Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,507 results · page 10 of 31
Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5283 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.1
- What to do
- Update wp-affiliate-platform to 6.5.1 or newer.
Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5282 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.1
- What to do
- Update wp-affiliate-platform to 6.5.1 or newer.
Jul 13, 2024wp-affiliate-platform: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5281 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-affiliate-platform WordPress plugin before 6.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.1
- What to do
- Update wp-affiliate-platform to 6.5.1 or newer.
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5075 · WordPress plugins & themes · reported by WPScanMedium 5.9
The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- wp-eMember
- Fixed in
- 10.6.6
- What to do
- Update wp-eMember to 10.6.6 or newer.
Jul 13, 2024wp-eMember: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5074 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- wp-eMember
- Fixed in
- 10.6.6
- What to do
- Update wp-eMember to 10.6.6 or newer.
Jul 13, 2024SULly: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5032 · WordPress plugins & themes · reported by WPScanMedium 4.7
The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- SULly
- Fixed in
- 4.3.1
- What to do
- Update SULly to 4.3.1 or newer.
Jul 13, 2024Index WP MySQL For Speed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4977 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Index WP MySQL For Speed WordPress plugin before 1.4.18 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Index WP MySQL For Speed
- Fixed in
- 1.4.18
- What to do
- Update Index WP MySQL For Speed to 1.4.18 or newer.
Jul 13, 2024Giveaways and Contests by RafflePress: Does not sanitise and escape some parametersCVE-2024-3963 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.14 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.12.14
- What to do
- Update Giveaways and Contests by RafflePress to 1.12.14 or newer.
Jul 13, 2024Hostel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3753 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Hostel
- Fixed in
- 1.1.5.3
- What to do
- Update Hostel to 1.1.5.3 or newer.
Jul 13, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some parametersCVE-2024-3026 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
- Product
- WordPress Button Plugin MaxButtons
- Fixed in
- 9.7.8
- What to do
- Update WordPress Button Plugin MaxButtons to 9.7.8 or newer.
Jul 13, 2024socialdriver-framework: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-2870 · WordPress plugins & themes · reported by WPScanMedium 6.1
The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- socialdriver-framework
- Fixed in
- 2024.04.30
- What to do
- Update socialdriver-framework to 2024.04.30 or newer.
Jul 12, 2024Inline Related Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5626 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Inline Related Posts
- Fixed in
- 3.7.0
- What to do
- Update Inline Related Posts to 3.7.0 or newer.
Jul 2, 2024Quiz and Survey Master (QSM): Is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX actionCVE-2024-5606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.2
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Jun 28, 2024Pagerank tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5730 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Pagerank tools
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Pagerank tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Simple AL Slider: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5729 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Simple AL Slider
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Simple AL Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Animated AL List: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5728 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Animated AL List
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Animated AL List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Widget4Call: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5727 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Widget4Call
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Widget4Call to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Bookster: Allows adding sensitive parametersCVE-2024-5071 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Bookster WordPress plugin through 1.1.0 allows adding sensitive parameters when validating appointments allowing attackers to manipulate the data sent when booking an appointment (the request body) to change its status from pending to approved.
- Product
- Bookster
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Bookster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024Widget Bundle: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4616 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users
- Product
- Widget Bundle
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Widget Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2024HTML5 Video Player: Does not sanitize and escape a parameter from a REST route before using it in a SQL statementCVE-2024-5522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- HTML5 Video Player
- Fixed in
- 2.5.27
- What to do
- Update HTML5 Video Player to 2.5.27 or newer.
Jun 14, 2024Pray For Me: Does not sanitise and escape some parametersCVE-2024-3966 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripting attacks that trigger when an admin visits the Prayer Requests in the WP Admin
- Product
- Pray For Me
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Pray For Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2024Search & Replace: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-4145 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks (such as within a multi-site network).
- Product
- Search & Replace
- Fixed in
- 3.2.2
- What to do
- Update Search & Replace to 3.2.2 or newer.
Jun 13, 2024Web Directory Free: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-3552 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
- Product
- Web Directory Free
- Fixed in
- 1.7.0
- What to do
- Update Web Directory Free to 1.7.0 or newer.
Jun 13, 2024Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issueCVE-2024-3032 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue
- Fixed in
- 7.5.8
- What to do
- Update the plugin to 7.5.8 or newer.
Jun 4, 2024Pinpoint Booking System: External Control of Assumed-Immutable Web ParameterCVE-2023-38520 · WordPress plugins & themes · reported by PatchstackMedium 6.5
External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4.
- Product
- Pinpoint Booking System
- Affected
- up to 2.9.9.3.4
- What to do
- Affects up to 2.9.9.3.4. Update Pinpoint Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024FS Product Inquiry: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4856 · WordPress plugins & themes · reported by WPScanHigh 8.2
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
- Product
- FS Product Inquiry
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update FS Product Inquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2024wp-eMember: Does not sanitize and escape the "fieldId" parameter before outputting it back in the pageCVE-2024-4749 · WordPress plugins & themes · reported by WPScanHigh 8.3
The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- wp-eMember
- Fixed in
- 10.3.9
- What to do
- Update wp-eMember to 10.3.9 or newer.
Jun 3, 2024Booking calendar, Appointment Booking System: External Control of Assumed-Immutable Web ParameterCVE-2023-24373 · WordPress plugins & themes · reported by PatchstackLow 3.7
External Control of Assumed-Immutable Web Parameter vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Manipulating Hidden Fields.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.
- Product
- Booking calendar, Appointment Booking System
- Affected
- up to 3.2.3
- What to do
- Affects up to 3.2.3. Update Booking calendar, Appointment Booking System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 27, 2024KKProgressbar2 Free: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-4533 · WordPress plugins & themes · reported by WPScanMedium 6.5
The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks
- Product
- KKProgressbar2 Free
- Affected
- up to 1.1.4.2
- What to do
- Affects up to 1.1.4.2. Update KKProgressbar2 Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attackCVE-2024-4399 · WordPress plugins & themes · reported by WPScanCritical 9.1
The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack
- What to do
- Update the plugin to the newest version.
May 23, 2024Pet Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3917 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Pet Manager
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Pet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Carousel Slider: Does not sanitise and escape some parametersCVE-2024-4372 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
- Product
- Carousel Slider
- Fixed in
- 2.2.11
- What to do
- Update Carousel Slider to 2.2.11 or newer.
May 21, 2024Sailthru Triggermail: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-4289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2024Popup4Phone: Does not sanitise and escape some parametersCVE-2024-3231 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Popup4Phone
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Popup4Phone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2024Newsletter Popup: Does not sanitise and escape some parametersCVE-2024-3641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3548 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.1.2
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.2 or newer.
Apr 26, 2024ENL Newsletter: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-3060 · WordPress plugins & themes · reported by WPScanMedium 4.5
The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Fancy Product Designer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0905 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users
- Product
- Fancy Product Designer
- Fixed in
- 6.1.8
- What to do
- Update Fancy Product Designer to 6.1.8 or newer.
Apr 25, 2024Advanced Search: Does not properly escape parameters appended to an SQL queryCVE-2024-3265 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
- Product
- Advanced Search
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Advanced Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2024WooCommerce Customers Manager: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-1743 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.8
- What to do
- Update WooCommerce Customers Manager to 29.8 or newer.
Apr 18, 2024The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordCVE-2024-1429 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tab_link’ attribute of the Panel Slider widget in all versions up to, and including, 5.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32572 is likely a duplicate of this or CVE-2024-1426.
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 18, 2024The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordCVE-2024-1426 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Element Pack Elementor Addons (Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ attribute of the Price List widget in all versions up to, and including, 5.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 5.6.0
- What to do
- Affects up to 5.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 17, 2024Salon booking system: Does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameterCVE-2024-2102 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Bookings' page and the malicious script is executed in the admin context.
- Product
- Salon booking system
- Fixed in
- 9.6.3
- What to do
- Update Salon booking system to 9.6.3 or newer.
Apr 15, 2024The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URLCVE-2024-1849 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URL
- Product
- WP Customer Reviews
- Fixed in
- 3.7.1
- What to do
- Update WP Customer Reviews to 3.7.1 or newer.
Apr 15, 2024WooCommerce Customers Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0399 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.7
- What to do
- Update WooCommerce Customers Manager to 29.7 or newer.
Apr 9, 2024The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all verCVE-2024-2738 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all versions up to, and including, 2.4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected
- up to 2.4.3.1
- What to do
- Affects up to 2.4.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 8, 2024WPB Show Core: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-1958 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Apr 8, 2024wpb-show-core: Does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated requestCVE-2024-1956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated request, leading to a Reflected Cross-Site Scripting
- Product
- wpb-show-core
- Fixed in
- 2.7
- What to do
- Update wpb-show-core to 2.7 or newer.
Apr 8, 2024WPB Show Core: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2024-1292 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.