Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,184 results · page 30 of 64
May 23, 2024IDonate: Does not sanitise and escape some of its settingsCVE-2024-3594 · WordPress plugins & themes · reported by WPScanHigh 8.7
The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- IDonate
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update IDonate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024Button contact VR: Does not sanitise and escape some of its settingsCVE-2024-2220 · WordPress plugins & themes · reported by WPScanLow 3.5
The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Button contact VR
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update Button contact VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Carousel Slider: Does not sanitise and escape some parametersCVE-2024-4372 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
- Product
- Carousel Slider
- Fixed in
- 2.2.11
- What to do
- Update Carousel Slider to 2.2.11 or newer.
May 21, 2024Sailthru Triggermail: Does not sanitise and escape some of its settingsCVE-2024-4290 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Sailthru Triggermail: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-4289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Survey Maker: Does not sanitise and escape some of its settingsCVE-2024-4061 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Survey Maker
- Fixed in
- 4.2.9
- What to do
- Update Survey Maker to 4.2.9 or newer.
May 21, 2024Social Icons Widget & Block by WPZOOM: Does not sanitise and escape some of its Widget settingsCVE-2024-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Icons Widget & Block by WPZOOM
- Fixed in
- 4.2.18
- What to do
- Update Social Icons Widget & Block by WPZOOM to 4.2.18 or newer.
May 20, 2024All in One SEO: Does not validate and escape some of its Post fields before outputting them backCVE-2024-3368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- All in One SEO
- Fixed in
- 4.6.1.1
- What to do
- Update All in One SEO to 4.6.1.1 or newer.
May 17, 2024Captcha by BestWebSoft: Guessable CAPTCHACVE-2024-31295 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Guessable CAPTCHA vulnerability in BestWebSoft Captcha by BestWebSoft allows Functionality Bypass.This issue affects Captcha by BestWebSoft: from n/a through 5.2.0.
- Product
- Captcha by BestWebSoft
- Affected
- up to 5.2.0
- What to do
- Affects up to 5.2.0. Update Captcha by BestWebSoft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024VS Contact Form: Guessable CAPTCHACVE-2024-30540 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Guessable CAPTCHA vulnerability in Guido VS Contact Form allows Functionality Bypass.This issue affects VS Contact Form: from n/a through 14.7.
- Product
- VS Contact Form
- Affected
- up to 14.7
- What to do
- Affects up to 14.7. Update VS Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Popup4Phone: Does not sanitise and escape some of its settingsCVE-2024-3580 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Popup4Phone
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Popup4Phone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2024Popup4Phone: Does not sanitise and escape some parametersCVE-2024-3231 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Popup4Phone
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Popup4Phone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2024NextGEN Gallery: Does not sanitise and escape some of its settingsCVE-2024-2744 · WordPress plugins & themes · reported by WPScanMedium 4.3
The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- NextGEN Gallery
- Fixed in
- 3.59.1
- What to do
- Update NextGEN Gallery to 3.59.1 or newer.
May 17, 2024socialdriver-framework: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-2697 · WordPress plugins & themes · reported by WPScanMedium 6.5
The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- socialdriver-framework
- Fixed in
- 2024.0.0
- What to do
- Update socialdriver-framework to 2024.0.0 or newer.
May 16, 2024Newsletter Popup: Does not sanitise and escape some of its settingsCVE-2024-3644 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2024Newsletter Popup: Does not sanitise and escape some parametersCVE-2024-3641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024month name translation benaceur: Does not sanitise and escape some of its settingsCVE-2024-3634 · WordPress plugins & themes · reported by WPScanMedium 4.8
The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- month name translation benaceur
- Fixed in
- 2.3.8
- What to do
- Update month name translation benaceur to 2.3.8 or newer.
May 15, 2024HL Twitter: Does not sanitise and escape some of its settingsCVE-2024-3630 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3548 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.1.2
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.2 or newer.
May 14, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3241 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Ultimate Blocks
- Fixed in
- 3.1.7
- What to do
- Update Ultimate Blocks to 3.1.7 or newer.
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in some placesCVE-2024-3941 · WordPress plugins & themes · reported by WPScanMedium 4.7
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
- Product
- reCAPTCHA Jetpack
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in placeCVE-2024-3940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- reCAPTCHA Jetpack
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Post Grid Gutenberg Blocks and WordPress Blog
- Fixed in
- 4.0.2
- What to do
- Update Post Grid Gutenberg Blocks and WordPress Blog to 4.0.2 or newer.
May 14, 2024Save as PDF Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2023-5971 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as PDF Plugin by Pdfcrowd
- Fixed in
- 3.2.0
- What to do
- Update Save as PDF Plugin by Pdfcrowd to 3.2.0 or newer.
May 7, 2024EasyEvent: Does not sanitise and escape some of its settingsCVE-2024-3628 · WordPress plugins & themes · reported by WPScanLow 3.8
The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- EasyEvent
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update EasyEvent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024MF Gig Calendar: Does not sanitise and escape some of its settingsCVE-2024-3755 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- MF Gig Calendar
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024Crelly Slider: Does not sanitise and escape some of its settingsCVE-2024-3752 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Crelly Slider
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Crelly Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024Fancy Product Designer: Does not sanitise and escape some of its settingsCVE-2024-0904 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fancy Product Designer
- Fixed in
- 6.1.81
- What to do
- Update Fancy Product Designer to 6.1.81 or newer.
May 3, 2024Carousel Slider: Does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embedCVE-2024-3703 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Carousel Slider
- Fixed in
- 2.2.10
- What to do
- Update Carousel Slider to 2.2.10 or newer.
May 3, 2024Responsive Contact Form Builder & Lead Generation: Does not sanitise and escape some of its settingsCVE-2024-3637 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Contact Form Builder & Lead Generation
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 29, 2024Smart Forms: Does not sanitise and escape some of its settingsCVE-2024-1905 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Smart Forms
- Fixed in
- 2.6.96
- What to do
- Update Smart Forms to 2.6.96 or newer.
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.1.0
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Apr 26, 2024MM-email2image: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3075 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- MM-email2image
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024ENL Newsletter: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-3060 · WordPress plugins & themes · reported by WPScanMedium 4.5
The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Bannerlid: Does not escape generated URLs before outputting them in attributesCVE-2024-3048 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators
- Product
- Bannerlid
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Bannerlid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Call Now Button: Does not sanitise and escape some of its settingsCVE-2024-2908 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Call Now Button
- Fixed in
- 1.4.7
- What to do
- Update Call Now Button to 1.4.7 or newer.
Apr 26, 2024WP Chat App: Does not sanitise and escape some of its settingsCVE-2024-2837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WP Chat App
- Fixed in
- 3.6.4
- What to do
- Update WP Chat App to 3.6.4 or newer.
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2603 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2439 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2024-2310 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Google Review Slider
- Fixed in
- 13.6
- What to do
- Update WP Google Review Slider to 13.6 or newer.
Apr 26, 2024Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2159 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Social Sharing
- Fixed in
- 3.3.61
- What to do
- Update Social Sharing to 3.3.61 or newer.
Apr 26, 2024Fancy Product Designer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0905 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users
- Product
- Fancy Product Designer
- Fixed in
- 6.1.8
- What to do
- Update Fancy Product Designer to 6.1.8 or newer.
Apr 25, 2024Advanced Search: Does not properly escape parameters appended to an SQL queryCVE-2024-3265 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
- Product
- Advanced Search
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Advanced Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2024AGCA: Does not sanitise and escape some of its settingsCVE-2024-2907 · WordPress plugins & themes · reported by WPScanMedium 6.8
The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AGCA
- Fixed in
- 7.2.2
- What to do
- Update AGCA to 7.2.2 or newer.
Apr 24, 2024Strong Testimonials: Does not validate and escape some of its Testimonial fields before outputting them back in a page/postCVE-2024-3261 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The attack requires a specific view to be performed
- Product
- Strong Testimonials
- Fixed in
- 3.1.12
- What to do
- Update Strong Testimonials to 3.1.12 or newer.
Apr 24, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-2972 · WordPress plugins & themes · reported by WPScanLow 3.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
- Fixed in
- 3.1.9
- What to do
- Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.1.9 or newer.
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2404 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers to perform Stored Cross-Site Scripting attacks.
- Product
- Better Comments
- Fixed in
- 1.5.6
- What to do
- Update Better Comments to 1.5.6 or newer.
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2402 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Better Comments
- Fixed in
- 1.5.6
- What to do
- Update Better Comments to 1.5.6 or newer.
Apr 24, 2024WooCommerce Customers Manager: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-1743 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.8
- What to do
- Update WooCommerce Customers Manager to 29.8 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.