Post Snippets: from n/a through <= 4.0.11.
- Product
- Post Snippets
- Affected
- up to 4.0.11
- What to do
- Affects up to 4.0.11. Update Post Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 1, 2025Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in anCVE-2025-65622 · Other software · Snipeitapp · reported by MITREMedium 5.4
Snipe-IT before 8.3.4 allows stored XSS via the Locations "Country" field, enabling a low-privileged authenticated user to inject JavaScript that executes in another user's session.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2025Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enablingCVE-2025-65621 · Other software · Snipeitapp · reported by MITREMedium 5.4
Snipe-IT before 8.3.4 allows stored XSS, allowing a low-privileged authenticated user to inject JavaScript that executes in an administrator's session, enabling privilege escalation.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow.CVE-2025-64027 · Other software · Snipeitapp · reported by MITREMedium 6.1
Snipe-IT v8.3.4 (build 20218) contains a reflected cross-site scripting (XSS) vulnerability in the CSV Import workflow. When an invalid CSV file is uploaded, the application returns a progress_message value that is rendered as raw HTML in the admin interface. An attacker can intercept and modify the POST /livewire/update request to inject arbitrary HTML or JavaScript into the progress_message. Because the server accepts the modified input without sanitization and reflects it back to the user, arbitrary JavaScript executes in the browser of any authenticated admin who views the import page. NOTE: this is disputed by the Supplier because the report only demonstrates that an authenticated user can choose to conduct a man-in-the-middle attack against himself.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Code Snippets: PHP Code InjectionCVE-2025-13035 · WordPress plugins & themes · reported by WordfenceHigh 8
The Code Snippets plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 3.9.1. This is due to the plugin's use of extract() on attacker-controlled shortcode attributes within the `evaluate_shortcode_from_flat_file` method, which can be used to overwrite the `$filepath` variable and subsequently passed to require_once. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server via the `[code_snippet]` shortcode using PHP filter chains granted they can trick an administrator into enabling the "Enable file-based execution" setting and creating at least one active Content snippet.
- Product
- Code Snippets
- Affected
- up to 3.9.1
- What to do
- Affects up to 3.9.1. Update Code Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 5, 2025Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing CVE-2025-63601 · Other software · Snipeitapp · reported by MITRECritical 9.9
Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files and execute system commands.
- Product
- Snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddappsec.substack.comfptcloud.com
Oct 31, 2025Insert PHP Code Snippet: Missing AuthorizationCVE-2025-64356 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in f1logic Insert PHP Code Snippet insert-php-code-snippet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Insert PHP Code Snippet: from n/a through <= 1.4.3.
- Product
- Insert PHP Code Snippet
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Insert PHP Code Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Fidelo Snippet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53351 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fidelo Software GmbH Fidelo Snippet thebing-snippet allows Reflected XSS.This issue affects Fidelo Snippet: from n/a through <= 1.12.
- Product
- Fidelo Snippet
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Fidelo Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 15, 2025Rich Snippet Site Report: SQL InjectionCVE-2025-10310 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Rich Snippet Site Report plugin for WordPress is vulnerable to SQL Injection via the 'last' parameter in all versions up to, and including, 2.0.0105 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can also be exploited via CSRF.
- Product
- Rich Snippet Site Report
- Affected
- up to 2.0.0105
- What to do
- Affects up to 2.0.0105. Update Rich Snippet Site Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 8, 2025In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conveCVE-2025-5009 · Computers, phones & browsers · Google · reported by cve-coordination@google.comLow 1
In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet.
- Product
- Gemini
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permisCVE-2025-59303 · Other software · HAProxy · reported by MITREMedium 6.4
HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress Controller are 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1.
- Product
- HAProxy Kubernetes Ingress Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Snipe-IT before 8.1.18 allows unsafe deserialization.CVE-2025-59713 · Other software · snipeitapp · reported by MITREMedium 6.8
Snipe-IT before 8.1.18 allows unsafe deserialization.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025Snipe-IT before 8.1.18 allows XSS.CVE-2025-59712 · Other software · snipeitapp · reported by MITREMedium 6.4
Snipe-IT before 8.1.18 allows XSS.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2025Solady is software that provides Solidity snippets with APIs.CVE-2025-53638 · Other software · Vectorized · reported by GitHubMedium 6.9
Solady is software that provides Solidity snippets with APIs. Starting in version 0.0.125 and prior to version 0.1.24, when an account is deployed via a proxy, using regular Solidity to call its initialization function may result in a silent failure, if the initialization function does not return a `bool` or some other return data. This is because regular Solidity uses `extcodesize(proxy)` to decide if call succeeds. This is insufficient in the case when the proxy points to an empty implementation. Users should upgrade to Solady v0.1.24 or later to receive a patch. Deploy any affected implementations and their factories on new EVM chains as soon as possible.
- Product
- solady
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025FluentSnippets: Cross-Site Request Forgery (CSRF)CVE-2025-54010 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel FluentSnippets easy-code-manager allows Cross Site Request Forgery.This issue affects FluentSnippets: from n/a through <= 10.50.
- Product
- FluentSnippets
- Affected
- up to 10.50
- What to do
- Affects up to 10.50. Update FluentSnippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2025OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects.CVE-2025-46822 · Other software · OsamaTaher · reported by GitHubHigh 7.7
OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.
- Product
- Java-springboot-codebase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.CVE-2025-47226 · Other software · snipeitapp · reported by MITREMedium 5
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
- Product
- Snipe-IT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025WebberZone Snippetz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31874 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay WebberZone Snippetz add-to-all allows Stored XSS.This issue affects WebberZone Snippetz: from n/a through <= 2.1.1.
- Product
- WebberZone Snippetz
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update WebberZone Snippetz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Google SEO Pressor Snippet: Cross-Site Request Forgery (CSRF)CVE-2025-31775 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Smackcoders Inc., Google SEO Pressor Snippet google-seo-author-snippets allows Cross Site Request Forgery.This issue affects Google SEO Pressor Snippet: from n/a through <= 2.0.
- Product
- Google SEO Pressor Snippet
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Google SEO Pressor Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 31, 2025Google SEO Pressor Snippet: Missing AuthorizationCVE-2025-31530 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Smackcoders Inc., Google SEO Pressor Snippet google-seo-author-snippets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google SEO Pressor Snippet: from n/a through <= 2.0.
- Product
- Google SEO Pressor Snippet
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Google SEO Pressor Snippet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 7, 2025The Code Snippets CPT: Arbitrary shortcode executionCVE-2024-13895 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The The Code Snippets CPT plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The Code Snippets CPT
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update The Code Snippets CPT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 16, 2025Content Snippet Manager: Cross-Site Request Forgery (CSRF)CVE-2025-26759 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager content-snippet-manager allows Stored XSS.This issue affects Content Snippet Manager: from n/a through <= 1.1.5.
- Product
- Content Snippet Manager
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Content Snippet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Snippy: Cross-Site Request Forgery (CSRF)CVE-2025-23803 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Rik Schennink Snippy snippy allows Reflected XSS.This issue affects Snippy: from n/a through <= 1.4.1.
- Product
- Snippy
- Affected
- up to 1.4.1
- What to do
- Affects up to 1.4.1. Update Snippy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Easy Code Snippets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-23780 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alpha BPO Easy Code Snippets easy-code-snippets allows SQL Injection.This issue affects Easy Code Snippets: from n/a through <= 1.0.2.
- Product
- Easy Code Snippets
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Easy Code Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Cache Sniper for Nginx: Missing AuthorizationCVE-2025-23776 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in ekaterir Cache Sniper for Nginx snipe-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cache Sniper for Nginx: from n/a through <= 1.0.4.2.
- Product
- Cache Sniper for Nginx
- Affected
- up to 1.0.4.2
- What to do
- Affects up to 1.0.4.2. Update Cache Sniper for Nginx to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024Snippet Shortcodes: Unauthorized Shortcode DeletionCVE-2024-12018 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Shortcodes.
- Product
- Snippet Shortcodes
- Affected
- up to 4.1.6
- What to do
- Affects up to 4.1.6. Update Snippet Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 7, 2024Easy Code Snippets: Reflected Cross-Site ScriptingCVE-2024-11464 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Easy Code Snippets plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Easy Code Snippets
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Easy Code Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 19, 2024codeSnips: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51808 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pat O’Brien codeSnips codesnips allows Stored XSS.This issue affects codeSnips: from n/a through <= 1.2.
- Product
- codeSnips
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update codeSnips to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2024An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field.CVE-2024-51094 · Other software · snipeitapp · reported by MITREHigh 8
An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be executed, allowing the attacker to exfiltrate internal system data from the CSV file to a remote server.
- Product
- snipe-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.githubusercontent.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.