Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

36added in the last 30 days

555new WordPress flaws this week

398,769entries in the database

19,570 results · page 152 of 392

Feb 15, 2022Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS)CVE-2022-25185 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Product
Jenkins Generic Webhook Trigger Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Feb 15, 2022Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, alloCVE-2022-25178 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Product
Jenkins Pipeline: Shared Groovy Libraries Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jenkins.io jenkins.io
Feb 15, 2022CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the CVE-2022-23317 · Other software · Helpsystems · reported by MITREHigh 7.5
CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL.
Product
Cobalt Strike
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record donghuangt1.com donghuangt1.com
Feb 14, 2022SpiderCalendar: Does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users)CVE-2022-0212 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
Product
SpiderCalendar
Affected
up to 1.5.65
What to do
Affects up to 1.5.65. Update SpiderCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022MapPress Maps for: Does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error messageCVE-2022-0208 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
Product
MapPress Maps for
Fixed in
2.73.4
What to do
Update MapPress Maps for to 2.73.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022NewStatPress: Does not properly escape the whatX parameters before outputting them back in attributesCVE-2022-0206 · WordPress plugins & themes · reported by WPScanMedium 6.1
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
NewStatPress
Fixed in
1.3.6
What to do
Update NewStatPress to 1.3.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themiCVE-2022-0200 · WordPress plugins & themes · reported by WPScanMedium 5.4
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Fixed in
1.1.7
What to do
Update the plugin to 1.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Complianz: Does not escape the s parameter before outputting it back in an attribute in an admin pageCVE-2022-0193 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Product
Complianz
Fixed in
6.0.0
What to do
Update Complianz to 6.0.0 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022PowerPack Lite for Beaver Builder: Does not sanitise and escape the tab parameter before outputting it back in an admin pageCVE-2022-0176 · WordPress plugins & themes · reported by WPScanMedium 6.1
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Product
PowerPack Lite for Beaver Builder
Fixed in
1.2.9.3
What to do
Update PowerPack Lite for Beaver Builder to 1.2.9.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022Form Store to DB: Does not sanitise and escape parameter keys before outputting it back in the created entryCVE-2021-25107 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
Product
Form Store to DB
Fixed in
1.1.1
What to do
Update Form Store to DB to 1.1.1 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022Remove Footer Credit: Does properly sanitise its settingsCVE-2021-25050 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Product
Remove Footer Credit
Fixed in
1.0.11
What to do
Update Remove Footer Credit to 1.0.11 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022WordPress Newsletter: Does not validate the to parameter before redirecting the user to its given valueCVE-2021-25033 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
Product
WordPress Newsletter
Fixed in
1.6.5
What to do
Update WordPress Newsletter to 1.6.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 14, 2022PPOM for WooCommerce: Does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX actionCVE-2021-25018 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored XSS issues
Product
PPOM for WooCommerce
Fixed in
24.0
What to do
Update PPOM for WooCommerce to 24.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Ibtana: Does not have authorisation and CSRF checks in the ive_save_general_settings AJAX actionCVE-2021-25014 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.
Product
Ibtana
Fixed in
1.1.4.9
What to do
Update Ibtana to 1.1.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Mortgage Calculators WP: Does not implement any sanitisation on the color setting of the background of a calculatorCVE-2021-24904 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Mortgage Calculators WP
Fixed in
1.56
What to do
Update Mortgage Calculators WP to 1.56 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Does not escape the lang and pid parameter before outputting them back in attributesCVE-2021-24874 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Fixed in
3.1.31
What to do
Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to 3.1.31 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 14, 2022Remove Footer Credit: Does not have CSRF check in placeCVE-2021-24446 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
Product
Remove Footer Credit
Fixed in
1.0.6
What to do
Update Remove Footer Credit to 1.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 11, 2022The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue.CVE-2022-24975 · Other software · Git-scm · reported by MITREHigh 7.5
The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk.
Product
GIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lore.kernel.org
Feb 11, 2022ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，CVE-2021-39658 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
ismsEx service is a vendor service in unisoc equipment。ismsEx service is an extension of sms system service，but it does not check the permissions of the caller，resulting in permission leaks。Third-party apps can use this service to arbitrarily modify and set system properties。Product: AndroidVersions: Android SoCAndroid ID: A-207479207
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Feb 11, 2022ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissioCVE-2021-39635 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.1
ims_ex is a vendor system service used to manage VoLTE in unisoc devices，But it does not verify the caller's permissions，so that normal apps (No phone permissions) can obtain some VoLTE sensitive information and manage VoLTE calls.Product: AndroidVersions: Android SoCAndroid ID: A-206492634
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Feb 11, 2022Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass.CVE-2020-13677 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 7.5
Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected.
Product
Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Feb 11, 2022The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.CVE-2020-13676 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Product
Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Feb 11, 2022The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible datCVE-2020-13674 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
Product
Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org drupal.org
Feb 9, 2022SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certaiCVE-2022-22535 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
SAP ERP HCM Portugal - versions 600, 604, 608, does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area. Since the affected report only reads the payroll information, the attacker can neither modify any information nor cause availability impacts.
Product
SAP ERP HCM (Portugal)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com sap.com
Feb 7, 2022Paid Memberships Pro: Does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statementCVE-2021-25114 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
Product
Paid Memberships Pro
Fixed in
2.6.7
What to do
Update Paid Memberships Pro to 2.6.7 or newer.
Full record and what to do →NVD record wpscan.com paidmembershipspro.com
Feb 7, 2022IP2Location Country Blocker: Does not have CSRF check in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25108 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX action, allowing attackers to make a logged in admin block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
Product
IP2Location Country Blocker
Fixed in
2.26.6
What to do
Update IP2Location Country Blocker to 2.26.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages: Does not check for authorisation and has a flawed CSRF logicCVE-2021-25106 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting
Product
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages
Fixed in
2.7.1
What to do
Update Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Ivory Search: Does not escape some of the Form settingsCVE-2021-25105 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Ivory Search
Fixed in
5.4.1
What to do
Update Ivory Search to 5.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Translate WordPress with GTranslate: Does not sanitise and escape the body parameter in the url_addon/gtranslate-emailCVE-2021-25103 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCE_SALT and NONCE_KEY
Product
Translate WordPress with GTranslate
Fixed in
2.9.7
What to do
Update Translate WordPress with GTranslate to 2.9.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022IP2Location Country Blocker: Does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX actionCVE-2021-25095 · WordPress plugins & themes · reported by WPScanHigh 7.1
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend.
Product
IP2Location Country Blocker
Fixed in
2.26.5
What to do
Update IP2Location Country Blocker to 2.26.5 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022Store Toolkit for WooCommerce: Does not sanitise and escape the tab parameter before outputting it back in an admin page in an error messageCVE-2021-25077 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting
Product
Store Toolkit for WooCommerce
Fixed in
2.3.2
What to do
Update Store Toolkit for WooCommerce to 2.3.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022CLUEVO LMS, E-Learning Platform: Does not sanitise and escape Course's moduleCVE-2021-25029 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
CLUEVO LMS, E-Learning Platform
Fixed in
1.8.1
What to do
Update CLUEVO LMS, E-Learning Platform to 1.8.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Ultimate Product Catalog: Does not have authorisation and CSRF checks in some AJAX actionsCVE-2021-24993 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
Product
Ultimate Product Catalog
Fixed in
5.0.26
What to do
Update Ultimate Product Catalog to 5.0.26 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 7, 2022RVM: Does not have proper authorisationCVE-2021-24947 · WordPress plugins & themes · reported by WPScanMedium 6.5
The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server
Product
RVM
Fixed in
6.4.2
What to do
Update RVM to 6.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022Rearrange Woocommerce Products: Does not have proper access controls in the save_all_order AJAX actionCVE-2021-24928 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.
Product
Rearrange Woocommerce Products
Fixed in
3.0.8
What to do
Update Rearrange Woocommerce Products to 3.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not validate and escape the page attribute of its shortcodeCVE-2021-24880 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not have CSRF check in the wpsc_tickets AJAX actionCVE-2021-24879 · WordPress plugins & themes · reported by WPScanHigh 8.8
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embedCVE-2021-24878 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the [wpsc_create_ticket] shortcode embed, leading to a Reflected Cross-Site Scripting issue
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not have CRSF check in its wpsc_tickets AJAX actionCVE-2021-24843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.
Product
SupportCandy
Fixed in
2.2.7
What to do
Update SupportCandy to 2.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 7, 2022SupportCandy: Does not have authorisation and CSRF checks in its wpsc_tickets AJAX actionCVE-2021-24839 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
Product
SupportCandy
Fixed in
2.2.5
What to do
Update SupportCandy to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 4, 2022The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrCVE-2022-24262 · Other software · Voipmonitor · reported by MITREHigh 8.8
The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root.
Product
Voipmonitor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kerbit.io voipmonitor.org
Feb 3, 2022Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer.CVE-2022-24171 · Network & remote access · Tendacn · reported by MITRECritical 9.8
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters.
Product
G1 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 3, 2022Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities.CVE-2022-24307 · Other software · Joinmastodon · reported by MITRECritical 9.8
Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)
Product
Mastodon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 2, 2022The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context.CVE-2022-22818 · Other software · Djangoproject · reported by MITREMedium 6.1
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
Product
Django
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.djangoproject.com groups.google.com
Feb 2, 2022IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated sesCVE-2021-39066 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Financial Transaction Manager 3.2.4 does not invalidate session any existing session identifier gives an attacker the opportunity to steal authenticated sessions. IBM X-Force ID: 215040.
Product
Financial Transaction Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
Feb 1, 2022Essential Addons for Elementor: Does not validate and sanitise some template data before it them in include statementsCVE-2022-0320 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.
Product
Essential Addons for Elementor
Fixed in
5.0.5
What to do
Update Essential Addons for Elementor to 5.0.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user.CVE-2021-41571 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.
Product
Apache Pulsar
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.apache.org
Feb 1, 2022LabTools: Does not have proper authorisation and CSRF check in placeCVE-2021-25097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
Product
LabTools
Affected
up to 1.0
What to do
Affects up to 1.0. Update LabTools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Link Library: Does not have authorisation in placeCVE-2021-25093 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Link Library WordPress plugin before 7.2.8 does not have authorisation in place when deleting links, allowing unauthenticated users to delete arbitrary links via a crafted request
Product
Link Library
Fixed in
7.2.8
What to do
Update Link Library to 7.2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 1, 2022Link Library: Does not have CSRF checkCVE-2021-25092 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attackers to make a logged in admin reset arbitrary settings via a CSRF attack
Product
Link Library
Fixed in
7.2.8
What to do
Update Link Library to 7.2.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.