Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,438 results · page 92 of 389
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: mmc: mmc_spi: fix error handling in mmc_spi_probe() If mmc_add_host() fails, it doesn't neCVE-2023-52708 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: mmc: mmc_spi: fix error handling in mmc_spi_probe() If mmc_add_host() fails, it doesn't need to call mmc_remove_host(), or it will cause null-ptr-deref, because of deleting a not added device in mmc_remove_host(). To fix this, goto label 'fail_glue_init', if mmc_add_host() fails, and change the label 'fail_add_host' to 'fail_gpiod_request'.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Fix resource leak in case of probe failure The driver doesn't clean upCVE-2021-47329 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 6.2
In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Fix resource leak in case of probe failure The driver doesn't clean up all the allocated resources properly when scsi_add_host(), megasas_start_aen() function fails during the PCI device probe. Clean up all those resources.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: dma-buf/sync_file: Don't leak fences on merge failure Each add_fence() call does a dma_fenCVE-2021-47305 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: dma-buf/sync_file: Don't leak fences on merge failure Each add_fence() call does a dma_fence_get() on the relevant fence. In the error path, we weren't calling dma_fence_put() so all those fences got leaked. Also, in the krealloc_array failure case, we weren't freeing the fences array. Instead, ensure that i and fences are always zero-initialized and dma_fence_put() all the fences and kfree(fences) on every error path.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 21, 2024Carousel Slider: Does not sanitise and escape some parametersCVE-2024-4372 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
- Product
- Carousel Slider
- Fixed in
- 2.2.11
- What to do
- Update Carousel Slider to 2.2.11 or newer.
May 21, 2024Sailthru Triggermail: Does not sanitise and escape some of its settingsCVE-2024-4290 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Sailthru Triggermail: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-4289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Survey Maker: Does not sanitise and escape some of its settingsCVE-2024-4061 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Survey Maker
- Fixed in
- 4.2.9
- What to do
- Update Survey Maker to 4.2.9 or newer.
May 21, 2024Social Icons Widget & Block by WPZOOM: Does not sanitise and escape some of its Widget settingsCVE-2024-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Icons Widget & Block by WPZOOM
- Fixed in
- 4.2.18
- What to do
- Update Social Icons Widget & Block by WPZOOM to 4.2.18 or newer.
May 20, 2024smanga 3.2.7 does not filter the file parameter at the PHP/get file flow.php interface, resulting in a path traversal vulnerability that can cause arbitrary filCVE-2024-34193 · Other software · pocketmanga · reported by MITREHigh 7.5
smanga 3.2.7 does not filter the file parameter at the PHP/get file flow.php interface, resulting in a path traversal vulnerability that can cause arbitrary file reading.
- Product
- smanga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2024All in One SEO: Does not validate and escape some of its Post fields before outputting them backCVE-2024-3368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- All in One SEO
- Fixed in
- 4.6.1.1
- What to do
- Update All in One SEO to 4.6.1.1 or newer.
May 17, 2024In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK The firmware doesn't need the MFP fCVE-2024-27434 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK The firmware doesn't need the MFP flag for the GTK, it can even make the firmware crash. in case the AP is configured with: group cipher TKIP and MFPC. We would send the GTK with cipher = TKIP and MFP which is of course not possible.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 17, 2024Popup4Phone: Does not sanitise and escape some of its settingsCVE-2024-3580 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Popup4Phone
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Popup4Phone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2024Popup4Phone: Does not sanitise and escape some parametersCVE-2024-3231 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Popup4Phone
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Popup4Phone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2024NextGEN Gallery: Does not sanitise and escape some of its settingsCVE-2024-2744 · WordPress plugins & themes · reported by WPScanMedium 4.3
The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- NextGEN Gallery
- Fixed in
- 3.59.1
- What to do
- Update NextGEN Gallery to 3.59.1 or newer.
May 17, 2024socialdriver-framework: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-2697 · WordPress plugins & themes · reported by WPScanMedium 6.5
The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- socialdriver-framework
- Fixed in
- 2024.0.0
- What to do
- Update socialdriver-framework to 2024.0.0 or newer.
May 16, 2024ePO doesn't allow a regular privileged user to delete tasks or assignments.CVE-2024-4843 · Other software · Trellix · reported by trellixpsirt@trellix.comMedium 4.3
ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate the client task and client task assignments, hence escalating his/her privilege.
- Product
- ePolicy Orchestrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthrive.trellix.comthrive.trellix.com
May 16, 2024Newsletter Popup: Does not sanitise and escape some of its settingsCVE-2024-3644 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2024Newsletter Popup: Does not have CSRF checkCVE-2024-3643 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2024Newsletter Popup: Does not have CSRF checkCVE-2024-3642 · WordPress plugins & themes · reported by WPScanMedium 6.9
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2024Newsletter Popup: Does not sanitise and escape some parametersCVE-2024-3641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.CVE-2023-6323 · Other software · ThroughTek · reported by cve-requests@bitdefender.comMedium 4.3
ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.
- Product
- Kalay SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
May 15, 2024Base64 Encoder/Decoder: Does not have CSRF check in placeCVE-2024-3824 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not have CSRF checkCVE-2024-3823 · WordPress plugins & themes · reported by WPScanLow 2.4
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024month name translation benaceur: Does not sanitise and escape some of its settingsCVE-2024-3634 · WordPress plugins & themes · reported by WPScanMedium 4.8
The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- month name translation benaceur
- Fixed in
- 2.3.8
- What to do
- Update month name translation benaceur to 2.3.8 or newer.
May 15, 2024HL Twitter: Does not have CSRF checkCVE-2024-3631 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024HL Twitter: Does not sanitise and escape some of its settingsCVE-2024-3630 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024HL Twitter: Does not have CSRF check in placeCVE-2024-3629 · WordPress plugins & themes · reported by WPScanLow 2.4
The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3548 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.1.2
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.2 or newer.
May 15, 2024WP Prayer: Does not have CSRF checks in some placesCVE-2024-3407 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- WP Prayer
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update WP Prayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Prayer: Does not have CSRF check in placeCVE-2024-3406 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Prayer
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update WP Prayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Prayer: Does not have CSRF check in placeCVE-2024-3405 · WordPress plugins & themes · reported by WPScanHigh 7.6
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Prayer
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update WP Prayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-4139 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can delete rules of other users affecting the integrity of the application. Confidentiality and Availability are not affected.
- Product
- SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
May 14, 2024Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-4138 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application. Confidentiality and Availability are not affected.
- Product
- SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
May 14, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3241 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Ultimate Blocks
- Fixed in
- 3.1.7
- What to do
- Update Ultimate Blocks to 3.1.7 or newer.
May 14, 2024Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vuCVE-2024-33002 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability with low impact on Confidentiality and Integrity of the application.
- Product
- SAP S/4HANA (Document Service Handler for DPS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
May 14, 2024SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges.CVE-2024-33000 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
SAP Bank Account Management does not perform necessary authorization check for an authorized user, resulting in escalation of privileges. As a result, it has a low impact to confidentiality to the system.
- Product
- SAP Bank Account Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
May 14, 2024 SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-32731 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.5
SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request which will lead to a low impact on the confidentiality, integrity and availability of the application.
- Product
- SAP My Travel Requests
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
May 14, 2024The access control in CemiPark software does not properly validate user-entered data, which allows the stored cross-site scripting (XSS) attack.CVE-2024-4424 · Other software · CEMI Tomasz Pawełek · reported by cvd@cert.plMedium 6.1
The access control in CemiPark software does not properly validate user-entered data, which allows the stored cross-site scripting (XSS) attack. The parameters used to enter data into the system do not have appropriate validation, which makes possible to smuggle in HTML/JavaScript code. This code will be executed in the user's browser space.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.
- Product
- CemiPark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024The access control in CemiPark software does not properly validate user-entered data, which allows the authentication bypass.CVE-2024-4423 · Other software · CEMI Tomasz Pawełek · reported by cvd@cert.plHigh 7.2
The access control in CemiPark software does not properly validate user-entered data, which allows the authentication bypass. An attacker who has network access to the login panel can log in with administrator rights to the application.This issue affects CemiPark software: 4.5, 4.7, 5.03 and potentially others. The vendor refused to provide the specific range of affected products.
- Product
- CemiPark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in some placesCVE-2024-3941 · WordPress plugins & themes · reported by WPScanMedium 4.7
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
- Product
- reCAPTCHA Jetpack
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in placeCVE-2024-3940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- reCAPTCHA Jetpack
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Add Custom CSS and JS: Does not have CSRF check in some placesCVE-2024-3903 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in as author and above add Stored XSS payloads via a CSRF attack
- Product
- Add Custom CSS and JS
- Affected
- up to 1.20
- What to do
- Affects up to 1.20. Update Add Custom CSS and JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024LetterPress: Does not have CSRF checks in some placesCVE-2024-3590 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers
- Product
- LetterPress
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update LetterPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024UnGallery: Does not have CSRF check in some placesCVE-2024-3582 · WordPress plugins & themes · reported by WPScanMedium 4.8
The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- UnGallery
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update UnGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Post Grid Gutenberg Blocks and WordPress Blog
- Fixed in
- 4.0.2
- What to do
- Update Post Grid Gutenberg Blocks and WordPress Blog to 4.0.2 or newer.
May 14, 2024SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.CVE-2024-32730 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which will lead to a high impact to the confidentiality of the application.
- Product
- SAP Enable Now
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordme.sap.comsupport.sap.com
May 14, 2024Save as PDF Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2023-5971 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as PDF Plugin by Pdfcrowd
- Fixed in
- 3.2.0
- What to do
- Update Save as PDF Plugin by Pdfcrowd to 3.2.0 or newer.
May 8, 2024SSL Zen: Does not properly prevent directory listing of the private keys folderCVE-2024-1076 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support .htaccess files, like NGINX.
- Product
- SSL Zen
- Fixed in
- 4.6.0
- What to do
- Update SSL Zen to 4.6.0 or newer.
May 7, 2024EasyEvent: Does not sanitise and escape some of its settingsCVE-2024-3628 · WordPress plugins & themes · reported by WPScanLow 3.8
The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- EasyEvent
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update EasyEvent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.