Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
18 results
Oct 11, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POCVE-2026-108869 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcements to any users via WebSocket, WeCom, DingTalk and Feishu.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /syCVE-2026-108868 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications to arbitrary users through WebSocket, DingTalk, WeCom, Feishu and UniPush channels.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' mCVE-2026-108642 · Other software · jeecgboot · reported by VulnCheckMedium 5.3
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients.
- Product
- JeecgBoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026Horizontal scrolling announcements: Does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front endCVE-2026-17005 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
- Product
- Horizontal scrolling announcements
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Horizontal scrolling announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 30, 2026Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules.CVE-2026-82657 · Other software · Admidio · reported by VulnCheckHigh 8.7
Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post text, author names, and timestamps.
- Product
- admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 22, 2025Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website: Stored Cross-Site ScriptingCVE-2025-12033 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pro_version_activation_code' parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
- Affected
- up to 3.0.10
- What to do
- Affects up to 3.0.10. Update Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 4, 2025Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website: Stored Cross-Site ScriptingCVE-2024-13898 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 21, 2025WP-Announcements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-23489 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Messenlehner WP-Announcements wp-announcements allows Reflected XSS.This issue affects WP-Announcements: from n/a through <= 1.8.
- Product
- WP-Announcements
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update WP-Announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024Top and footer bars for announcements, notifications, advertisements, promotions – YooBar: Stored Cross-Site ScriptingCVE-2024-11410 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Top and footer bars for announcements, notifications, advertisements, promotions – YooBar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Yoo Bar settings in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Top and footer bars for announcements, notifications, advertisements, promotions – YooBar
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update Top and footer bars for announcements, notifications, advertisements, promotions – YooBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Aug 5, 2024Horizontal scrolling announcements: SQL InjectionCVE-2023-5000 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Horizontal scrolling announcements plugin for WordPress is vulnerable to SQL Injection via the plugin's 'hsas-shortcode' shortcode in versions up to, and including, 2.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Horizontal scrolling announcements
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Horizontal scrolling announcements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 10, 2023Scheduled Announcements Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0363 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scheduled Announcements Widget WordPress plugin before 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Scheduled Announcements Widget
- Fixed in
- 1.0
- What to do
- Update Scheduled Announcements Widget to 1.0 or newer.
Nov 14, 2022A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 beforeCVE-2022-42110 · Other software · Liferay · reported by MITREMedium 6.1
A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.liferay.comportal.liferay.dev
Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
- Product
- Tutor LMS – eLearning and online course solution
- Fixed in
- 1.9.2
- What to do
- Update Tutor LMS – eLearning and online course solution to 1.9.2 or newer.
Nov 12, 2020In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab.CVE-2020-26804 · Network & remote access · Sapplica · reported by MITREHigh 8.8
In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab. Also, in this page, users can upload attachments with the shared announcements. This "Upload Attachment" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server.
- Product
- Sentrifugo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.blogspot.com
Jan 30, 2020Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.CVE-2013-0738 · Other software · Chamilo · reported by PSIRT-CNA@flexerasoftware.comMedium 6.1
Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
May 11, 2017Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power BoaCVE-2017-8898 · Other software · Invisioncommunity · reported by MITRECritical 9.8
Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request. This is related to the "<> Source" option.
- Product
- Invision Power Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzeroday.insecurity.zonetwitter.com
Oct 31, 2012The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access reCVE-2012-4500 · Other software · Nancy Wichmann · reported by Red HatLow 3.5
The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact.
- Product
- Announcements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2010SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2008-7267 · Other software · Boka · reported by MITREHigh 7.5
SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter.
- Product
- Siteengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.