Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
640 results · page 4 of 13
Nov 20, 2024Quick Learn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2024-52441 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Rajesh Thanoch Quick Learn quick-learn allows Object Injection.This issue affects Quick Learn: from n/a through <= 1.0.1.
- Product
- Quick Learn
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Quick Learn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Simple File List: Does not sanitise and escape a generated URL before outputting it back in an attributeCVE-2024-10146 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.
- Product
- Simple File List
- Fixed in
- 6.1.13
- What to do
- Update Simple File List to 6.1.13 or newer.
Nov 12, 2024RSS Feed Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-9836 · WordPress plugins & themes · reported by WPScanMedium 5.9
The RSS Feed Widget WordPress plugin before 3.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- RSS Feed Widget
- Fixed in
- 3.0.0
- What to do
- Update RSS Feed Widget to 3.0.0 or newer.
Nov 12, 2024RSS Feed Widget: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-9835 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- RSS Feed Widget
- Fixed in
- 3.0.1
- What to do
- Update RSS Feed Widget to 3.0.1 or newer.
Oct 17, 2024Logo Slider: Does not validate and escape some of its Slider Settings before outputting them back in attributesCVE-2024-5429 · WordPress plugins & themes · reported by WPScanHigh 7.6
The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 4.1.0
- What to do
- Update Logo Slider to 4.1.0 or newer.
Sep 30, 2024Ultimate Blocks: Does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embedCVE-2024-8536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Ultimate Blocks
- Fixed in
- 3.2.2
- What to do
- Update Ultimate Blocks to 3.2.2 or newer.
Sep 23, 2024YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes.CVE-2024-7846 · WordPress plugins & themes · reported by WPScanMedium 5.4
YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.
- Fixed in
- 2.7.1
- What to do
- Update the plugin to 2.7.1 or newer.
Sep 12, 2024MM-Breaking News: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-8056 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- MM-Breaking News
- Affected
- up to 0.7.9
- What to do
- Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Music Request Manager: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6018 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- Music Request Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6859 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 4, 2024Attributes for Blocks: Stored Cross-Site ScriptingCVE-2024-8318 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Attributes for Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributesForBlocks’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Attributes for Blocks
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Attributes for Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 2, 2024Ninja Forms: Does not escape an URL before outputting it back in an attributeCVE-2024-7354 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ninja Forms
- Fixed in
- 3.8.11
- What to do
- Update Ninja Forms to 3.8.11 or newer.
Aug 6, 2024shortcodes-ultimate-pro: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6766 · WordPress plugins & themes · reported by WPScanMedium 5.4
The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- shortcodes-ultimate-pro
- Fixed in
- 7.2.1
- What to do
- Update shortcodes-ultimate-pro to 7.2.1 or newer.
Jul 29, 2024Ultimate Blocks: Does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embedCVE-2024-6362 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Ultimate Blocks
- Fixed in
- 3.2.0
- What to do
- Update Ultimate Blocks to 3.2.0 or newer.
Jul 29, 2024Email Encoder: Does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin pageCVE-2024-4483 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting
- Product
- Email Encoder
- Fixed in
- 2.2.2
- What to do
- Update Email Encoder to 2.2.2 or newer.
Jul 15, 2024wp-cart-for-digital-products: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6072 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- wp-cart-for-digital-products
- Fixed in
- 8.5.5
- What to do
- Update wp-cart-for-digital-products to 8.5.5 or newer.
Jul 13, 2024wp-eMember: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-5744 · WordPress plugins & themes · reported by WPScanMedium 6.8
The wp-eMember WordPress plugin before 10.6.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- wp-eMember
- Fixed in
- 10.6.7
- What to do
- Update wp-eMember to 10.6.7 or newer.
Jul 13, 2024If-So Dynamic Content Personalization: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-5713 · WordPress plugins & themes · reported by WPScanMedium 5.4
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- If-So Dynamic Content Personalization
- Fixed in
- 1.8.0.4
- What to do
- Update If-So Dynamic Content Personalization to 1.8.0.4 or newer.
Jul 13, 2024OpenPGP Form Encryption for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3919 · WordPress plugins & themes · reported by WPScanMedium 4.6
The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- OpenPGP Form Encryption for
- Fixed in
- 1.5.1
- What to do
- Update OpenPGP Form Encryption for to 1.5.1 or newer.
Jul 13, 2024Image Photo Gallery Final Tiles Grid: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-3710 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.6.0
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.6.0 or newer.
Jul 12, 2024Website Content in Page or Post: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2430 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Website Content in Page or Post
- Fixed in
- 2024.04.09
- What to do
- Update Website Content in Page or Post to 2024.04.09 or newer.
Jul 11, 2024Bible Text: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5444 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Bible Text
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Bible Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Spotify Play Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5199 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Spotify Play Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Spotify Play Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5448 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024DOP Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-4377 · WordPress plugins & themes · reported by WPScanMedium 5.4
The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- DOP Shortcodes
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DOP Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2024Responsive video embed: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5475 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive video embed
- Fixed in
- 0.5.1
- What to do
- Update Responsive video embed to 0.5.1 or newer.
Jun 14, 2024WordPress Jitsi Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3978 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WordPress Jitsi Shortcode
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WordPress Jitsi Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2024Logo Slider: Does not validate and escape some of its Slider Settings before outputting them back in attributesCVE-2024-3288 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 4.0.0
- What to do
- Update Logo Slider to 4.0.0 or newer.
Jun 4, 2024Gutenberg Blocks with AI by Kadence WP: Does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embedCVE-2024-4057 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Gutenberg Blocks with AI by Kadence WP
- Fixed in
- 3.2.37
- What to do
- Update Gutenberg Blocks with AI by Kadence WP to 3.2.37 or newer.
May 23, 2024Flattr: Does not sanitise and escape some of its settingsCVE-2024-3920 · WordPress plugins & themes · reported by WPScanLow 3.5
The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Flattr
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Flattr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Sailthru Triggermail: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-4289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2024socialdriver-framework: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-2697 · WordPress plugins & themes · reported by WPScanMedium 6.5
The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- socialdriver-framework
- Fixed in
- 2024.0.0
- What to do
- Update socialdriver-framework to 2024.0.0 or newer.
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.1.0
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Apr 26, 2024MM-email2image: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3075 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- MM-email2image
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Bannerlid: Does not escape generated URLs before outputting them in attributesCVE-2024-3048 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators
- Product
- Bannerlid
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Bannerlid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2159 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Social Sharing
- Fixed in
- 3.3.61
- What to do
- Update Social Sharing to 3.3.61 or newer.
Apr 24, 2024WooCommerce Customers Manager: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-1743 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.8
- What to do
- Update WooCommerce Customers Manager to 29.8 or newer.
Apr 18, 2024Otter Blocks: Does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered blockCVE-2024-2729 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.
- Product
- Otter Blocks
- Fixed in
- 2.6.6
- What to do
- Update Otter Blocks to 2.6.6 or newer.
Apr 17, 2024Easy Social Feed: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-1219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Easy Social Feed
- Fixed in
- 6.5.6
- What to do
- Update Easy Social Feed to 6.5.6 or newer.
Apr 15, 2024Responsive Tabs: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1846 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Tabs
- Fixed in
- 4.0.7
- What to do
- Update Responsive Tabs to 4.0.7 or newer.
Apr 15, 2024WP User Profile Avatar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP User Profile Avatar
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 13, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not properly escape some of its shortcodes attributes before they are echoed back to usersCVE-2024-2583 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.0.5
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.0.5 or newer.
Mar 18, 2024Tabs Shortcode and Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-0719 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tabs Shortcode and Widget WordPress plugin through 1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Tabs Shortcode and Widget
- Affected
- up to 1.17
- What to do
- Affects up to 1.17. Update Tabs Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Buttons Shortcode and Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-0711 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Buttons Shortcode and Widget
- Affected
- up to 1.16
- What to do
- Affects up to 1.16. Update Buttons Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Grid Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1658 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Grid Shortcodes
- Fixed in
- 1.1.1
- What to do
- Update Grid Shortcodes to 1.1.1 or newer.
Mar 18, 2024Team Members: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Team Members
- Fixed in
- 5.3.2
- What to do
- Update Team Members to 5.3.2 or newer.
Mar 11, 2024Ultimate Posts Widget: Does not validate and escape some of its Widget options before outputting them back in attributesCVE-2024-0561 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Posts Widget
- Fixed in
- 2.3.1
- What to do
- Update Ultimate Posts Widget to 2.3.1 or newer.
Mar 11, 2024Enhanced Text Widget: Does not validate and escape some of its Widget options before outputting them back in attributesCVE-2024-0559 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Enhanced Text Widget
- Fixed in
- 1.6.6
- What to do
- Update Enhanced Text Widget to 1.6.6 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Jan 29, 2024TJ Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6530 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- TJ Shortcodes
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update TJ Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Jan 16, 2024Community by PeepSo: Does not sanitise and escape various parameters and generated URLs before outputting them back attributesCVE-2024-0187 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Community by PeepSo
- Fixed in
- 6.3.1.2
- What to do
- Update Community by PeepSo to 6.3.1.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.