Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,520 results · page 110 of 391
Jul 17, 2023Membership: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-3182 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Membership
- Fixed in
- 3.2.3
- What to do
- Update Membership to 3.2.3 or newer.
Jul 17, 2023POST SMTP Mailer: Does not have proper CSRF checks in some AJAX actionsCVE-2023-3179 · WordPress plugins & themes · reported by WPScanHigh 8.8
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
- Product
- POST SMTP Mailer
- Fixed in
- 2.5.7
- What to do
- Update POST SMTP Mailer to 2.5.7 or newer.
Jul 17, 2023Autochat Automatic Conversation: Does not sanitise and escape user input before outputting it back on the pageCVE-2023-3041 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack.
- Product
- Autochat Automatic Conversation
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Autochat Automatic Conversation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2023Gravity Forms: Does not escape generated URLs before outputting them in attributesCVE-2023-2701 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gravity Forms WordPress plugin before 2.7.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high-privileged users such as admin.
- Product
- Gravity Forms
- Fixed in
- 2.7.5
- What to do
- Update Gravity Forms to 2.7.5 or newer.
Jul 17, 2023AN_GradeBook: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2636 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber
- Product
- AN_GradeBook
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2023InventoryPress: Does not sanitise and escape some of its settingsCVE-2023-2579 · WordPress plugins & themes · reported by WPScanMedium 5.4
The InventoryPress WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.
- Product
- InventoryPress
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update InventoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2023Caldera Forms Google Sheets Connector: Does not have CSRF checkCVE-2023-2330 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- Caldera Forms Google Sheets Connector
- Fixed in
- 1.3
- What to do
- Update Caldera Forms Google Sheets Connector to 1.3 or newer.
Jul 17, 2023WooCommerce Google Sheet Connector: Does not have CSRF checkCVE-2023-2329 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
- Product
- WooCommerce Google Sheet Connector
- Fixed in
- 1.3.6
- What to do
- Update WooCommerce Google Sheet Connector to 1.3.6 or newer.
Jul 17, 2023Enable SVG, WebP & ICO Upload: Does not sanitize SVG file contentsCVE-2023-2143 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.
- Product
- Enable SVG, WebP & ICO Upload
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Enable SVG, WebP & ICO Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 17, 2023Login Configurator: Does not properly escape a URL parameter before outputting it to the pageCVE-2023-1893 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Login Configurator WordPress plugin through 2.1 does not properly escape a URL parameter before outputting it to the page, leading to a reflected cross-site scripting vulnerability targeting site administrators.
- Product
- Login Configurator
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Login Configurator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 17, 2023NEX-Forms: Does not escape its form nameCVE-2023-0439 · WordPress plugins & themes · reported by WPScanMedium 5.4
The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By default only SuperAdmins (in multisite) / admins (in single site) can create forms, however there is a settings allowing them to give lower roles access to such feature.
- Product
- NEX-Forms
- Fixed in
- 8.4.4
- What to do
- Update NEX-Forms to 8.4.4 or newer.
Jul 17, 20233DPrint: Does not protect against CSRF attacks in the modified version of Tiny File Manager included with the pluginCVE-2022-4023 · WordPress plugins & themes · reported by WPScanMedium 5.3
The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.
- Product
- 3DPrint
- Fixed in
- 3.5.6.9
- What to do
- Update 3DPrint to 3.5.6.9 or newer.
Jul 14, 2023Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps.CVE-2023-37268 · Other software · warp-tech · reported by GitHubMedium 6.4
Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.
- Product
- warpgate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2023Alaris Systems Manager does not perform input validation during the Device Import Function.CVE-2023-30564 · Other software · Becton Dickinson & Co · reported by cybersecurity@bd.comMedium 6.9
Alaris Systems Manager does not perform input validation during the Device Import Function.
- Product
- BD Alarisâ„¢ Systems Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms.CVE-2023-38199 · Other software · Owasp · reported by MITRECritical 9.8
coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.
- Product
- Coreruleset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer.CVE-2023-3635 · Other software · Squareup · reported by reefs@jfrog.comMedium 5.9
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
- Product
- Okio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.jfrog.com
Jul 12, 2023Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access CVE-2023-37951 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to.
- Product
- Jenkins mabl Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 12, 2023Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle attCVE-2023-37948 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comLow 3.7
Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not validate SSH host keys when connecting OCI clouds, enabling man-in-the-middle attacks.
- Product
- Jenkins Oracle Cloud Infrastructure Compute Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 12, 2023Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.CVE-2023-37946 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the previous session on login.
- Product
- Jenkins OpenShift Login Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 12, 2023Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2023-37942 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins External Monitor Job Type Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 11, 2023The HTTP/1 client does not fully validate the contents of the Host header.CVE-2023-29406 · Other software · Go standard library · reported by security@golang.orgMedium 6.5
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
- Product
- net/http
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities tCVE-2023-35873 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.
- Product
- SAP NetWeaver Process Integration (Runtime Workbench)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities CVE-2023-35872 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.
- Product
- SAP NetWeaver Process Integration (Message Display Tool)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023Float menu: Does not sanitise and escape some of its settingsCVE-2023-3225 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Float menu
- Fixed in
- 5.0.3
- What to do
- Update Float menu to 5.0.3 or newer.
Jul 10, 2023EventON: Does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid EventCVE-2023-3219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.
- Product
- EventON
- Fixed in
- 2.1.2
- What to do
- Update EventON to 2.1.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3209 · WordPress plugins & themes · reported by WPScanLow 3.5
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- Product
- MStore API
- Fixed in
- 3.9.7
- What to do
- Update MStore API to 3.9.7 or newer.
Jul 10, 2023AI ChatBot: Does not adequately escape some settingsCVE-2023-3175 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- AI ChatBot
- Fixed in
- 4.6.1
- What to do
- Update AI ChatBot to 4.6.1 or newer.
Jul 10, 2023MStore API: Does not secure most of its AJAX actions by implementing privilege checksCVE-2023-3131 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.
- Product
- MStore API
- Fixed in
- 3.9.7
- What to do
- Update MStore API to 3.9.7 or newer.
Jul 10, 2023URL Shortify: Does not sanitise and escape some of its settingsCVE-2023-3129 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- URL Shortify
- Fixed in
- 1.7.0
- What to do
- Update URL Shortify to 1.7.0 or newer.
Jul 10, 2023Export All URLs: Does not sanitise and escape a parameter before outputting them back in the pageCVE-2023-3118 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Export All URLs
- Fixed in
- 4.6
- What to do
- Update Export All URLs to 4.6 or newer.
Jul 10, 2023MStore API: Does not sanitise and escape a parameter before using it in a SQL statementCVE-2023-3077 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, and uses the woocommerce-appointments plugin.
- Product
- MStore API
- Fixed in
- 3.9.8
- What to do
- Update MStore API to 3.9.8 or newer.
Jul 10, 2023MStore API: Does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpointCVE-2023-3076 · WordPress plugins & themes · reported by WPScanCritical 9.8
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
- Product
- MStore API
- Fixed in
- 3.9.9
- What to do
- Update MStore API to 3.9.9 or newer.
Jul 10, 2023TinyMCE Custom Styles: Does not sanitise and escape some of its settingsCVE-2023-2967 · WordPress plugins & themes · reported by WPScanMedium 4.8
The TinyMCE Custom Styles WordPress plugin before 1.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- TinyMCE Custom Styles
- Fixed in
- 1.1.4
- What to do
- Update TinyMCE Custom Styles to 1.1.4 or newer.
Jul 10, 2023Simple Iframe: Does not properly validate one of its WordPress block attribute's contentCVE-2023-2964 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Iframe WordPress plugin before 1.2.0 does not properly validate one of its WordPress block attribute's content, which may allow users whose role is at least that of a contributor to conduct Stored Cross-Site Scripting attacks.
- Product
- Simple Iframe
- Fixed in
- 1.2.0
- What to do
- Update Simple Iframe to 1.2.0 or newer.
Jul 10, 2023AN_GradeBook: Does not sanitise and escape some of its settingsCVE-2023-2709 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AN_GradeBook WordPress plugin through 5.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AN_GradeBook
- Affected
- up to 5.0.1
- What to do
- Affects up to 5.0.1. Update AN_GradeBook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023Call Now Accessibility Button: Does not sanitise and escape some of its settingsCVE-2023-2635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Call Now Accessibility Button
- Fixed in
- 1.1
- What to do
- Update Call Now Accessibility Button to 1.1 or newer.
Jul 10, 2023Buy Me a Coffee: Does not sanitise and escape some of its settingsCVE-2023-2578 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Buy Me a Coffee WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Buy Me a Coffee
- Fixed in
- 3.7
- What to do
- Update Buy Me a Coffee to 3.7 or newer.
Jul 10, 2023Enable SVG Uploads: Does not sanitise uploaded SVG filesCVE-2023-2529 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Enable SVG Uploads WordPress plugin through 2.1.5 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Enable SVG Uploads
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update Enable SVG Uploads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023Greeklish-permalink: Does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX actionCVE-2023-2495 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF.
- Product
- Greeklish-permalink
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update Greeklish-permalink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023All In One Redirection: Does not properly sanitise and escape multiple parameters before using them in an SQL statementCVE-2023-2493 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- All In One Redirection
- Fixed in
- 2.2.0
- What to do
- Update All In One Redirection to 2.2.0 or newer.
Jul 10, 2023PrePost SEO: Does not properly sanitize some of its settingsCVE-2023-2029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PrePost SEO WordPress plugin through 3.0 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PrePost SEO
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update PrePost SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Jul 10, 2023Call Now Accessibility Button: Does not properly sanitize some of its settingsCVE-2023-2028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Call Now Accessibility Button WordPress plugin before 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Call Now Accessibility Button
- Fixed in
- 1.1
- What to do
- Update Call Now Accessibility Button to 1.1 or newer.
Jul 10, 2023Image Protector: Does not properly sanitize some of its settingsCVE-2023-2026 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Protector WordPress plugin through 1.1 does not properly sanitize some of its settings, which could allow high-privilege users to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Protector
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Image Protector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 10, 2023IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specifiCVE-2023-27540 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specific to the system to cause a denial of service. IBM X-Force ID: 248924.
- Product
- Watson CP4D Data Stores
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 10, 2023Companion Sitemap Generator: Does not sanitise and escape some parameters before outputting them back in pagesCVE-2023-1780 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Companion Sitemap Generator
- Fixed in
- 4.5.3
- What to do
- Update Companion Sitemap Generator to 4.5.3 or newer.
Jul 10, 2023tagDiv Cloud Library: Does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated usersCVE-2023-1597 · WordPress plugins & themes · reported by WPScanHigh 8.8
The tagDiv Cloud Library WordPress plugin before 2.7 does not have authorisation and CSRF in an AJAX action accessible to both unauthenticated and authenticated users, allowing unauthenticated users to change arbitrary user metadata, which could lead to privilege escalation by setting themselves as an admin of the blog.
- Product
- tagDiv Cloud Library
- Fixed in
- 2.7
- What to do
- Update tagDiv Cloud Library to 2.7 or newer.
Jul 6, 2023 PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks.CVE-2023-32652 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 8
PiiGAB M-Bus does not validate identification strings before processing, which could make it vulnerable to cross-site scripting attacks.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2023 PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.CVE-2023-36859 · Other software · PiiGAB · reported by ics-cert@hq.dhs.govHigh 8.8
PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands.
- Product
- M-Bus SoftwarePack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 5, 2023In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver.CVE-2023-35863 · Other software · Madefornet · reported by MITREMedium 5.3
In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.
- Product
- Http Debugger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordctrl-c.clubmadefornet.com
Jul 4, 2023Ultimate Member: Does not prevent visitors from creating user accounts with arbitrary capabilitiesCVE-2023-3460 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.
- Product
- Ultimate Member
- Fixed in
- 2.6.7
- What to do
- Update Ultimate Member to 2.6.7 or newer.
Full record and what to do →NVD recordblog.wpscan.comwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.