Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,528 results · page 35 of 111
Jan 25, 2025Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More: Stored Cross-Site ScriptingCVE-2025-0350 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Carousel and Logo Carousel in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 23, 2025An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the program to requests to allCVE-2024-55195 · Other software · reported by MITREHigh 7.5
An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the program to requests to allocate too much space.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.CVE-2024-55194 · Other software · Openimageio · reported by MITRECritical 9.8
OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component /OpenImageIO/fmath.h.
- Product
- Openimageio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string_view.h.CVE-2024-55193 · Other software · Openimageio · reported by MITRECritical 9.8
OpenImageIO v3.1.0.0dev was discovered to contain a segmentation violation via the component /OpenImageIO/string_view.h.
- Product
- Openimageio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*).CVE-2024-55192 · Other software · Openimageio · reported by MITRECritical 9.8
OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char const*).
- Product
- Openimageio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2025Save & Import Image from URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in basteln3rk Save & Import Image from URL save-import-image-from-url allows Reflected XSS.This issue affects Save & Import Image from URL: from n/a through <= 0.7.
- Product
- Save & Import Image from URL
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Save & Import Image from URL to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Image Gallery Box by CRUDLab: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-23938 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CRUDLab Image Gallery Box by CRUDLab image-gallery-box-by-crudlab allows PHP Local File Inclusion.This issue affects Image Gallery Box by CRUDLab: from n/a through <= 1.0.3.
- Product
- Image Gallery Box by CRUDLab
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Image Gallery Box by CRUDLab to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025Picture Gallery – Frontend Image Uploads, AJAX Photo List: Stored Cross-Site ScriptingCVE-2024-13584 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_pictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Picture Gallery – Frontend Image Uploads, AJAX Photo List
- Affected
- up to 1.5.19
- What to do
- Affects up to 1.5.19. Update Picture Gallery – Frontend Image Uploads, AJAX Photo List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 21, 2025Image Source Control: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22711 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Maier Image Source Control image-source-control-isc allows Reflected XSS.This issue affects Image Source Control: from n/a through <= 2.29.0.
- Product
- Image Source Control
- Affected
- up to 2.29.0
- What to do
- Affects up to 2.29.0. Update Image Source Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 18, 2025Picture Gallery – Frontend Image Uploads, AJAX Photo List: Stored Cross-Site ScriptingCVE-2024-12696 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisper_picture_upload_guest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Picture Gallery – Frontend Image Uploads, AJAX Photo List
- Affected
- up to 1.5.22
- What to do
- Affects up to 1.5.22. Update Picture Gallery – Frontend Image Uploads, AJAX Photo List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 18, 2025Image Source Control Lite – Show Image Credits and Captions: Reflected Cross-Site ScriptingCVE-2024-13515 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'path' parameter in all versions up to, and including, 2.28.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Image Source Control Lite – Show Image Credits and Captions
- Affected
- up to 2.28.0
- What to do
- Affects up to 2.28.0. Update Image Source Control Lite – Show Image Credits and Captions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jan 17, 2025zot is a production-ready vendor-neutral OCI image registry.CVE-2025-23208 · Other software · project-zot · reported by GitHubHigh 7.3
zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- zot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload fuCVE-2024-40514 · Other software · Themesbrand · reported by MITREMedium 4.6
Insecure Permissions vulnerability in themesebrand Chatvia v.5.3.2 allows a remote attacker to escalate privileges via the User profile name and image upload functions.
- Product
- Chatvia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function.CVE-2024-40513 · Other software · Themesbrand · reported by MITREMedium 4.6
An issue in themesebrand Chatvia v.5.3.2 allows a remote attacker to execute arbitrary code via the User profile Upload image function.
- Product
- Chatvia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Salvador – AI Image Generator: Missing AuthorizationCVE-2025-23954 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in awcode Salvador – AI Image Generator salvador-ai-image-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salvador – AI Image Generator: from n/a through <= 1.0.11.
- Product
- Salvador – AI Image Generator
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Salvador – AI Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Image Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23940 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in horiyuki Image Switcher image-switcher allows Stored XSS.This issue affects Image Switcher: from n/a through <= 0.1.1.
- Product
- Image Switcher
- Affected
- up to 0.1.1
- What to do
- Affects up to 0.1.1. Update Image Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Image Switcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23939 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KHAN-IT Image Switcher image-switcher allows Stored XSS.This issue affects Image Switcher: from n/a through <= 1.1.
- Product
- Image Switcher
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Image Switcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025imaGenius: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23772 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eugenio Petulla’ imaGenius imagenius allows Stored XSS.This issue affects imaGenius: from n/a through <= 1.7.
- Product
- imaGenius
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update imaGenius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2025Blogger Image Import: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23689 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a.
- Product
- Blogger Image Import
- What to do
- Update Blogger Image Import to the newest version.
Jan 15, 2025Photo Gallery – Image Gallery by Ape: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22317 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gallery Ape Photo Gallery – Image Gallery by Ape gallery-images-ape allows Reflected XSS.This issue affects Photo Gallery – Image Gallery by Ape: from n/a through <= 2.2.8.
- Product
- Photo Gallery – Image Gallery by Ape
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Photo Gallery – Image Gallery by Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Image Gallery – Responsive Photo Gallery: Reflected Cross-Site ScriptingCVE-2024-12403 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Image Gallery – Responsive Photo Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'awsmgallery' parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Image Gallery – Responsive Photo Gallery
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Image Gallery – Responsive Photo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 14, 2025Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function.CVE-2024-54730 · Other software · reported by MITREHigh 7.5
Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condiCVE-2024-48858 · Other software · BlackBerry · reported by secure@blackberry.comHigh 7.5
Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition in the context of the process using the image codec.
- Product
- QNX Software Development Platform (SDP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.com
Jan 14, 2025NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service conditCVE-2024-48857 · Other software · BlackBerry · reported by secure@blackberry.comHigh 7.5
NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition in the context of the process using the image codec.
- Product
- QNX Software Development Platform (SDP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.com
Jan 14, 2025Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition oCVE-2024-48856 · Other software · BlackBerry · reported by secure@blackberry.comCritical 9.8
Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition or execute code in the context of the process using the image codec.
- Product
- QNX Software Development Platform (SDP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.com
Jan 14, 2025Out-of-bounds read in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in thCVE-2024-48855 · Other software · BlackBerry · reported by secure@blackberry.comMedium 5.3
Out-of-bounds read in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the context of the process using the image codec.
- Product
- QNX Software Development Platform (SDP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.com
Jan 14, 2025Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the CVE-2024-48854 · Other software · BlackBerry · reported by secure@blackberry.comMedium 5.3
Off-by-one error in the TIFF image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause an information disclosure in the context of the process using the image codec.
- Product
- QNX Software Development Platform (SDP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.blackberry.com
Jan 9, 2025Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 beforeCVE-2024-13259 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.
- Product
- Image Sizes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025Modula Image Gallery: Arbitrary file uploadsCVE-2024-12853 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- Modula Image Gallery
- Affected
- up to 2.11.10
- What to do
- Affects up to 2.11.10. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Ultimate Image Hover Effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22585 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Ultimate Image Hover Effects ultimate-image-hover-effects allows DOM-Based XSS.This issue affects Ultimate Image Hover Effects: from n/a through <= 1.1.2.
- Product
- Ultimate Image Hover Effects
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Ultimate Image Hover Effects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Justified Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22518 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Justified Image Gallery justified-image-gallery allows Stored XSS.This issue affects Justified Image Gallery: from n/a through <= 1.0.
- Product
- Justified Image Gallery
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Justified Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Image Hover Effects for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22323 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Image Hover Effects for Elementor image-hover-effects-elementor-addon allows Stored XSS.This issue affects Image Hover Effects for Elementor: from n/a through <= 1.0.2.4.
- Product
- Image Hover Effects for Elementor
- Affected
- up to 1.0.2.4
- What to do
- Affects up to 1.0.2.4. Update Image Hover Effects for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator: Arbitrary files uploadsCVE-2024-12471 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator plugin for WordPress is vulnerable to arbitrary files uploads due to a missing capability check and file type validation on the add_image_to_library AJAX action function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.
- Product
- Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 7, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its Gallery settingsCVE-2024-10102 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.22
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Jan 7, 2025LazyLoad Background Images: Unauthorized modification of dataCVE-2024-12327 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LazyLoad Background Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pblzbg_save_settings() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings.
- Product
- LazyLoad Background Images
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update LazyLoad Background Images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025Image Magnify: Stored Cross-Site ScriptingCVE-2024-11445 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Image Magnify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'image_magnify' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Image Magnify
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Image Magnify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 6, 2025Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification.CVE-2024-45555 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system image.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2025Sensitive information disclosure due to missing authentication.CVE-2024-55538 · Other software · Acronis · reported by security@acronis.comMedium 4
Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis True Image (Windows) before build 41736, Acronis True Image OEM (macOS) before build 42571, Acronis True Image OEM (Windows) before build 42575.
- Product
- Acronis True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Jan 2, 2025Sensitive information disclosure due to insecure folder permissions.CVE-2024-49385 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736, Acronis True Image OEM (Windows) before build 42575.
- Product
- Acronis True Image
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Jan 2, 2025Gallery Images Ape: Missing AuthorizationCVE-2022-41995 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Galleryape Gallery Images Ape allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gallery Images Ape: from n/a through 2.2.8.
- Product
- Gallery Images Ape
- Affected
- up to 2.2.8
- What to do
- Affects up to 2.2.8. Update Gallery Images Ape to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Responsive Image Gallery, Gallery Album: Missing AuthorizationCVE-2023-45631 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.
- Product
- Responsive Image Gallery, Gallery Album
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Responsive Image Gallery, Gallery Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2024In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details pageCVE-2024-56352 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Image Mapper: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56016 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maartenhemmes Image Mapper image-mapper allows Reflected XSS.This issue affects Image Mapper: from n/a through <= 0.2.5.3.
- Product
- Image Mapper
- Affected
- up to 0.2.5.3
- What to do
- Affects up to 0.2.5.3. Update Image Mapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024WP Menu Image: Missing AuthorizationCVE-2024-52485 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Yudiz Solutions Ltd. WP Menu Image wp-menu-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Menu Image: from n/a through <= 2.2.
- Product
- WP Menu Image
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update WP Menu Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Nabz Image Gallery: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-55981 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabajit Roy Nabz Image Gallery nabz-image-gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through <= v1.00.
- Product
- Nabz Image Gallery
- Affected
- up to 1.00
- What to do
- Affects up to 1.00. Update Nabz Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Add image to Post: Cross-Site Request Forgery (CSRF)CVE-2024-54428 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in onigetoc Add image to Post add-image-to-post allows Stored XSS.This issue affects Add image to Post: from n/a through <= 0.6.
- Product
- Add image to Post
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update Add image to Post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024XPD Reduce Image Filesize: Cross-Site Request Forgery (CSRF)CVE-2024-54409 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in fzmaster XPD Reduce Image Filesize xpd-reduce-image-filesize allows Stored XSS.This issue affects XPD Reduce Image Filesize: from n/a through <= 1.0.
- Product
- XPD Reduce Image Filesize
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update XPD Reduce Image Filesize to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024ImageRecycle pdf & image compression: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54266 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImageRecycle ImageRecycle pdf & image compression imagerecycle-pdf-image-compression allows Reflected XSS.This issue affects ImageRecycle pdf & image compression: from n/a through <= 3.1.16.
- Product
- ImageRecycle pdf & image compression
- Affected
- up to 3.1.16
- What to do
- Affects up to 3.1.16. Update ImageRecycle pdf & image compression to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Image Regenerate & Select Crop: Missing AuthorizationCVE-2023-36680 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Iulia Cazan Image Regenerate & Select Crop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Regenerate & Select Crop: from n/a through 7.1.0.
- Product
- Image Regenerate & Select Crop
- Affected
- up to 7.1.0
- What to do
- Affects up to 7.1.0. Update Image Regenerate & Select Crop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Portfolio Gallery – Responsive Image Gallery: Missing AuthorizationCVE-2023-32585 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Total-Soft Portfolio Gallery – Responsive Image Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery – Responsive Image Gallery: from n/a through 1.4.6.
- Product
- Portfolio Gallery – Responsive Image Gallery
- Affected
- up to 1.4.6
- What to do
- Affects up to 1.4.6. Update Portfolio Gallery – Responsive Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.