Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
815 results · page 7 of 17
Oct 14, 2024Elementor Website Builder – More than Just a Page Builder: Basic Information ExposureCVE-2024-6757 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 3.23.5 via the get_image_alt function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract either excerpt data or titles of private or password-protected posts.
- Product
- Elementor Website Builder – More than Just a Page Builder
- Affected
- up to 3.23.5
- What to do
- Affects up to 3.23.5. Update Elementor Website Builder – More than Just a Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 4, 2024WP Cleanup and Basic Functions: Stored Cross-Site ScriptingCVE-2024-9455 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Cleanup and Basic Functions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- WP Cleanup and Basic Functions
- Affected
- up to 2.2.1
- What to do
- Affects up to 2.2.1. Update WP Cleanup and Basic Functions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 4, 2024cookie is a basic HTTP cookie parser and serializer for HTTP servers.CVE-2024-47764 · Other software · jshttp · reported by GitHubMedium 6.9
cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
- Product
- cookie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024basic-auth-connect is Connect's Basic Auth middleware in its own module.CVE-2024-47178 · Other software · expressjs · reported by GitHubHigh 8.7
basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.
- Product
- basic-auth-connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in TE Informatics V5 allows Reflected XSS.CVE-2024-2010 · Other software · TE Informatics · reported by iletisim@usom.gov.trHigh 8.8
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in TE Informatics V5 allows Reflected XSS. This issue affects V5: before 6.2.
- Product
- V5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Sep 10, 2024Out-of-Bounds read vulnerability in OSCAT Basic Library allows an local, unprivileged attacker to access limited internal data of the PLC which may lead to a crCVE-2024-6876 · Other software · oscat.de · reported by info@cert.vde.comMedium 4.4
Out-of-Bounds read vulnerability in OSCAT Basic Library allows an local, unprivileged attacker to access limited internal data of the PLC which may lead to a crash of the affected service.
- Product
- OSCAT Basic Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcustomers.codesys.com
Sep 10, 2024A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), MendiCVE-2023-49069 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.12 (All versions < V10.12.11 only if the basic authentication mechanism is used by the application), Mendix Runtime V10.6 (All versions < V10.6.19 only if the basic authentication mechanism is used by the application), Mendix Runtime V8 (All versions < V8.18.33 only if the basic authentication mechanism is used by the application), Mendix Runtime V9 (All versions < V9.24.31 only if the basic authentication mechanism is used by the application). The authentication mechanism of affected applications contains an observable response discrepancy vulnerability when validating usernames. This could allow unauthenticated remote attackers to distinguish between valid and invalid usernames.
- Product
- Mendix Runtime V10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Sep 10, 2024Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted.CVE-2024-44121 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Under certain conditions Statutory Reports in SAP S/4 HANA allows an attacker with basic privileges to access information which would otherwise be restricted. The vulnerability could expose internal user data that should remain confidential. It does not impact the integrity and availability of the application
- Product
- SAP S/4 HANA (Statutory Reports)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-41697 · Other software · Priority · reported by cna@cyber.gov.ilMedium 6.1
Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- Product
- Priority
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2024Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privilegeCVE-2024-38202 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization Based Security (VBS). However, an attacker attempting to exploit this vulnerability requires additional interaction by a privileged user to be successful. Microsoft has developed a security update to mitigate this threat which was made available October 08, 2024 and is provided in the Security Updates table of this CVE for customers to download. Note: Depending on your version of Windows, additional steps may be required to update Windows Recovery Environment (WinRE) to be protected from this vulnerability. Please refer to the FAQ section for more information. Guidance for customers who cannot immediately implement the update is provided in the Recommended Actions section of this CVE to help reduce the risks associated with this vulnerability and to protect their systems. If there are any further updates regarding mitigations for this vulnerability, this CVE will be updated and customers will be notified. We highly encourage c
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comvicarius.io
Aug 2, 2024In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by tCVE-2024-27182 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.9
In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by the Linkis system user . Users are recommended to upgrade to version 1.6.0, which fixes this issue.
- Product
- Apache Linkis Basic management services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Aug 2, 2024In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token CVE-2024-27181 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.
- Product
- Apache Linkis Basic management services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Jul 30, 2024Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-41693 · Other software · Mashov · reported by cna@cyber.gov.ilMedium 6.1
Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- Product
- Mashov
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2024In the Linux kernel, the following vulnerability has been resolved: btrfs: always do the basic checks for btrfs_qgroup_inherit structure [BUG] Syzbot reports CVE-2024-42111 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: btrfs: always do the basic checks for btrfs_qgroup_inherit structure [BUG] Syzbot reports the following regression detected by KASAN: BUG: KASAN: slab-out-of-bounds in btrfs_qgroup_inherit+0x42e/0x2e20 fs/btrfs/qgroup.c:3277 Read of size 8 at addr ffff88814628ca50 by task syz-executor318/5171 CPU: 0 PID: 5171 Comm: syz-executor318 Not tainted 6.10.0-rc2-syzkaller-00010-g2ab795141095 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 btrfs_qgroup_inherit+0x42e/0x2e20 fs/btrfs/qgroup.c:3277 create_pending_snapshot+0x1359/0x29b0 fs/btrfs/transaction.c:1854 create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1922 btrfs_commit_transaction+0xf20/0x3740 fs/btrfs/transaction.c:2382 create_snapshot+0x6a1/0x9e0 fs/btrfs/ioctl.c:875 btrfs_mksubvol+0x58f/0x710 fs/btrfs/ioct
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jul 16, 2024A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should oCVE-2024-6435 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should only be available to users with administrative level privileges. If exploited, an attacker could read sensitive data, and create users. For example, a malicious user with basic privileges could perform critical functions such as creating a user with elevated privileges and reading sensitive information in the “views” section.
- Product
- Pavilion8®
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.comrockwellautomation.com
Jul 9, 2024A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBasCVE-2023-52891 · Other software · Siemens · reported by productcert@siemens.comMedium 5.3
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMIT V10 (All versions), SIMIT V11 (All versions < V11.1). Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in Siemens products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the server.
- Product
- SIMATIC Energy Manager Basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Jul 2, 2024The webserver utilizes basic authentication for its user login to the configuration interface.CVE-2023-41926 · Other software · Kiloview · reported by cert@ncsc.nlHigh 8.8
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
- Product
- P1/P2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.ncsc.nladvisories.ncsc.nl
Jun 21, 2024wpForo Forum: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2022-38055 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue affects wpForo Forum: from n/a through 2.0.9.
- Product
- wpForo Forum
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update wpForo Forum to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 13, 2024TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid in the function setWiFiBasicCfgCVE-2024-37635 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid in the function setWiFiBasicCfg
- Product
- a3700r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-36395 · Other software · Verint · reported by cna@cyber.gov.ilMedium 6.1
Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- Product
- WFO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024YITH WooCommerce Product Add-Ons: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-35680 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.9.2.
- Product
- YITH WooCommerce Product Add-Ons
- Affected
- up to 4.9.2
- What to do
- Affects up to 4.9.2. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 9, 2024Calendarista Basic Edition: Missing AuthorizationCVE-2024-30534 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.5.
- Product
- Calendarista Basic Edition
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Responsive Slick Slider: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-49852 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vsourz Digital Responsive Slick Slider WordPress allows Code Injection.This issue affects Responsive Slick Slider WordPress: from n/a through 1.4.
- Product
- Responsive Slick Slider
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Responsive Slick Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Stripe Payments: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-48285 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through 2.0.79.
- Product
- Stripe Payments
- Affected
- up to 2.0.79
- What to do
- Affects up to 2.0.79. Update Stripe Payments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024ARI Stream Quiz: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-47513 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affects ARI Stream Quiz: from n/a through 1.3.2.
- Product
- ARI Stream Quiz
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update ARI Stream Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024wpDiscuz: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-46310 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.This issue affects wpDiscuz: from n/a through 7.6.10.
- Product
- wpDiscuz
- Affected
- up to 7.6.10
- What to do
- Affects up to 7.6.10. Update wpDiscuz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Responsive Tabs: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-45635 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injection.This issue affects Responsive Tabs: from n/a before 4.0.6.
- Product
- Responsive Tabs
- Fixed in
- 4.0.6
- What to do
- Update Responsive Tabs to 4.0.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024WP Content Pilot – Autoblogging & Affiliate Marketing: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-45053 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing Plugin allows Code Injection.This issue affects WP Content Pilot – Autoblogging & Affiliate Marketing Plugin: from n/a through 1.3.3.
- Product
- WP Content Pilot – Autoblogging & Affiliate Marketing
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update WP Content Pilot – Autoblogging & Affiliate Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Tabs & Accordion: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-40557 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Injection.This issue affects Tabs & Accordion: from n/a through 1.3.10.
- Product
- Tabs & Accordion
- Affected
- up to 1.3.10
- What to do
- Affects up to 1.3.10. Update Tabs & Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Discussion Board: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-39161 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Discussion Board Discussion Board allows Content Spoofing, Cross-Site Scripting (XSS).This issue affects Discussion Board: from n/a through 2.4.8.
- Product
- Discussion Board
- Affected
- up to 2.4.8
- What to do
- Affects up to 2.4.8. Update Discussion Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 3, 2024Spectra: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-23735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affects Spectra: from n/a through 2.3.0.
- Product
- Spectra
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update Spectra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 22, 2024xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary code.CVE-2024-29421 · Other software · xmedcon · reported by MITREMedium 6.2
xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary code.
- Product
- medcon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024Car Dealer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSSCVE-2024-4214 · WordPress plugins & themes · reported by PatchstackLow 2.7
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Bill Minozzi Car Dealer allows Code Injection.This issue affects Car Dealer: from n/a through 4.15.
- Product
- Car Dealer
- Affected
- up to 4.15
- What to do
- Affects up to 4.15. Update Car Dealer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Pricing Table by Supsystic: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-32790 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Supsystic Pricing Table by Supsystic allows Code Injection.This issue affects Pricing Table by Supsystic: from n/a through 1.9.12.
- Product
- Pricing Table by Supsystic
- Affected
- up to 1.9.12
- What to do
- Affects up to 1.9.12. Update Pricing Table by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024CP Polls: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-24874 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CodePeople CP Polls allows Code Injection.This issue affects CP Polls: from n/a through 1.0.71.
- Product
- CP Polls
- Affected
- up to 1.0.71
- What to do
- Affects up to 1.0.71. Update CP Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Formidable Forms: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2024-23522 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Injection.This issue affects Formidable Forms: from n/a through 6.7.
- Product
- Formidable Forms
- Affected
- up to 6.7
- What to do
- Affects up to 6.7. Update Formidable Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Simple Basic Contact Form plugin for: Arbitrary shortcode executionCVE-2024-4144 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment.
- Product
- Simple Basic Contact Form plugin for
- Affected
- up to 20240502
- What to do
- Affects up to 20240502. Update Simple Basic Contact Form plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2024Simple Basic Contact Form: Reflected Cross-Site ScriptingCVE-2024-4150 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Simple Basic Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘scf_email’ parameter in versions up to, and including, 20221201 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Simple Basic Contact Form
- Affected
- up to 20221201
- What to do
- Affects up to 20221201. Update Simple Basic Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 7, 2024Cross-site scripting (XSS) vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier.CVE-2024-33748 · Other software · mingsoft · reported by MITREMedium 4.1
Cross-site scripting (XSS) vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier.
- Product
- ms_basic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commvnrepository.com
Apr 24, 2024JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSSCVE-2023-48763 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS vulnerability in Crocoblock JetFormBuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.1.4.
- Product
- JetFormBuilder
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update JetFormBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 24, 2024WP ADA Compliance Check Basic: Cross-Site Request Forgery (CSRF)CVE-2024-32947 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in AlumniOnline Web Services LLC WP ADA Compliance Check Basic.This issue affects WP ADA Compliance Check Basic: from n/a through 3.1.3.
- Product
- WP ADA Compliance Check Basic
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update WP ADA Compliance Check Basic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 15, 2024Calendarista Basic Edition: Cross-Site Request Forgery (CSRF)CVE-2024-31942 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.
- Product
- Calendarista Basic Edition
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 2, 2024In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode (without =inf-cpu or =extCVE-2023-52633 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5
In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_read(), which pushes time forward just a little bit. Then, if we happen to get the interrupt after calculating the new time to push to, but before actually finishing that, the interrupt will set the time to a value that's incompatible with the forward, and we'll crash because time goes backwards when we do the forwarding. Fix this by reading the time_travel_time, calculating the adjustment, and doing the adjustment all with interrupts disabled.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 29, 2024Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security parameter from the formWifiBasicSet function.CVE-2024-30633 · Network & remote access · tenda · reported by MITREMedium 6.5
Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security parameter from the formWifiBasicSet function.
- Product
- fh1205_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security_5g parameter from formWifiBasicSet function.CVE-2024-30632 · Network & remote access · tenda · reported by MITREMedium 6.5
Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the security_5g parameter from formWifiBasicSet function.
- Product
- fh1205_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.CVE-2024-30598 · Network & remote access · tenda · reported by MITREMedium 6.5
Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
- Product
- fh1203_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.CVE-2024-30597 · Network & remote access · tenda · reported by MITREMedium 6.5
Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.
- Product
- fh1203_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.CVE-2024-30586 · Network & remote access · tenda · reported by MITREMedium 6.5
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
- Product
- fh1202_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2024Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.CVE-2024-30584 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.
- Product
- fh1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024Calendarista Basic Edition: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27993 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.
- Product
- Calendarista Basic Edition
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Calendarista Basic Edition to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.