Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,103 results · page 45 of 83
Jan 18, 2022NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, which may lead to a systeCVE-2021-34406 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 4.7
NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, which may lead to a system reboot.
- Product
- SHIELD TV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jan 18, 2022NVIDIA Linux distributions contain a vulnerability in TrustZone’s TEE_Malloc function, where an unchecked return value causing a null pointer dereference may leCVE-2021-34405 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA Linux distributions contain a vulnerability in TrustZone’s TEE_Malloc function, where an unchecked return value causing a null pointer dereference may lead to denial of service.
- Product
- SHIELD TV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jan 18, 2022Android images for T210 provided by NVIDIA contain a vulnerability in BROM, where failure to limit access to AHB-DMA when BROM fails may allow an unprivileged aCVE-2021-34404 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.1
Android images for T210 provided by NVIDIA contain a vulnerability in BROM, where failure to limit access to AHB-DMA when BROM fails may allow an unprivileged attacker with physical access to cause denial of service or impact integrity and confidentiality beyond the security scope of BROM.
- Product
- SHIELD TV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jan 18, 2022NVIDIA Linux distributions contain a vulnerability in nvmap ioctl, which allows any user with a local account to exploit a use-after-free condition, leading to CVE-2021-34403 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Linux distributions contain a vulnerability in nvmap ioctl, which allows any user with a local account to exploit a use-after-free condition, leading to code privilege escalation, loss of confidentiality and integrity, or denial of service.
- Product
- SHIELD TV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jan 18, 2022NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location CVE-2021-34402 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.7
NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service, Information disclosure, loss of Integrity, or possible escalation of privileges.
- Product
- SHIELD TV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jan 18, 2022NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code executCVE-2021-34401 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER, where improper access control may lead to code execution, compromised integrity, or denial of service.
- Product
- SHIELD TV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jan 18, 2022SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g.CVE-2021-38695 · Other software · Softvibe · reported by MITREMedium 5.4
SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject, description) of the document form.
- Product
- Saraban
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfoma.netorangeo.tech
Jan 17, 2022In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer.CVE-2022-22703 · Other software · Stormshield · reported by MITREMedium 5.5
In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer.
- Product
- Network Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.euadvisories.stormshield.eu
Jan 17, 2022ACF Photo Gallery Field: Does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_editCVE-2021-24909 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acf_photo_gallery_metabox_edit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- ACF Photo Gallery Field
- Fixed in
- 1.7.5
- What to do
- Update ACF Photo Gallery Field to 1.7.5 or newer.
Jan 14, 2022By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator funCVE-2021-24044 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.
- Product
- Hermes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
Jan 12, 2022MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt.CVE-2021-43436 · Other software · Iresturant Project · reported by MITREMedium 5.4
MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
- Product
- Iresturant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.CVE-2022-22844 · Other software · Libtiff · reported by MITREMedium 5.5
LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.
- Product
- Libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order.CVE-2021-22569 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comHigh 7.5
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
- Product
- protobuf-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 6, 2022The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.CVE-2021-36739 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
- Product
- Apache Portals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 6, 2022The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks.CVE-2021-36738 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact
- Product
- Apache Portals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 6, 2022The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks.CVE-2021-36737 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
- Product
- Apache Portals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 3, 2022WP Travel Engine: Does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pagesCVE-2021-24680 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
- Product
- WP Travel Engine
- Fixed in
- 5.3.1
- What to do
- Update WP Travel Engine to 5.3.1 or newer.
Dec 29, 2021An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8).CVE-2021-45885 · Other software · Stormshield · reported by MITREHigh 7.5
An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH password change does not properly clear the old password.
- Product
- Network Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.euadvisories.stormshield.eu
Dec 29, 2021In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.CVE-2021-25990 · Other software · ifmeorg · reported by vulnerabilitylab@mend.ioMedium 5.4
In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.
- Product
- ifme
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Tickera
- Fixed in
- 3.4.8.3
- What to do
- Update Tickera to 3.4.8.3 or newer.
Dec 21, 2021A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault and application craCVE-2021-44923 · Other software · Gpac · reported by MITREMedium 5.5
A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault and application crash.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function, which can cause a segmentation fault and application crash.CVE-2021-44918 · Other software · Gpac · reported by MITREMedium 5.5
A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function, which can cause a segmentation fault and application crash.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.CVE-2021-45091 · Other software · Stormshield · reported by MITREMedium 4.3
Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.
- Product
- Endpoint Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.euadvisories.stormshield.eu
Dec 21, 2021Stormshield Endpoint Security before 2.1.2 allows remote code execution.CVE-2021-45090 · Other software · Stormshield · reported by MITRECritical 9.8
Stormshield Endpoint Security before 2.1.2 allows remote code execution.
- Product
- Endpoint Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.euadvisories.stormshield.eu
Dec 21, 2021Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.CVE-2021-45089 · Other software · Stormshield · reported by MITREMedium 5.2
Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.
- Product
- Endpoint Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.stormshield.euadvisories.stormshield.eu
Dec 21, 2021PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.CVE-2012-20001 · Websites & servers · Prestashop · reported by MITREMedium 6.1
PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 20, 2021Stored XSS in Signup Form in iResturant 1.0 Allows Remote Attacker to Inject Arbitrary code via NAME and ADDRESS fieldCVE-2021-43438 · Other software · Iresturant Project · reported by MITREMedium 5.4
Stored XSS in Signup Form in iResturant 1.0 Allows Remote Attacker to Inject Arbitrary code via NAME and ADDRESS field
- Product
- Iresturant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process CVE-2021-0966 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In code generated by BuildParcelFields of generate_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory of a target process due to uninitialized data. This could lead to local information disclosure across Binder transactions with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12Android ID: A-198346478
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2021Get Custom Field Values: Allows users with a roleCVE-2021-24872 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Get Custom Field Values WordPress plugin before 4.0 allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata.
- Product
- Get Custom Field Values
- Fixed in
- 4.0
- What to do
- Update Get Custom Field Values to 4.0 or newer.
Dec 13, 2021Get Custom Field Values: Does not escape custom fields before outputting them in the pageCVE-2021-24871 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Get Custom Field Values WordPress plugin before 4.0.1 does not escape custom fields before outputting them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Get Custom Field Values
- Fixed in
- 4.0.1
- What to do
- Update Get Custom Field Values to 4.0.1 or newer.
Dec 13, 2021Display Post Metadata: Adds a shortcode to print out custom fieldsCVE-2021-24855 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Display Post Metadata WordPress plugin before 1.5.0 adds a shortcode to print out custom fields, however their content is not sanitised or escaped which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Display Post Metadata
- Fixed in
- 1.5.0
- What to do
- Update Display Post Metadata to 1.5.0 or newer.
Dec 13, 2021Flex Local Fonts: Does not escape the Class Name fieldCVE-2021-24782 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Flex Local Fonts
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Flex Local Fonts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021Inspirational Quote Rotator: Does not sanitize and escape some of its quote fieldsCVE-2021-24771 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when the unfiltered_html capability is disallowed
- Product
- Inspirational Quote Rotator
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Inspirational Quote Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2021moving the field group which may allow a user to move the unauthorized field group: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20867 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in moving the field group which may allow a user to move the unauthorized field group via unspecified vectors.
- Product
- moving the field group which may allow a user to move the unauthorized field group
- What to do
- Update moving the field group which may allow a user to move the unauthorized field group to the newest version.
Dec 13, 2021obtaining the user list which may allow a user to obtain the unauthorized information: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20866 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in obtaining the user list which may allow a user to obtain the unauthorized information via unspecified vectors.
- Product
- obtaining the user list which may allow a user to obtain the unauthorized information
- What to do
- Update obtaining the user list which may allow a user to obtain the unauthorized information to the newest version.
Dec 13, 2021browsing database which may allow a user to browse unauthorized data: Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorizationCVE-2021-20865 · WordPress plugins & themes · reported by vultures@jpcert.or.jpHigh 7.5
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerability in browsing database which may allow a user to browse unauthorized data via unspecified vectors.
- Product
- browsing database which may allow a user to browse unauthorized data
- What to do
- Update browsing database which may allow a user to browse unauthorized data to the newest version.
Dec 6, 2021WordPress Online Booking and Scheduling: Does not escape the Staff Full Name field before outputting it back in a pageCVE-2021-24930 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue
- Product
- WordPress Online Booking and Scheduling
- Fixed in
- 20.3.1
- What to do
- Update WordPress Online Booking and Scheduling to 20.3.1 or newer.
Dec 6, 2021Import any XML or CSV File to: Does not escape the Import's Title and Unique Identifier fields before outputting them in admin pagesCVE-2021-24714 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfiltered_html capability is disallowed.
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.3
- What to do
- Update Import any XML or CSV File to to 3.6.3 or newer.
Dec 1, 2021Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php.CVE-2021-43137 · Websites & servers · Phpgurukul · reported by MITREHigh 8.8
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chaining to this both vulnerabilities leads to account takeover.
- Product
- Hostel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.4
- What to do
- Update Ninja Forms Contact Form to 3.6.4 or newer.
Nov 29, 2021Popup Anything: Does not escape the Link Text and Button Text fields of PopupCVE-2021-24883 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Popup Anything
- Fixed in
- 2.0.4
- What to do
- Update Popup Anything to 2.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 29, 2021Shop Page WP: Does not sanitise and escape some of the Product fieldsCVE-2021-24811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Shop Page WP
- Fixed in
- 1.2.8
- What to do
- Update Shop Page WP to 1.2.8 or newer.
Nov 29, 2021WP RSS Aggregator: Does not properly sanitise and escape the URL to Blacklist fieldCVE-2021-24768 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
- Product
- WP RSS Aggregator
- Fixed in
- 4.19.2
- What to do
- Update WP RSS Aggregator to 4.19.2 or newer.
Nov 29, 2021myCred: Does not validate or escape the fields parameter before using it in a SQL statementCVE-2021-24755 · WordPress plugins & themes · reported by WPScanHigh 8.8
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user
- Product
- myCred
- Fixed in
- 2.3
- What to do
- Update myCred to 2.3 or newer.
Nov 29, 2021About Author Box: Does not sanitise and escape the Social Profiles field values before outputting them in attributesCVE-2021-24745 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- About Author Box
- Fixed in
- 1.0.2
- What to do
- Update About Author Box to 1.0.2 or newer.
Nov 23, 2021BetterLinks: Does not sanitise and escape some of imported link fieldsCVE-2021-24812 · WordPress plugins & themes · reported by WPScanMedium 5.4
The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV.
- Product
- BetterLinks
- Fixed in
- 1.2.6
- What to do
- Update BetterLinks to 1.2.6 or newer.
Nov 23, 2021Forminator: Does not sanitize and escape the email field labelCVE-2021-24700 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Forminator
- Fixed in
- 1.15.4
- What to do
- Update Forminator to 1.15.4 or newer.
Nov 23, 2021There is an Unstandardized field names in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2021-37034 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an Unstandardized field names in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Nov 17, 2021QR Redirector: Does not sanitise and escape some of the QR Redirect fieldsCVE-2021-24854 · WordPress plugins & themes · reported by WPScanMedium 5.4
The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.
- Product
- QR Redirector
- Fixed in
- 1.6.1
- What to do
- Update QR Redirector to 1.6.1 or newer.
Nov 17, 2021Insert Pages: Adds a shortcode that prints out other pages' content and custom fieldsCVE-2021-24850 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert Pages WordPress plugin before 3.7.0 adds a shortcode that prints out other pages' content and custom fields. It can be used by users with a role as low as Contributor to perform Cross-Site Scripting attacks by storing the payload/s in another post's custom fields.
- Product
- Insert Pages
- Fixed in
- 3.7.0
- What to do
- Update Insert Pages to 3.7.0 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.