Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,570 results · page 155 of 392
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboardCVE-2021-25000 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue
- Product
- Booster for WooCommerce
- Fixed in
- 5.4.9
- What to do
- Update Booster for WooCommerce to 5.4.9 or newer.
Jan 3, 2022Booster for WooCommerce: Does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboardCVE-2021-24999 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting
- Product
- Booster for WooCommerce
- Fixed in
- 5.4.9
- What to do
- Update Booster for WooCommerce to 5.4.9 or newer.
Jan 3, 2022WooCommerce PDF Invoices & Packing Slips: Does not escape the tab and section parameters before outputting it back in an attributeCVE-2021-24991 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard
- Product
- WooCommerce PDF Invoices & Packing Slips
- Fixed in
- 2.10.5
- What to do
- Update WooCommerce PDF Invoices & Packing Slips to 2.10.5 or newer.
Jan 3, 2022Site Reviews: Does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users)CVE-2021-24973 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
- Product
- Site Reviews
- Fixed in
- 5.17.3
- What to do
- Update Site Reviews to 5.17.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 3, 2022LiteSpeed Cache: Does not properly verify that requests are coming from QUICCVE-2021-24964 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.
- Product
- LiteSpeed Cache
- Fixed in
- 4.4.4
- What to do
- Update LiteSpeed Cache to 4.4.4 or newer.
Jan 3, 2022LiteSpeed Cache: Does not escape the qc_res parameter before outputting it back in the JS code of an admin pageCVE-2021-24963 · WordPress plugins & themes · reported by WPScanMedium 4.8
The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting
- Product
- LiteSpeed Cache
- Fixed in
- 4.4.4
- What to do
- Update LiteSpeed Cache to 4.4.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 3, 2022Stars Rating: Does not validate the submitted ratingCVE-2021-24893 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Stars Rating WordPress plugin before 3.5.1 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the comments section, or pending comment dashboard depending if the user sent it as unauthenticated or authenticated.
- Product
- Stars Rating
- Fixed in
- 3.5.1
- What to do
- Update Stars Rating to 3.5.1 or newer.
Jan 3, 2022Mortgage Calculator / Loan Calculator: Does not escape the some of the attributes of its mlcalc shortcode before outputting themCVE-2021-24828 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Mortgage Calculator / Loan Calculator
- Fixed in
- 1.5.17
- What to do
- Update Mortgage Calculator / Loan Calculator to 1.5.17 or newer.
Jan 3, 2022Download Monitor: Does not properly validate and escape the "orderby" GET parameter before using it in a SQL statementCVE-2021-24786 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
- Product
- Download Monitor
- Fixed in
- 4.4.5
- What to do
- Update Download Monitor to 4.4.5 or newer.
Jan 3, 2022WP Travel Engine: Does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pagesCVE-2021-24680 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed
- Product
- WP Travel Engine
- Fixed in
- 5.3.1
- What to do
- Update WP Travel Engine to 5.3.1 or newer.
Jan 1, 2022The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings.CVE-2021-43333 · Other software · Datalogic · reported by MITREMedium 6.5
The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings.
- Product
- DXU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatalogic.github.iodeveloper.datalogic.com
Dec 30, 2021Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console.CVE-2021-23147 · Network & remote access · Netgear · reported by vulnreport@tenable.comMedium 6.8
Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication.
- Product
- R6700 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 30, 2021Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface.CVE-2021-20175 · Network & remote access · Netgear · reported by vulnreport@tenable.comHigh 7.5
Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device's SOAP Interface (port 5000) is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext
- Product
- R6700 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 30, 2021Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface.CVE-2021-20174 · Network & remote access · Netgear · reported by vulnreport@tenable.comHigh 7.5
Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext.
- Product
- R6700 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 30, 2021Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface.CVE-2021-20169 · Network & remote access · Netgear · reported by vulnreport@tenable.comMedium 6.8
Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communication to/from the device is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext.
- Product
- Rax43 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 30, 2021Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface.CVE-2021-20168 · Network & remote access · Netgear · reported by vulnreport@tenable.comMedium 6.8
Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection, login with default credentials, and execute commands as the root user. These default credentials are admin:admin.
- Product
- Rax43 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections.CVE-2021-20165 · Other software · Trendnet · reported by vulnreport@tenable.comHigh 8.8
Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Additionally, pages that do make use of CSRF tokens are trivially bypassable as the server does not appear to validate them properly (i.e. re-using an old token or finding the token thru some other method is possible).
- Product
- Tew-827dru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality.CVE-2021-20161 · Other software · Trendnet · reported by vulnreport@tenable.comMedium 6.8
Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection. No username or password is required and the user is given a root shell with full control of the device.
- Product
- Tew-827dru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 30, 2021Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface.CVE-2021-20149 · Other software · Trendnet · reported by vulnreport@tenable.comCritical 9.8
Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the device only apply to IPv4. All services running on the devices are accessible via the WAN interface via IPv6 by default.
- Product
- Tew-827dru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 29, 2021ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amoCVE-2021-36724 · Other software · ForeScout · reported by cna@cyber.gov.ilMedium 6.1
ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the stack cookie causing the service to crash.
- Product
- eServices / eNvoice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the propCVE-2021-43548 · Other software · Philips · reported by ics-cert@hq.dhs.govMedium 6.5
Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.
- Product
- Patient Information Center iX (PIC iX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021WP Guppy: Does not have any authorisation in some of the REST API endpointsCVE-2021-24997 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user
- Product
- WP Guppy
- Fixed in
- 1.3
- What to do
- Update WP Guppy to 1.3 or newer.
Dec 27, 2021Smart Floating / Sticky Buttons: Does not sanitise and escape some parameter before outputting them in attributes and pageCVE-2021-24992 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Smart Floating / Sticky Buttons
- Fixed in
- 2.5.5
- What to do
- Update Smart Floating / Sticky Buttons to 2.5.5 or newer.
Dec 27, 2021WP RSS Aggregator: Does not sanitise and escape data before outputting it in the System Info admin dashboardCVE-2021-24988 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.
- Product
- WP RSS Aggregator
- Fixed in
- 4.19.3
- What to do
- Update WP RSS Aggregator to 4.19.3 or newer.
Dec 27, 2021WPFront User Role Editor: Does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboardCVE-2021-24984 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- WPFront User Role Editor
- Fixed in
- 3.2.1.11184
- What to do
- Update WPFront User Role Editor to 3.2.1.11184 or newer.
Dec 27, 2021Gwolle Guestbook: Does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attributeCVE-2021-24980 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page
- Product
- Gwolle Guestbook
- Fixed in
- 4.2.0
- What to do
- Update Gwolle Guestbook to 4.2.0 or newer.
Dec 27, 2021Paid Memberships Pro: Does not escape the s parameter before outputting it back in an attribute in an admin pageCVE-2021-24979 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- Paid Memberships Pro
- Fixed in
- 2.6.6
- What to do
- Update Paid Memberships Pro to 2.6.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 27, 2021WordPress Download Manager: Does not sanitise and escape Template data before outputting it in various pages (suchCVE-2021-24969 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks
- Product
- WordPress Download Manager
- Fixed in
- 3.2.22
- What to do
- Update WordPress Download Manager to 3.2.22 or newer.
Dec 27, 2021Contact Form & Lead Form Elementor Builder: Does not sanitise and escape some lead valuesCVE-2021-24967 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads
- Product
- Contact Form & Lead Form Elementor Builder
- Fixed in
- 1.6.4
- What to do
- Update Contact Form & Lead Form Elementor Builder to 1.6.4 or newer.
Dec 27, 2021Typebot | Build beautiful conversational forms: Does not sanitise and escape the Publish ID settingCVE-2021-24902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Typebot | Build beautiful conversational forms
- Fixed in
- 1.4.3
- What to do
- Update Typebot | Build beautiful conversational forms to 1.4.3 or newer.
Dec 27, 2021Tickera: Does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboardCVE-2021-24797 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Tickera
- Fixed in
- 3.4.8.3
- What to do
- Update Tickera to 3.4.8.3 or newer.
Dec 27, 2021Rich Reviews by Starfish: Does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statementCVE-2021-24753 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
- Product
- Rich Reviews by Starfish
- Fixed in
- 1.9.6
- What to do
- Update Rich Reviews by Starfish to 1.9.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Dec 24, 2021In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.CVE-2021-45487 · Other software · Netbsd · reported by MITREHigh 7.5
In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.
- Product
- Netbsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.netbsd.orgarxiv.org
Dec 23, 2021NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users onCVE-2021-23175 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.2
NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information disclosure, data tampering, and denial of service, affecting other resources beyond the intended security authority of GameStream.
- Product
- NVIDIA GeForce Experience Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Dec 22, 2021Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.CVE-2021-44030 · Other software · Quest · reported by MITREMedium 6.1
Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.
- Product
- Kace Desktop Authority
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.quest.comsupport.quest.com
Dec 21, 2021Blog2Social: Social Media Auto Post & Scheduler: Does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin pageCVE-2021-24956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
- Product
- Blog2Social: Social Media Auto Post & Scheduler
- Fixed in
- 6.8.7
- What to do
- Update Blog2Social: Social Media Auto Post & Scheduler to 6.8.7 or newer.
Dec 21, 2021Popups, Welcome Bar, Optins and Lead Generation: Does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attributeCVE-2021-24941 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue
- Product
- Popups, Welcome Bar, Optins and Lead Generation
- Fixed in
- 2.0.5
- What to do
- Update Popups, Welcome Bar, Optins and Lead Generation to 2.0.5 or newer.
Dec 21, 2021Contact Form, Drag and Drop Form Builder for: Does not escape the status parameter before outputting it back in an attributeCVE-2021-24907 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form, Drag and Drop Form Builder for WordPress plugin before 1.8.0 does not escape the status parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- Contact Form, Drag and Drop Form Builder for
- Fixed in
- 1.8.0
- What to do
- Update Contact Form, Drag and Drop Form Builder for to 1.8.0 or newer.
Dec 21, 2021The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not propeCVE-2021-24849 · WordPress plugins & themes · reported by WPScanCritical 9.8
The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections
- Product
- WCFM Marketplace
- Fixed in
- 3.4.12
- What to do
- Update WCFM Marketplace to 3.4.12 or newer.
Dec 21, 2021WP Visitor Statistics (Real Time Traffic): Does not properly sanitise and escape the refUrl in the refDetails AJAX actionCVE-2021-24750 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks
- Product
- WP Visitor Statistics (Real Time Traffic)
- Fixed in
- 4.8
- What to do
- Update WP Visitor Statistics (Real Time Traffic) to 4.8 or newer.
Full record and what to do →NVD recordpacketstormsecurity.complugins.trac.wordpress.org
Dec 21, 2021Logo Carousel: Does not validate and escape the "Logo Margin" carousel optionCVE-2021-24738 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Carousel WordPress plugin before 3.4.2 does not validate and escape the "Logo Margin" carousel option, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- Logo Carousel
- Fixed in
- 3.4.2
- What to do
- Update Logo Carousel to 3.4.2 or newer.
Dec 21, 2021SportsPress: Does not sanitise and escape its match_day parameter before outputting back in the Events backend pageCVE-2021-24578 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue
- Product
- SportsPress
- Fixed in
- 2.7.9
- What to do
- Update SportsPress to 2.7.9 or newer.
Dec 17, 2021TCMAN GIM does not perform an authorization check when trying to access determined resources.CVE-2021-40853 · Other software · TCMAN · reported by cve-coordination@incibe.esHigh 7.2
TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerability to access URL that require privileges without having them. The exploitation of this vulnerability might allow a remote attacker to obtain sensible information.
- Product
- GIM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.CVE-2021-41844 · Other software · Crocoblock · reported by MITRECritical 9.8
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.
- Product
- Jetengine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrocoblock.comcrocoblock.com
Dec 14, 2021SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead tCVE-2021-44233 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.8
SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated user, which could lead to escalation of privileges.
- Product
- SAP GRC Access Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Dec 14, 2021SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-SitCVE-2021-42061 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This allows a low privileged attacker to retrieve some data from the victim but will never be able to modify the document and publish these modifications to the server. It impacts the "Quick Prompt" workflow.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Dec 13, 2021The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data.CVE-2020-16155 · Other software · Cpan\ · reported by MITREMedium 6.5
The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data.
- Product
- \
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.hackeriet.nometacpan.org
Dec 13, 2021Pixel Cat: Does not escape some of its settingsCVE-2021-24972 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Pixel Cat
- Fixed in
- 2.6.3
- What to do
- Update Pixel Cat to 2.6.3 or newer.
Dec 13, 2021All-in-One Video Gallery: Does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboardCVE-2021-24970 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One Video Gallery WordPress plugin before 2.5.0 does not sanitise and validate the tab parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue
- Product
- All-in-One Video Gallery
- Fixed in
- 2.5.0
- What to do
- Update All-in-One Video Gallery to 2.5.0 or newer.
Dec 13, 2021User Registration, Login Form, User Profile & Membership: Does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attributeCVE-2021-24955 · WordPress plugins & themes · reported by WPScanMedium 6.1
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- User Registration, Login Form, User Profile & Membership
- Fixed in
- 3.2.3
- What to do
- Update User Registration, Login Form, User Profile & Membership to 3.2.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.