Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

3,467 results · page 51 of 70

Oct 1, 2021A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link whCVE-2021-29109 · Other software · Esri · reported by psirt@esri.comMedium 6.1
A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
Product
Portal for ArcGIS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record esri.com esri.com
Sep 30, 2021NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.CVE-2021-35204 · Other software · Netscout · reported by MITREMedium 5.4
NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.
Product
Ngeniusone
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record netscout.com netscout.com
Sep 30, 2021In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim brCVE-2021-25963 · Other software · shuup · reported by vulnerabilitylab@mend.ioMedium 6.1
In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.
Product
shuup
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com whitesourcesoftware.com
Sep 29, 2021In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionaCVE-2021-25959 · Other software · org.opencrx · reported by vulnerabilitylab@mend.ioMedium 6.1
In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
Product
opencrx-core-config
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com whitesourcesoftware.com
Sep 27, 2021Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter.CVE-2021-40714 · Other software · Adobe · reported by AdobeMedium 6.1
Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser
Product
Experience Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
Sep 27, 2021On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XCVE-2021-23054 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.1
On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
Big-ip Access Policy Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Sep 24, 2021Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentialCVE-2020-20508 · Other software · Shopkit Project · reported by MITREMedium 6.1
Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field.
Product
Shopkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 23, 2021The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization.CVE-2021-22016 · Other software · VMware · reported by security@vmware.comMedium 6.1
The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this issue to execute malicious scripts by tricking a victim into clicking a malicious link.
Product
Cloud Foundation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vmware.com vmware.com
Sep 21, 2021In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.CVE-2021-40868 · Other software · Cloudron · reported by MITREMedium 6.1
In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
Product
Cloudron
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Sep 20, 2021eID Easy: Reflected Cross-Site ScriptingCVE-2021-34650 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the ~/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6.
Product
eID Easy
Affected
up to 4.6
What to do
Affects up to 4.6. Update eID Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 20, 2021OptinMonster: Reflected Cross-Site ScriptingCVE-2021-39325 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The OptinMonster WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation in the load_previews function found in the ~/OMAPI/Output.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.6.0.
Product
OptinMonster
Affected
up to 2.6.0
What to do
Affects up to 2.6.0. Update OptinMonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 16, 2021OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.CVE-2021-27340 · Other software · Os4ed · reported by MITREMedium 6.1
OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 14, 2021On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed pagCVE-2021-23037 · Network & remote access · F5 · reported by f5sirt@f5.comCritical 9.6
On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Product
Big-ip Access Policy Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.f5.com support.f5.com
Sep 13, 2021Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4CVE-2021-22528 · Other software · Micro Focus · reported by security@opentext.comHigh 8
Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4
Product
NetIQ Access Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.microfocus.com microfocus.com
Sep 10, 2021WordPress InviteBox Plugin for viral Refer-a-Friend Promotions: Reflected Cross-Site ScriptingCVE-2021-38359 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1.
Product
WordPress InviteBox Plugin for viral Refer-a-Friend Promotions
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update WordPress InviteBox Plugin for viral Refer-a-Friend Promotions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021MoolaMojo: Reflected Cross-Site ScriptingCVE-2021-38358 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1.
Product
MoolaMojo
Affected
up to 0.7.4.1
What to do
Affects up to 0.7.4.1. Update MoolaMojo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021SMS OVH: Reflected Cross-Site ScriptingCVE-2021-38357 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.
Product
SMS OVH
Affected
up to 0.1
What to do
Affects up to 0.1. Update SMS OVH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Bug Library: Reflected Cross-Site ScriptingCVE-2021-38355 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the ~/bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3.
Product
Bug Library
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Bug Library to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021GNU-Mailman Integration: Reflected Cross-Site ScriptingCVE-2021-38354 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
Product
GNU-Mailman Integration
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update GNU-Mailman Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Dropdown and scrollable Text: Reflected Cross-Site ScriptingCVE-2021-38353 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the ~/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.
Product
Dropdown and scrollable Text
Affected
up to 2.0
What to do
Affects up to 2.0. Update Dropdown and scrollable Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Feedify – Web Push Notifications: Reflected Cross-Site ScriptingCVE-2021-38352 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Feedify – Web Push Notifications WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the feedify_msg parameter found in the ~/includes/base.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.8.
Product
Feedify – Web Push Notifications
Affected
up to 2.1.8
What to do
Affects up to 2.1.8. Update Feedify – Web Push Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021OSD Subscribe: Reflected Cross-Site ScriptingCVE-2021-38351 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe_options_subscribers.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.3.
Product
OSD Subscribe
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update OSD Subscribe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021spideranalyse: Reflected Cross-Site ScriptingCVE-2021-38350 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the ~/analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1.
Product
spideranalyse
Affected
up to 0.0.1
What to do
Affects up to 0.0.1. Update spideranalyse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Integration of Moneybird for WooCommerce: Reflected Cross-Site ScriptingCVE-2021-38349 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error_description parameter found in the ~/templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1.
Product
Integration of Moneybird for WooCommerce
Affected
up to 2.1.1
What to do
Affects up to 2.1.1. Update Integration of Moneybird for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Advance Search: Reflected Cross-Site ScriptingCVE-2021-38348 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.2.
Product
Advance Search
Affected
up to 1.1.2
What to do
Affects up to 1.1.2. Update Advance Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Custom Website Data: Reflected Cross-Site ScriptingCVE-2021-38347 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Website Data WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter found in the ~/views/edit.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.
Product
Custom Website Data
Affected
up to 2.2
What to do
Affects up to 2.2. Update Custom Website Data to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021WooCommerce Payment Gateway Per Category: Reflected Cross-Site ScriptingCVE-2021-38341 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WooCommerce Payment Gateway Per Category WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/includes/plugin_settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.10.
Product
WooCommerce Payment Gateway Per Category
Affected
up to 2.0.10
What to do
Affects up to 2.0.10. Update WooCommerce Payment Gateway Per Category to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Wordpress Simple Shop: Reflected Cross-Site ScriptingCVE-2021-38340 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the update_row parameter found in the ~/includes/add_product.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
Wordpress Simple Shop
Affected
up to 1.2
What to do
Affects up to 1.2. Update Wordpress Simple Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Simple Matted Thumbnails: Reflected Cross-Site ScriptingCVE-2021-38339 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Matted Thumbnails WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simple-matted-thumbnail.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.01.
Product
Simple Matted Thumbnails
Affected
up to 1.01
What to do
Affects up to 1.01. Update Simple Matted Thumbnails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Border Loading Bar: Reflected Cross-Site ScriptingCVE-2021-38338 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Border Loading Bar WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `f` and `t` parameter found in the ~/titan-framework/iframe-googlefont-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
Product
Border Loading Bar
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Border Loading Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021RSVPMaker Excel: Reflected Cross-Site ScriptingCVE-2021-38337 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The RSVPMaker Excel WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/phpexcel/PHPExcel/Shared/JAMA/docs/download.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.
Product
RSVPMaker Excel
Affected
up to 1.1
What to do
Affects up to 1.1. Update RSVPMaker Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Edit Comments XT: Reflected Cross-Site ScriptingCVE-2021-38336 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Edit Comments XT WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/edit-comments-xt.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
Edit Comments XT
Affected
up to 1.0
What to do
Affects up to 1.0. Update Edit Comments XT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Wise Agent Capture Forms: Reflected Cross-Site ScriptingCVE-2021-38335 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Wise Agent Capture Forms WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/WiseAgentCaptureForm.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.
Product
Wise Agent Capture Forms
Affected
up to 1.0
What to do
Affects up to 1.0. Update Wise Agent Capture Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021WP Design Maps & Places: Reflected Cross-Site ScriptingCVE-2021-38334 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the ~/wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.
Product
WP Design Maps & Places
Affected
up to 1.2
What to do
Affects up to 1.2. Update WP Design Maps & Places to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021WP Scrippets: Reflected Cross-Site ScriptingCVE-2021-38333 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Scrippets WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/wp-scrippets.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.1.
Product
WP Scrippets
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update WP Scrippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021On Page SEO + Whatsapp Chat Button Plugin: Reflected Cross-Site ScriptingCVE-2021-38332 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1.
Product
On Page SEO + Whatsapp Chat Button Plugin
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update On Page SEO + Whatsapp Chat Button Plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021WP-T-Wap: Reflected Cross-Site ScriptingCVE-2021-38331 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP-T-Wap WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the posted parameter found in the ~/wap/writer.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.13.2.
Product
WP-T-Wap
Affected
up to 1.13.2
What to do
Affects up to 1.13.2. Update WP-T-Wap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Yet Another bol.com Plugin: Reflected Cross-Site ScriptingCVE-2021-38330 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Yet Another bol.com Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/yabp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.
Product
Yet Another bol.com Plugin
Affected
up to 1.4
What to do
Affects up to 1.4. Update Yet Another bol.com Plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021DJ EmailPublish: Reflected Cross-Site ScriptingCVE-2021-38329 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The DJ EmailPublish WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/dj-email-publish.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.7.2.
Product
DJ EmailPublish
Affected
up to 1.7.2
What to do
Affects up to 1.7.2. Update DJ EmailPublish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Notices: Reflected Cross-Site ScriptingCVE-2021-38328 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Notices WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/notices.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.1.
Product
Notices
Affected
up to 6.1
What to do
Affects up to 6.1. Update Notices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021YouTube Video Inserter: Reflected Cross-Site ScriptingCVE-2021-38327 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0.
Product
YouTube Video Inserter
Affected
up to 1.2.1.0
What to do
Affects up to 1.2.1.0. Update YouTube Video Inserter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021Post Title Counter: Reflected Cross-Site ScriptingCVE-2021-38326 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Post Title Counter WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the notice parameter found in the ~/post-title-counter.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.
Product
Post Title Counter
Affected
up to 1.1
What to do
Affects up to 1.1. Update Post Title Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 10, 2021The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62CVE-2021-35976 · Websites & servers · Plesk · reported by MITREMedium 6.1
The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability.
Product
Obsidian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.plesk.com tarekbouali.com
Sep 9, 2021A reflected cross-site scripting (XSS) vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML.CVE-2020-19295 · Other software · Jeesns · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML.
Product
Jeesns
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com seebug.org
Sep 9, 2021A reflected cross-site scripting (XSS) vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML.CVE-2020-19283 · Other software · Jeesns · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML.
Product
Jeesns
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com seebug.org
Sep 9, 2021A reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the systCVE-2020-19282 · Other software · Jeesns · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field.
Product
Jeesns
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com seebug.org
Sep 9, 2021User Activation Email: Reflected Cross-Site ScriptingCVE-2021-38325 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Activation Email WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the uae-key parameter found in the ~/user-activation-email.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.0.
Product
User Activation Email
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update User Activation Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 9, 2021RentPress: Reflected Cross-Site ScriptingCVE-2021-38323 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The RentPress WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the ~/src/rentPress/AjaxRequests.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 6.6.4.
Product
RentPress
Affected
up to 6.6.4
What to do
Affects up to 6.6.4. Update RentPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 9, 2021Twitter Friends Widget: Reflected Cross-Site ScriptingCVE-2021-38322 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Twitter Friends Widget WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the pmc_TF_user and pmc_TF_password parameter found in the ~/twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.1.
Product
Twitter Friends Widget
Affected
up to 3.1
What to do
Affects up to 3.1. Update Twitter Friends Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 9, 2021Custom Menu Plugin: Reflected Cross-Site ScriptingCVE-2021-38321 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Custom Menu Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the selected_menu parameter found in the ~/custom-menus.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.3.
Product
Custom Menu Plugin
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Custom Menu Plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.