Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,507 results · page 8 of 31
Jan 31, 2025Privacy Policy Genius: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13219 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Privacy Policy Genius
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Privacy Policy Genius to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Fast Tube: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13218 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Fast Tube WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Fast Tube
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Fast Tube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025WP MediaTagger: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13112 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP MediaTagger WordPress plugin through 4.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP MediaTagger
- Affected
- up to 4.1.1
- What to do
- Affects up to 4.1.1. Update WP MediaTagger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025OPSI Israel Domestic Shipments: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13100 · WordPress plugins & themes · reported by WPScanMedium 6.1
The OPSI Israel Domestic Shipments WordPress plugin through 2.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- OPSI Israel Domestic Shipments
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update OPSI Israel Domestic Shipments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 31, 2025Ninja Tables: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2024-12772 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ninja Tables WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, leading to a Cross Site Scripting vulnerability.
- Product
- Ninja Tables
- Fixed in
- 5.0.17
- What to do
- Update Ninja Tables to 5.0.17 or newer.
Jan 31, 2025Canvasflow for: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12275 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Canvasflow for WordPress plugin through 1.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Canvasflow for
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Canvasflow for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 30, 2025Bulk Me Now!: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12638 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Bulk Me Now! WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Bulk Me Now!
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Bulk Me Now! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 29, 2025Competition Form: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12749 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Competition Form
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Competition Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 28, 2025The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13CVE-2024-13509 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability is partially fixed in 1.10.13 and completely fixed in 1.10.14.
- Affected
- up to 1.10.13
- Fixed in
- 1.10.13
- What to do
- Update the plugin to 1.10.13 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 28, 2025Infility Global: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12723 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Infility Global
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update Infility Global to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WP Triggers Lite: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-13095 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- WP Triggers Lite
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Triggers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WP Triggers Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13094 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WP Triggers Lite
- Affected
- up to 2.5.3
- What to do
- Affects up to 2.5.3. Update WP Triggers Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dyn Business Panel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13056 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Dyn Business Panel
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dyn Business Panel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13055 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Dyn Business Panel
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Dyn Business Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Dental Optimizer Patient Generator App: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13052 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Dental Optimizer Patient Generator App WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Dental Optimizer Patient Generator App
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Dental Optimizer Patient Generator App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Altra Side Menu: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12773 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Altra Side Menu WordPress plugin through 2.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Altra Side Menu
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Altra Side Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WC Affiliate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12321 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WC Affiliate
- Affected
- up to 2.3.9
- What to do
- Affects up to 2.3.9. Update WC Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 11, 2025Contact Form Master: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12587 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Contact Form Master
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Contact Form Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025MG Parallax Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22330 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mahesh Waghmare MG Parallax Slider mg-parallax-slider allows Reflected XSS.This issue affects MG Parallax Slider: from n/a through <= 1.0..
- Product
- MG Parallax Slider
- Affected
- up to 1.0.
- What to do
- Affects up to 1.0.. Update MG Parallax Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025BU Section Editing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12736 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- BU Section Editing
- Affected
- up to 0.9.9
- What to do
- Affects up to 0.9.9. Update BU Section Editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Aklamator INfeed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12731 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Aklamator INfeed
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Aklamator INfeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Asgard Security Scanner: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12715 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Asgard Security Scanner
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Asgard Security Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Backlink Monitoring Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12714 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Backlink Monitoring Manager
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Backlink Monitoring Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025PostLists: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-10815 · WordPress plugins & themes · reported by WPScanMedium 4.2
The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- PostLists
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update PostLists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2025Property Hive: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12585 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Property Hive
- Fixed in
- 2.1.1
- What to do
- Update Property Hive to 2.1.1 or newer.
Jan 7, 2025The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versCVE-2024-12077 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Booking Calendar and Booking Calendar Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘calendar_id’ parameter in all versions up to, and including, 3.2.19 and 11.2.19 respectively, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected
- up to 3.2.19
- What to do
- Affects up to 3.2.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 7, 2025WordPress Auction: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-8855 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks
- Product
- WordPress Auction
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 6, 2025Email Subscribers by Icegram Express: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12311 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.44
- What to do
- Update Email Subscribers by Icegram Express to 5.7.44 or newer.
Jan 6, 2025tourmaster: Does not sanitise and escape some parametersCVE-2024-11356 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- tourmaster
- Fixed in
- 5.3.4
- What to do
- Update tourmaster to 5.3.4 or newer.
Jan 2, 2025AHAthat: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-12595 · WordPress plugins & themes · reported by WPScanMedium 4.7
The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- AHAthat
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 1, 2025The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against higCVE-2024-11846 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Dec 27, 2024GiveWP: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-11921 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- GiveWP
- Fixed in
- 3.19.0
- What to do
- Update GiveWP to 3.19.0 or newer.
Dec 24, 2024Exhibit to WP Gallery: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12096 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Exhibit to WP Gallery WordPress plugin through 0.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Exhibit to WP Gallery
- Affected
- up to 0.0.2
- What to do
- Affects up to 0.0.2. Update Exhibit to WP Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024AI Engine: Does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statementCVE-2024-10499 · WordPress plugins & themes · reported by WPScanHigh 7.2
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- AI Engine
- Fixed in
- 2.6.5
- What to do
- Update AI Engine to 2.6.5 or newer.
Dec 10, 2024System Dashboard: Does not sanitise and escape some parametersCVE-2024-11107 · WordPress plugins & themes · reported by WPScanMedium 6.1
The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- System Dashboard
- Fixed in
- 2.8.15
- What to do
- Update System Dashboard to 2.8.15 or newer.
Dec 9, 2024PayPal Brasil para WooCommerce: Missing AuthorizationCVE-2023-25026 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2.
- Product
- PayPal Brasil para WooCommerce
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update PayPal Brasil para WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.CVE-2024-12015 · WordPress plugins & themes · reported by vulnreport@tenable.comHigh 7.7
The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.
- What to do
- Update the plugin to the newest version.
Nov 21, 2024Taskbuilder: Does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statementCVE-2024-9828 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks
- Product
- Taskbuilder
- Fixed in
- 3.0.5
- What to do
- Update Taskbuilder to 3.0.5 or newer.
Nov 19, 2024Parallaxer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51848 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitalzoomstudio Parallaxer parallaxer-lite-parallax-effects-on-images allows Stored XSS.This issue affects Parallaxer: from n/a through <= 1.00.
- Product
- Parallaxer
- Affected
- up to 1.00
- What to do
- Affects up to 1.00. Update Parallaxer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Parallax Image: Stored Cross-Site ScriptingCVE-2024-11224 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘position’ parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Parallax Image
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Parallax Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 14, 2024Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: Does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statementCVE-2024-9186 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
- Fixed in
- 3.3.0
- What to do
- Update Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit to 3.3.0 or newer.
Nov 12, 2024RSS Feed Widget: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-9835 · WordPress plugins & themes · reported by WPScanMedium 4.8
The RSS Feed Widget WordPress plugin before 3.0.1 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- RSS Feed Widget
- Fixed in
- 3.0.1
- What to do
- Update RSS Feed Widget to 3.0.1 or newer.
Nov 11, 2024MasterBip para Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masterbip MasterBip para Elementor masterbip-for-elementor allows DOM-Based XSS.This issue affects MasterBip para Elementor: from n/a through <= 1.6.3.
- Product
- MasterBip para Elementor
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update MasterBip para Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 8, 2024Registrations for the Events Calendar: Does not sanitise and escape some parametersCVE-2024-7982 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Registrations for the Events Calendar WordPress plugin before 2.12.4 does not sanitise and escape some parameters when accepting event registrations, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.12.4
- What to do
- Update Registrations for the Events Calendar to 2.12.4 or newer.
Nov 6, 2024Wp-ImageZoom: Does not sanitise and escape some parameters before outputting them back in a pageCVE-2024-9934 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wp-ImageZoom WordPress plugin through 1.1.0 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Wp-ImageZoom
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Wp-ImageZoom to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Download Manager: Doesn't sanitize some of it's shortcode parametersCVE-2024-8444 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.
- Product
- Download Manager
- Fixed in
- 3.3.00
- What to do
- Update Download Manager to 3.3.00 or newer.
Oct 21, 2024TS Poll: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-8625 · WordPress plugins & themes · reported by WPScanHigh 7.2
The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- TS Poll
- Fixed in
- 2.4.0
- What to do
- Update TS Poll to 2.4.0 or newer.
Oct 20, 2024jLayer Parallax Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49334 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unizoe Web Solutions jLayer Parallax Slider jlayer-parallax-slider-wp allows Reflected XSS.This issue affects jLayer Parallax Slider: from n/a through <= 1.0.
- Product
- jLayer Parallax Slider
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update jLayer Parallax Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Parallax Image: Stored Cross-Site ScriptingCVE-2024-9898 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Parallax Image
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Parallax Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2024The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufCVE-2017-20193 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Product Vendors is vulnerable to Reflected Cross-Site Scripting via the 'vendor_description' parameter in versions up to, and including, 2.0.35 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected
- up to 2.0.35
- What to do
- Affects up to 2.0.35. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordhackerone.comthreatpost.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.