Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,408 results · page 74 of 389
Mar 23, 2025Pods: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-1446 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Pods WordPress plugin before 3.2.8.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Pods
- Fixed in
- 3.2.8.2
- What to do
- Update Pods to 3.2.8.2 or newer.
Mar 23, 2025Nested Pages: Does not sanitise and escape some of its settingsCVE-2025-0718 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Nested Pages WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Nested Pages
- Fixed in
- 3.2.13
- What to do
- Update Nested Pages to 3.2.13 or newer.
Mar 20, 2025In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step.CVE-2024-8954 · Other software · composiohq · reported by security@huntr.devCritical 9.8
In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the `x-api-key` header, thereby gaining unauthorized access to the server.
- Product
- composiohq/composio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in thCVE-2024-6854 · Other software · h2oai · reported by security@huntr.devHigh 7.1
In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a trained model file, although the content of the overwrite is not controllable by the attacker.
- Product
- h2oai/h2o-3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default falCVE-2024-6827 · Other software · benoitc · reported by security@huntr.devHigh 7.5
Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
- Product
- benoitc/gunicorn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a CVE-2024-4990 · Websites & servers · yiisoft · reported by security@huntr.devCritical 9.1
In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking setter methods. Depending on the installed dependencies, various types of attacks are possible, including the execution of arbitrary code, retrieval of sensitive information, and unauthorized access.
- Product
- yiisoft/yii2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any usCVE-2024-12776 · Other software · langgenius · reported by security@huntr.devHigh 8.1
In langgenius/dify v0.10.1, the `/forgot-password/resets` endpoint does not verify the password reset code, allowing an attacker to reset the password of any user, including administrators. This vulnerability can lead to a complete compromise of the application.
- Product
- langgenius/dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025Link My Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13881 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Link My Posts
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Link My Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025My Quota: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13880 · WordPress plugins & themes · reported by WPScanHigh 7.1
The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- My Quota
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update My Quota to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025SpotBot: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13878 · WordPress plugins & themes · reported by WPScanHigh 7.1
The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- SpotBot
- Affected
- up to 0.1.8
- What to do
- Affects up to 0.1.8. Update SpotBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025Passbeemedia Web Push Notification: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13877 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Passbeemedia Web Push Notification
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Passbeemedia Web Push Notification to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025mEintopf: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13876 · WordPress plugins & themes · reported by WPScanHigh 7.1
The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- mEintopf
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update mEintopf to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 20, 2025WP-PManager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13875 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP-PManager
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update WP-PManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 19, 2025Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe anCVE-2025-30197 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comLow 3.1
Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it.
- Product
- Jenkins Zoho QEngine Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme, resulting in a stoCVE-2025-30196 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step.
- Product
- Jenkins AnchorChain Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2025Site Reviews: Does not properly sanitise and escape some of its Review fieldsCVE-2025-1232 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks
- Product
- Site Reviews
- Fixed in
- 7.2.5
- What to do
- Update Site Reviews to 7.2.5 or newer.
Mar 17, 2025Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variable assignment to bCVE-2025-30143 · Other software · Akamai · reported by MITREMedium 5.4
Rule 3000216 (before version 2) in Akamai App & API Protector (with Akamai ASE) before 2024-12-10 does not properly consider JavaScript variable assignment to built-in functions and properties.
- Product
- App & API Protector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtechdocs.akamai.com
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1624 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- GDPR Cookie Compliance
- Fixed in
- 4.15.9
- What to do
- Update GDPR Cookie Compliance to 4.15.9 or newer.
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1623 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- GDPR Cookie Compliance
- Fixed in
- 4.15.9
- What to do
- Update GDPR Cookie Compliance to 4.15.9 or newer.
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1622 · WordPress plugins & themes · reported by WPScanLow 3.5
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- GDPR Cookie Compliance
- Fixed in
- 4.15.7
- What to do
- Update GDPR Cookie Compliance to 4.15.7 or newer.
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- GDPR Cookie Compliance
- Fixed in
- 4.15.7
- What to do
- Update GDPR Cookie Compliance to 4.15.7 or newer.
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1620 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- GDPR Cookie Compliance
- Fixed in
- 4.15.7
- What to do
- Update GDPR Cookie Compliance to 4.15.7 or newer.
Mar 16, 2025GDPR Cookie Compliance: Does not sanitise and escape some of its settingsCVE-2025-1619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- GDPR Cookie Compliance
- Fixed in
- 4.15.7
- What to do
- Update GDPR Cookie Compliance to 4.15.7 or newer.
Mar 16, 2025Poll Maker: Does not sanitise and escape some of its settingsCVE-2024-13602 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Poll Maker WordPress plugin before 5.5.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Poll Maker
- Fixed in
- 5.5.4
- What to do
- Update Poll Maker to 5.5.4 or newer.
Mar 16, 2025Download Manager: Doesn't prevent directory listing on web servers that don't use htaccessCVE-2024-13126 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Download Manager WordPress plugin before 3.3.07 doesn't prevent directory listing on web servers that don't use htaccess, allowing unauthorized access of files.
- Product
- Download Manager
- Fixed in
- 3.3.07
- What to do
- Update Download Manager to 3.3.07 or newer.
Mar 16, 2025Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.CVE-2024-58103 · Other software · Square · reported by MITREMedium 5.8
Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.
- Product
- Wire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2025WoWPth: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1487 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WoWPth
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WoWPth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025WoWPth: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1486 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WoWPth WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WoWPth
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update WoWPth to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025Limit Bio: Does not have CSRF checkCVE-2025-1436 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Limit Bio WordPress plugin through 1.0 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Limit Bio
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Limit Bio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025WP Click Info: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-1401 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Click Info WordPress plugin through 2.7.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Click Info
- Affected
- up to 2.7.4
- What to do
- Affects up to 2.7.4. Update WP Click Info to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025Schedule: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13891 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Schedule WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Schedule
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025WP e-Customers Beta: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13885 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP e-Customers Beta WordPress plugin through 0.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP e-Customers Beta
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update WP e-Customers Beta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025Limit Bio: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13884 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Limit Bio WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Limit Bio
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Limit Bio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 13, 2025The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential CVE-2020-36843 · Other software · str4d · reported by MITREMedium 4.3
The implementation of EdDSA in EdDSA-Java (aka ed25519-java) through 0.3.0 exhibits signature malleability and does not satisfy the SUF-CMA (Strong Existential Unforgeability under Chosen Message Attacks) property. This allows attackers to create new valid signatures different from previous signatures for a known message.
- Product
- ed25519-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeprint.iacr.orggithub.com
Mar 11, 2025Coronavirus (COVID-19) Notice Message: Does not sanitise and escape some of its settingsCVE-2025-0629 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Coronavirus (COVID-19) Notice Message
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update Coronavirus (COVID-19) Notice Message to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Countdown Timer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13864 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Countdown Timer
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Countdown Timer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13862 · WordPress plugins & themes · reported by WPScanHigh 7.1
The S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) WordPress plugin through 8.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality)
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update S3Bubble Media Streaming (AWS|Elementor|YouTube|Vimeo Functionality) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025SEO Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13853 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- SEO Tools
- Affected
- up to 4.0.7
- What to do
- Affects up to 4.0.7. Update SEO Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025WP Login Control: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13836 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Login Control WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP Login Control
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update WP Login Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap: Does not sanitise and escape some of its settingsCVE-2024-13615 · WordPress plugins & themes · reported by WPScanLow 3.5
The Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap WordPress plugin through 1.3.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update Social Share Buttons, Social Sharing Icons, Click to Tweet — Social Media Plugin by Social Snap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025XV Random Quotes: Does not have CSRF check in placeCVE-2024-13580 · WordPress plugins & themes · reported by WPScanMedium 4.3
The XV Random Quotes WordPress plugin through 1.40 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- XV Random Quotes
- Affected
- up to 1.40
- What to do
- Affects up to 1.40. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025XV Random Quotes: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13574 · WordPress plugins & themes · reported by WPScanHigh 7.1
The XV Random Quotes WordPress plugin through 1.40 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- XV Random Quotes
- Affected
- up to 1.40
- What to do
- Affects up to 1.40. Update XV Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 10, 2025The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact witCVE-2025-27436 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact with a resource is legitimate, allowing the attacker to delete the attachment of a posted bank statement. This leads to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application.
- Product
- SAP S/4HANA (Manage Bank Statements)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability.CVE-2025-26659 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability
- Product
- SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privCVE-2025-26656 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on integrity of the application.
- Product
- S/4HANA (Manage Purchasing Info Records)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise bCVE-2025-26655 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted.
- Product
- SAP Just In Time
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting.CVE-2025-23194 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user can set it to an undesired value causing low impact on integrity. There is no impact on confidentiality or availability of the application.
- Product
- SAP NetWeaver Enterprise Portal (OBN component)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Gtbabel: Does not ensure that the URL to perform code analysis upon belongs to the blogCVE-2024-11638 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gtbabel WordPress plugin before 6.6.9 does not ensure that the URL to perform code analysis upon belongs to the blog which could allow unauthenticated attackers to retrieve a logged in user (such as admin) cookies by making them open a crafted URL as the request made to analysed the URL contains such cookies.
- Product
- Gtbabel
- Fixed in
- 6.6.9
- What to do
- Update Gtbabel to 6.6.9 or newer.
Mar 9, 2025Contact Us By Lord Linus: Does not have CSRF check in some placesCVE-2025-1382 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Contact Us By Lord Linus
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Contact Us By Lord Linus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 9, 2025URL Shortener | Conversion Tracking | AB Testing | WooCommerce: Does not sanitise and escape some of its settingsCVE-2025-1363 · WordPress plugins & themes · reported by WPScanLow 3.5
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- URL Shortener | Conversion Tracking | AB Testing | WooCommerce
- Affected
- up to 9.0.2
- What to do
- Affects up to 9.0.2. Update URL Shortener | Conversion Tracking | AB Testing | WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.