Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

3,467 results · page 50 of 70

Dec 14, 2021duoFAQ - Responsive, Flat, Simple FAQ WordPess: Reflected Cross-Site ScriptingCVE-2021-39319 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8.
Product
duoFAQ - Responsive, Flat, Simple FAQ WordPess
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update duoFAQ - Responsive, Flat, Simple FAQ WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021H5P CSS Editor: Reflected Cross-Site ScriptingCVE-2021-39318 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found in the ~/h5p-css-editor.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
H5P CSS Editor
Affected
up to 1.0
What to do
Affects up to 1.0. Update H5P CSS Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Magic Post Voice: Reflected Cross-Site ScriptingCVE-2021-39315 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the ~/inc/admin/main.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
Magic Post Voice
Affected
up to 1.2
What to do
Affects up to 1.2. Update Magic Post Voice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021WooCommerce EnvioPack: Reflected Cross-Site ScriptingCVE-2021-39314 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the ~/includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
WooCommerce EnvioPack
Affected
up to 1.2
What to do
Affects up to 1.2. Update WooCommerce EnvioPack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Simple Image Gallery: Reflected Cross-Site ScriptingCVE-2021-39313 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
Product
Simple Image Gallery
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Simple Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021link-list-manager: Reflected Cross-Site ScriptingCVE-2021-39311 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found in the ~/llm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
link-list-manager
Affected
up to 1.0
What to do
Affects up to 1.0. Update link-list-manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Real WYSIWYG: Reflected Cross-Site ScriptingCVE-2021-39310 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/real-wysiwyg.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2.
Product
Real WYSIWYG
Affected
up to 0.0.2
What to do
Affects up to 0.0.2. Update Real WYSIWYG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021Parsian Bank Gateway for Woocommerce: Reflected Cross-Site ScriptingCVE-2021-39309 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parameter due to a var_dump() on $_POST variables found in the ~/vendor/dpsoft/parsian-payment/sample/rollback-payment.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
Parsian Bank Gateway for Woocommerce
Affected
up to 1.0
What to do
Affects up to 1.0. Update Parsian Bank Gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021WooCommerce myghpay Payment Gateway WordPess: Reflected Cross-Site ScriptingCVE-2021-39308 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientref parameter found in the ~/processresponse.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.0.
Product
WooCommerce myghpay Payment Gateway WordPess
Affected
up to 3.0
What to do
Affects up to 3.0. Update WooCommerce myghpay Payment Gateway WordPess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 14, 2021.htaccess Redirect: Reflected Cross-Site ScriptingCVE-2021-38361 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in the ~/htaccess-redirect.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.3.1.
Product
.htaccess Redirect
Affected
up to 0.3.1
What to do
Affects up to 0.3.1. Update .htaccess Redirect to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-SiCVE-2021-42549 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Lets-Box prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.15.3
What to do
Update search functionality of to 1.15.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected CCVE-2021-42548 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Share-one-Drive prior to 1.15.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.15.3
What to do
Update search functionality of to 1.15.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected CrCVE-2021-42547 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Out-of-the-Box prior to 1.20.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.20.3
What to do
Update search functionality of to 1.20.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 13, 2021Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected CrCVE-2021-42546 · WordPress plugins & themes · reported by vulnerability@ncsc.chMedium 4.7
Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to craft a reflected Cross-Site Scripting attack.
Product
search functionality of
Fixed in
1.18.3
What to do
Update search functionality of to 1.18.3 or newer.
Full record and what to do →NVD record wpcloudplugins.com wpcloudplugins.com
Dec 9, 2021A reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerror_description parameter in assets/sources/instagram.php CVE-2021-41697 · Other software · Globaldatingsoftware · reported by MITREMedium 6.1
A reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerror_description parameter in assets/sources/instagram.php script.
Product
Premiumdatingscript
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chudamax.com chudamax.com
Dec 9, 2021A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface.CVE-2021-20137 · Other software · Gryphonconnect · reported by vulnreport@tenable.comMedium 6.1
A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution in the context of the victim's browser.
Product
Gryphon Tower Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tenable.com tenable.com
Dec 8, 2021An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface.CVE-2021-23860 · Other software · Bosch · reported by psirt@bosch.comMedium 5
An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.
Product
BVMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.bosch.com psirt.bosch.com
Dec 6, 2021The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcCVE-2021-25041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action
Product
Photo Gallery by 10Web
Fixed in
1.5.68
What to do
Update Photo Gallery by 10Web to 1.5.68 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 30, 2021Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.CVE-2021-43295 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
Product
Manageengine Supportcenter Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com manageengine.com
Nov 30, 2021Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.CVE-2021-43294 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
Product
Manageengine Supportcenter Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record manageengine.com manageengine.com
Nov 26, 2021Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id,CVE-2021-36919 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
Affected
up to 6.0.6
What to do
Affects up to 6.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Nov 23, 2021A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script oCVE-2021-31852 · Other software · McAfee,LLC · reported by trellixpsirt@trellix.comMedium 6.1
A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extract of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.
Product
McAfee Policy Auditor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kc.mcafee.com kc.mcafee.com
Nov 23, 2021A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script oCVE-2021-31851 · Other software · McAfee,LLC · reported by trellixpsirt@trellix.comMedium 6.1
A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extraction of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.
Product
McAfee Policy Auditor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kc.mcafee.com kc.mcafee.com
Nov 19, 2021A reflected cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB.CVE-2021-38681 · Other software · Negocios · reported by security@qnapsecurity.com.twMedium 5.3
A reflected cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already disabled and removed Ragic Cloud DB from the QNAP App Center, pending a security patch from Ragic.
Product
Ragic Cloud DB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qnap.com qnap.com
Nov 19, 2021Preview E-Mails for WooCommerce: Reflected Cross-Site ScriptingCVE-2021-42363 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8.
Product
Preview E-Mails for WooCommerce
Affected
up to 1.6.8
What to do
Affects up to 1.6.8. Update Preview E-Mails for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Nov 16, 2021The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site ScripCVE-2021-43047 · Other software · TIBCO Software Inc. · reported by security@tibco.comCritical 9
The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below.
Product
TIBCO PartnerExpress
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tibco.com tibco.com
Nov 16, 2021In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “tags” and “catCVE-2021-25983 · Other software · FactorJS · reported by vulnerabilitylab@mend.ioMedium 6.1
In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies.
Product
Factor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com whitesourcesoftware.com
Nov 16, 2021In Factor (App Framework & Headless CMS) forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “search” parameteCVE-2021-25982 · Other software · FactorJS · reported by vulnerabilitylab@mend.ioMedium 6.1
In Factor (App Framework & Headless CMS) forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies.
Product
Factor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com whitesourcesoftware.com
Nov 15, 2021plugins/wordpress_sso/pages/index.php: ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site ScriptingCVE-2021-41951 · WordPress plugins & themes · reported by MITREMedium 6.1
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the context of the victim's browser.
Product
plugins/wordpress_sso/pages/index.php
Fixed in
9.6
What to do
Update plugins/wordpress_sso/pages/index.php to 9.6 or newer.
Full record and what to do →NVD record horizon3.ai horizon3.ai
Nov 9, 2021Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter.CVE-2021-35489 · Other software · Thruk · reported by MITREMedium 6.1
Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.
Product
Thruk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it thruk.org
Nov 9, 2021Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter.CVE-2021-35488 · Other software · Thruk · reported by MITREMedium 6.1
Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it.
Product
Thruk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it thruk.org
Nov 3, 2021ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php.CVE-2020-18259 · Other software · Ed01-cms Project · reported by MITREMedium 6.1
ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields.
Product
Ed01-cms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 1, 2021NextScripts: Social Networks Auto-Poster <= 4.3.20: Reflected Cross-Site ScriptingCVE-2021-38356 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $_REQUEST['page'] parameter which is echoed out on inc/nxs_class_snap.php by supplying the appropriate value 'nxssnap-post' to load the page in $_GET['page'] along with malicious JavaScript in $_POST['page'].
Product
NextScripts: Social Networks Auto-Poster <= 4.3.20
Affected
up to 4.3.20
What to do
Affects up to 4.3.20. Update NextScripts: Social Networks Auto-Poster <= 4.3.20 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Nov 1, 2021AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attaCVE-2021-25878 · Other software · Youphptube · reported by MITREMedium 6.1
AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Product
Youphptube
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synacktiv.com synacktiv.com
Nov 1, 2021AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal adminCVE-2021-25876 · Other software · Youphptube · reported by MITREMedium 6.1
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Product
Youphptube
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synacktiv.com synacktiv.com
Nov 1, 2021AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a rCVE-2021-25875 · Other software · Youphptube · reported by MITREMedium 6.1
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Product
Youphptube
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synacktiv.com synacktiv.com
Oct 22, 2021The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlCVE-2021-31682 · Other software · Automatedlogic · reported by MITREMedium 6.1
The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.
Product
Webctrl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Oct 21, 2021WordPress Ivory Search: Reflected Cross-Site Scripting (XSS)CVE-2021-36869 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post.
Product
WordPress Ivory Search
Affected
up to 4.6.6
What to do
Affects up to 4.6.6. Update WordPress Ivory Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Oct 21, 2021"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"CVE-2021-27746 · Other software · Hcltechsw · reported by psirt@hcl.comMedium 5.4
"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"
Product
Connections
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Oct 21, 2021Easy Digital Downloads: Reflected Cross-Site ScriptingCVE-2021-39354 · WordPress plugins & themes · reported by WordfenceMedium 4.8
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end_date parameters found in the ~/includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2.
Product
Easy Digital Downloads
Affected
up to 2.11.2
What to do
Affects up to 2.11.2. Update Easy Digital Downloads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 20, 2021ZTE MF971R product has reflective XSS vulnerability.CVE-2021-21747 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.1
ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.
Product
Mf971r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zte.com.cn support.zte.com.cn
Oct 20, 2021ZTE MF971R product has reflective XSS vulnerability.CVE-2021-21746 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.1
ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.
Product
Mf971r Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zte.com.cn support.zte.com.cn
Oct 15, 2021Adobe Connect version 11.2.3 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2021-40721 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Connect version 11.2.3 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Product
Connect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
Oct 14, 2021The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting.CVE-2021-33179 · Other software · Nagios · reported by disclosure@synopsys.comMedium 6.1
The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload.
Product
Nagios XI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synopsys.com synopsys.com
Oct 11, 2021Enfold Enfold: Was vulnerable to Reflected Cross-Site Scripting (XSS)CVE-2021-24719 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder.
Product
Enfold Enfold
Fixed in
4.8.4
What to do
Update Enfold Enfold to 4.8.4 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Oct 6, 2021FV Flowplayer Video Player: Reflected Cross-Site ScriptingCVE-2021-39350 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.
Product
FV Flowplayer Video Player
Affected
7.5.0.727 to 7.5.2.727
What to do
Affects 7.5.0.727 to 7.5.2.727. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 5, 2021A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to execute arbitrary javasCVE-2021-39878 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.8
A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to execute arbitrary javascript code.
Product
GitLab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitlab.com gitlab.com
Oct 4, 2021The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulaCVE-2021-23856 · Other software · Rexroth · reported by psirt@bosch.comCritical 10
The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL.
Product
IndraMotion MLC L20, L40
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.bosch.com psirt.bosch.com
Oct 4, 2021Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 and earlier, and 6.10.0 are vulnerable to TCP reflected amplification vulnerability, if HTTP User RespCVE-2021-41530 · Other software · Forcepoint · reported by psirt@forcepoint.comHigh 7.5
Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 and earlier, and 6.10.0 are vulnerable to TCP reflected amplification vulnerability, if HTTP User Response has been configured.
Product
Next Generation Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.forcepoint.com help.forcepoint.com
Oct 4, 2021A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitraryCVE-2021-41878 · Other software · Hkurl · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button.
Product
I-panel Administration System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com cybergroot.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.