Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,438 results · page 89 of 389
Jul 9, 2024SEOPress: Does not properly protect some of its REST API routesCVE-2024-5488 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
- Product
- SEOPress
- Fixed in
- 7.9
- What to do
- Update SEOPress to 7.9 or newer.
Jul 9, 2024DN Footer Contacts: Does not sanitise and escape some of its settingsCVE-2024-3410 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DN Footer Contacts
- Fixed in
- 1.6.3
- What to do
- Update DN Footer Contacts to 1.6.3 or newer.
Jul 9, 2024SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site ScriptCVE-2024-39595 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows users to modify website content and on successful exploitation, an attacker can cause low impact to the confidentiality and integrity of the application.
- Product
- SAP Business Warehouse - Business Planning and Simulation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site ScrCVE-2024-39594 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause low impact on the confidentiality and integrity of the application.
- Product
- SAP Business Warehouse - Business Planning and Simulation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges.CVE-2024-37175 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP CRM WebClient does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to access some sensitive information.
- Product
- SAP CRM WebClient UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in escalation of privilegeCVE-2024-37172 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality and availability but there is no impact on the integrity.
- Product
- SAP S/4HANA Finance (Advanced Payment Management)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-39592 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.7
Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application.
- Product
- SAP PDCE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability.CVE-2024-37174 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application.
- Product
- SAP CRM WebClient UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2024tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory CVE-2024-1305 · Other software · OpenVPN · reported by security@openvpn.netCritical 9.8
tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting in a bug check and potentially arbitrary code execution in kernel space
- Product
- tap-windows6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openvpn.netmail-archive.com
Jul 3, 2024In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intendeCVE-2024-6284 · Computers, phones & browsers · Google · reported by cve-coordination@google.comMedium 6.3
In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended (might block or not block the desired addresses). This issue affects: https://pkg.go.dev/github.com/google/nftables@v0.1.0 The bug was fixed in the next released version: https://pkg.go.dev/github.com/google/nftables@v0.2.0
- Product
- https://github.com/google/nftables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Jul 3, 2024WPQA Builder: Does not have CSRF checks in some placesCVE-2024-2376 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- WPQA Builder
- Fixed in
- 6.1.1
- What to do
- Update WPQA Builder to 6.1.1 or newer.
Jul 3, 2024WPQA Builder: Does not sanitise and escape some of its Slider settingsCVE-2024-2375 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WPQA Builder
- Fixed in
- 6.1.1
- What to do
- Update WPQA Builder to 6.1.1 or newer.
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 3, 2024Himer: Does not sanitise and escape some of its Post settingsCVE-2024-2234 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2233 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2040 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 2, 2024sitetweet: Does not have CSRF check in some placesCVE-2024-5767 · WordPress plugins & themes · reported by WPScanHigh 8.8
The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- sitetweet
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update sitetweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2024Quiz and Survey Master (QSM): Is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX actionCVE-2024-5606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.2
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Jul 2, 2024Rank Math SEO: Does not sanitise and escape some of its settingsCVE-2024-4627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings (by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO WordPress plugin before 1.0.219) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Rank Math SEO
- Fixed in
- 1.0.219
- What to do
- Update Rank Math SEO to 1.0.219 or newer.
Jul 2, 2024EazyDocs: Does not sanitise and escape some of its settingsCVE-2024-3999 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- EazyDocs
- Fixed in
- 2.5.0
- What to do
- Update EazyDocs to 2.5.0 or newer.
Jul 1, 2024In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold theCVE-2024-36989 · Other software · Splunk · reported by prodsec@splunk.comHigh 7.1
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Jul 1, 2024In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote CodeCVE-2024-36985 · Other software · Splunk · reported by prodsec@splunk.comHigh 8.8
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisory.splunk.comresearch.splunk.com
Jul 1, 2024Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-6130 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.26
- What to do
- Update Form Maker by 10Web to 1.15.26 or newer.
Jul 1, 2024Quiz and Survey Master (QSM): Does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embedCVE-2024-4934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.2
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Jul 1, 2024CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly.CVE-2024-3123 · Other software · CHANGING · reported by twcert@cert.org.twHigh 7.2
CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands.
- Product
- Mobile One Time Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 1, 2024CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilegCVE-2024-3122 · Other software · CHANGING · reported by twcert@cert.org.twMedium 4.9
CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system.
- Product
- Mobile One Time Password
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 28, 2024Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used.CVE-2024-5737 · Other software · Nikola Vasilijevski · reported by cvd@cert.plMedium 6.3
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0.
- Product
- AdmirorFrames
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2024Pagerank tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5730 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Pagerank tools
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Pagerank tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Simple AL Slider: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5729 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Simple AL Slider
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Simple AL Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Animated AL List: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5728 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Animated AL List
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Animated AL List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Widget4Call: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5727 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Widget4Call
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Widget4Call to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Simple Photoswipe: Does not have authorisation checkCVE-2024-5570 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them
- Product
- Simple Photoswipe
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Simple Photoswipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect theCVE-2024-39349 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and it does not affect the upstream library. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jun 27, 2024In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor.CVE-2016-20022 · Other software · reported by MITREHigh 8.4
In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor. NOTE: This vulnerability only affects products that are no longer supported by the supplier.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlore.kernel.org
Jun 27, 2024CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSCVE-2024-5642 · Other software · Python Software Foundation · reported by cna@python.orgMedium 6.5
CPython 3.9 and earlier doesn't disallow configuring an empty list ("[]") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).
- Product
- CPython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Jun 27, 2024D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL.CVE-2024-36755 · Network & remote access · d-link · reported by MITREMedium 6.8
D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to downgrade the firmware version or change the downloading URL via a man-in-the-middle attack.
- Product
- dir-1950_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comsupportannouncement.us.dlink.com
Jun 27, 2024IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another applicatioCVE-2023-42011 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Sterling B2B Integrator Standard Edition 6.1 and 6.2 does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. IBM X-Force ID: 265508.
- Product
- Sterling B2B Integrator Standard Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 27, 2024WP Chat App: Does not sanitise and escape some of its settingsCVE-2024-4664 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WP Chat App
- Fixed in
- 3.6.5
- What to do
- Update WP Chat App to 3.6.5 or newer.
Jun 27, 2024Interactive Content: Does not validate uploadsCVE-2024-3111 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues
- Product
- Interactive Content
- Fixed in
- 1.15.8
- What to do
- Update Interactive Content to 1.15.8 or newer.
Jun 27, 2024kadence-blocks-pro: Does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the databaseCVE-2024-1330 · WordPress plugins & themes · reported by WPScanMedium 4.3
The kadence-blocks-pro WordPress plugin before 2.3.8 does not prevent users with at least the contributor role using some of its shortcode's functionalities to leak arbitrary options from the database.
- Product
- kadence-blocks-pro
- Fixed in
- 2.3.8
- What to do
- Update kadence-blocks-pro to 2.3.8 or newer.
Jun 26, 2024Easy Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-5573 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Easy Table of Contents
- Fixed in
- 2.0.66
- What to do
- Update Easy Table of Contents to 2.0.66 or newer.
Jun 26, 2024Simple Photoswipe: Does not sanitise and escape some of its settingsCVE-2024-5473 · WordPress plugins & themes · reported by WPScanMedium 4
The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Photoswipe
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Simple Photoswipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Spotify Play Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5199 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Spotify Play Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Spotify Play Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Video Widget: Does not sanitise and escape some of its settingsCVE-2024-5169 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Video Widget
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Video Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Frontend Checklist: Does not sanitise and escape some of its settingsCVE-2024-4959 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Frontend Checklist
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Frontend Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Frontend Checklist: Does not sanitise and escape some of its settingsCVE-2024-4957 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Frontend Checklist
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Frontend Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Muslim Prayer Time BD: Does not have CSRF check in placeCVE-2024-4758 · WordPress plugins & themes · reported by WPScanHigh 7.6
The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- Muslim Prayer Time BD
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Muslim Prayer Time BD to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024WebP & SVG Support: Does not sanitise uploaded SVG filesCVE-2024-3633 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- WebP & SVG Support
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update WebP & SVG Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2024Mime Types Extended: Does not sanitise uploaded SVG filesCVE-2024-4759 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Mime Types Extended
- Affected
- up to 0.11
- What to do
- Affects up to 0.11. Update Mime Types Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2024Logo Manager For Enamad: Does not have CSRF check in some placesCVE-2024-4757 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Logo Manager For Enamad WordPress plugin through 0.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Logo Manager For Enamad
- Affected
- up to 0.7.0
- What to do
- Affects up to 0.7.0. Update Logo Manager For Enamad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.