Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,570 results · page 157 of 392
Nov 29, 2021Media-Tags: Does not sanitise and escape any of its Labels settingsCVE-2021-24899 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Media-Tags WordPress plugin through 3.2.0.2 does not sanitise and escape any of its Labels settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_htnl capability is disallowed.
- Product
- Media-Tags
- Affected
- up to 3.2.0.2
- What to do
- Affects up to 3.2.0.2. Update Media-Tags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
- Product
- Ninja Forms Contact Form
- Fixed in
- 3.6.4
- What to do
- Update Ninja Forms Contact Form to 3.6.4 or newer.
Nov 29, 2021Popup Anything: Does not escape the Link Text and Button Text fields of PopupCVE-2021-24883 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Popup Anything
- Fixed in
- 2.0.4
- What to do
- Update Popup Anything to 2.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 29, 2021Registrations for the Events Calendar: Does not escape the v parameter before outputting it back in an attributeCVE-2021-24876 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.7.5
- What to do
- Update Registrations for the Events Calendar to 2.7.5 or newer.
Nov 29, 2021BSK PDF Manager: Does not validate and escape the orderby and order parameters before using them in a SQL statementCVE-2021-24860 · WordPress plugins & themes · reported by WPScanHigh 7.2
The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue
- Product
- BSK PDF Manager
- Fixed in
- 3.1.2
- What to do
- Update BSK PDF Manager to 3.1.2 or newer.
Nov 29, 2021Bulk Datetime Change: Does not enforce capability checksCVE-2021-24842 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.
- Product
- Bulk Datetime Change
- Fixed in
- 1.12
- What to do
- Update Bulk Datetime Change to 1.12 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 29, 2021Stylish Cost Calculator: Does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users)CVE-2021-24822 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters
- Product
- Stylish Cost Calculator
- Fixed in
- 7.0.4
- What to do
- Update Stylish Cost Calculator to 7.0.4 or newer.
Nov 29, 2021Shop Page WP: Does not sanitise and escape some of the Product fieldsCVE-2021-24811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Shop Page WP
- Fixed in
- 1.2.8
- What to do
- Update Shop Page WP to 1.2.8 or newer.
Nov 29, 2021WP RSS Aggregator: Does not properly sanitise and escape the URL to Blacklist fieldCVE-2021-24768 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
- Product
- WP RSS Aggregator
- Fixed in
- 4.19.2
- What to do
- Update WP RSS Aggregator to 4.19.2 or newer.
Nov 29, 2021myCred: Does not validate or escape the fields parameter before using it in a SQL statementCVE-2021-24755 · WordPress plugins & themes · reported by WPScanHigh 8.8
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user
- Product
- myCred
- Fixed in
- 2.3
- What to do
- Update myCred to 2.3 or newer.
Nov 29, 2021GenerateBlocks: Does not validate the generateblocks/container block's tagName attributeCVE-2021-24751 · WordPress plugins & themes · reported by WPScanMedium 5.4
The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- GenerateBlocks
- Fixed in
- 1.4.0
- What to do
- Update GenerateBlocks to 1.4.0 or newer.
Nov 29, 2021URL Shortify: Does not have CSRF check in placeCVE-2021-24749 · WordPress plugins & themes · reported by WPScanMedium 4.3
The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow attackers to make a logged in admin delete arbitrary link and group via a CSRF attack.
- Product
- URL Shortify
- Fixed in
- 1.5.1
- What to do
- Update URL Shortify to 1.5.1 or newer.
Nov 29, 2021Email Before Download: Does not properly validate and escape the order and orderby GET parameters before using them in SQL statementsCVE-2021-24748 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
- Product
- Email Before Download
- Fixed in
- 6.8
- What to do
- Update Email Before Download to 6.8 or newer.
Nov 29, 2021About Author Box: Does not sanitise and escape the Social Profiles field values before outputting them in attributesCVE-2021-24745 · WordPress plugins & themes · reported by WPScanMedium 5.4
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- About Author Box
- Fixed in
- 1.0.2
- What to do
- Update About Author Box to 1.0.2 or newer.
Nov 29, 2021myCred: Does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboardCVE-2017-20008 · WordPress plugins & themes · reported by WPScanMedium 6.1
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- myCred
- Fixed in
- 1.7.8
- What to do
- Update myCred to 1.7.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 25, 2021In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property.CVE-2021-44225 · Other software · Keepalived · reported by MITREMedium 5.4
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property
- Product
- Keepalived
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Reviews Plus: Does not validate the submitted ratingCVE-2021-24894 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page
- Product
- Reviews Plus
- Fixed in
- 1.2.14
- What to do
- Update Reviews Plus to 1.2.14 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 23, 2021Elementor Website Builder: Does not sanitise or escape user input appended to the DOM via a malicious hashCVE-2021-24891 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue.
- Product
- Elementor Website Builder
- Fixed in
- 3.4.8
- What to do
- Update Elementor Website Builder to 3.4.8 or newer.
Full record and what to do →NVD recordwpscan.comjbelamor.com
Nov 23, 2021ImageBoss: Does not sanitise and escape its Source Name settingCVE-2021-24888 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ImageBoss WordPress plugin before 3.0.6 does not sanitise and escape its Source Name setting, which could allow high privilege users to perform Cross-Site Scripting attacks
- Product
- ImageBoss
- Fixed in
- 3.0.6
- What to do
- Update ImageBoss to 3.0.6 or newer.
Nov 23, 2021Slideshow Gallery: Does not sanitise and escape the Slide "Title"CVE-2021-24882 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Slideshow Gallery
- Fixed in
- 1.7.4
- What to do
- Update Slideshow Gallery to 1.7.4 or newer.
Nov 23, 2021MainWP Child: Does not validate the orderby and order parameter before using them in a SQL statementCVE-2021-24877 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
- Product
- MainWP Child
- Fixed in
- 4.1.8
- What to do
- Update MainWP Child to 4.1.8 or newer.
Nov 23, 2021eCommerce Product Catalog Plugin for: Does not escape the ic-settings-search parameter before outputting it back in the page in an attributeCVE-2021-24875 · WordPress plugins & themes · reported by WPScanMedium 6.1
The eCommerce Product Catalog Plugin for WordPress plugin before 3.0.39 does not escape the ic-settings-search parameter before outputting it back in the page in an attribute, leading to a Reflected Cross-Site Scripting issue
- Product
- eCommerce Product Catalog Plugin for
- Fixed in
- 3.0.39
- What to do
- Update eCommerce Product Catalog Plugin for to 3.0.39 or newer.
Nov 23, 2021Tutor LMS: Does not sanitise and escape user input before outputting back in attributes in the Student Registration pageCVE-2021-24873 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
- Product
- Tutor LMS
- Fixed in
- 1.9.11
- What to do
- Update Tutor LMS to 1.9.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 23, 2021Advanced Access Manager: Does not escape some of its settingsCVE-2021-24830 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Advanced Access Manager
- Fixed in
- 6.8.0
- What to do
- Update Advanced Access Manager to 6.8.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 23, 2021BetterLinks: Does not sanitise and escape some of imported link fieldsCVE-2021-24812 · WordPress plugins & themes · reported by WPScanMedium 5.4
The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV.
- Product
- BetterLinks
- Fixed in
- 1.2.6
- What to do
- Update BetterLinks to 1.2.6 or newer.
Nov 23, 2021Logo Showcase with Slick Slider: Does not sanitise the Grid SettingsCVE-2021-24729 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Showcase with Slick Slider WordPress plugin before 1.2.4 does not sanitise the Grid Settings, which could allow users with a role as low as Author to perform stored Cross-Site Scripting attacks via post metadata of Grid logo showcase.
- Product
- Logo Showcase with Slick Slider
- Fixed in
- 1.2.4
- What to do
- Update Logo Showcase with Slick Slider to 1.2.4 or newer.
Nov 23, 2021Download: Does not have capability and CSRF checks in the dpwap_plugin_activate AJAX actionCVE-2021-24703 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.
- Product
- Download
- Fixed in
- 1.6.1
- What to do
- Update Download to 1.6.1 or newer.
Nov 23, 2021Forminator: Does not sanitize and escape the email field labelCVE-2021-24700 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
- Product
- Forminator
- Fixed in
- 1.15.4
- What to do
- Update Forminator to 1.15.4 or newer.
Nov 23, 2021MAZ Loader: Does not enforce nonce checksCVE-2021-24668 · WordPress plugins & themes · reported by WPScanMedium 4.3
The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack
- Product
- MAZ Loader
- Fixed in
- 1.4.1
- What to do
- Update MAZ Loader to 1.4.1 or newer.
Nov 23, 2021Images to WebP: Does not validate or sanitise the tab parameter before passing it to the include() functionCVE-2021-24644 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Images to WebP WordPress plugin before 1.9 does not validate or sanitise the tab parameter before passing it to the include() function, which could lead to a Local File Inclusion issue
- Product
- Images to WebP
- Fixed in
- 1.9
- What to do
- Update Images to WebP to 1.9 or newer.
Nov 23, 2021Images to WebP: Does not have CSRF checks in placeCVE-2021-24641 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion
- Product
- Images to WebP
- Fixed in
- 1.9
- What to do
- Update Images to WebP to 1.9 or newer.
Nov 19, 2021Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.CVE-2021-42744 · Other software · Philips · reported by 20705f08-db8b-4497-8f94-7eea62317651Medium 5.9
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- Product
- MRI 1.5T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govusa.philips.com
Nov 19, 2021Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.CVE-2021-26262 · Other software · Philips · reported by 20705f08-db8b-4497-8f94-7eea62317651Medium 5.9
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- Product
- MRI 1.5T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govusa.philips.com
Nov 19, 2021Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.CVE-2021-26248 · Other software · Philips · reported by 20705f08-db8b-4497-8f94-7eea62317651Medium 5.9
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- Product
- MRI 1.5T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govusa.philips.com
Nov 19, 2021In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token.CVE-2021-39235 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
- Product
- Apache Ozone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.commail-archives.apache.org
Nov 17, 2021Shared Files: Does not sanitise and escape the Download Counter Text settingsCVE-2021-24856 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Shared Files
- Fixed in
- 1.6.61
- What to do
- Update Shared Files to 1.6.61 or newer.
Nov 17, 2021QR Redirector: Does not sanitise and escape some of the QR Redirect fieldsCVE-2021-24854 · WordPress plugins & themes · reported by WPScanMedium 5.4
The QR Redirector WordPress plugin before 1.6.1 does not sanitise and escape some of the QR Redirect fields, which could allow users with a role as low as Contributor perform Stored Cross-Site Scripting attacks.
- Product
- QR Redirector
- Fixed in
- 1.6.1
- What to do
- Update QR Redirector to 1.6.1 or newer.
Nov 17, 2021QR Redirector: Does not have capability and CSRF checksCVE-2021-24853 · WordPress plugins & themes · reported by WPScanMedium 4.3
The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects
- Product
- QR Redirector
- Fixed in
- 1.6
- What to do
- Update QR Redirector to 1.6 or newer.
Nov 17, 2021MouseWheel Smooth Scroll: Does not have CSRF check in place on its settings pageCVE-2021-24852 · WordPress plugins & themes · reported by WPScanMedium 6.5
The MouseWheel Smooth Scroll WordPress plugin before 5.7 does not have CSRF check in place on its settings page, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- MouseWheel Smooth Scroll
- Fixed in
- 5.7
- What to do
- Update MouseWheel Smooth Scroll to 5.7 or newer.
Nov 17, 2021Helpful: Does not sanitise and escape some of its settingsCVE-2021-24841 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Helpful WordPress plugin before 4.4.59 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Helpful
- Fixed in
- 4.4.59
- What to do
- Update Helpful to 4.4.59 or newer.
Nov 17, 2021Accept Donations with PayPal: Does not escape the Amount Menu Name field of created ButtonsCVE-2021-24815 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Accept Donations with PayPal
- Fixed in
- 1.3.2
- What to do
- Update Accept Donations with PayPal to 1.3.2 or newer.
Nov 17, 2021Simple JWT Login: Does not have nonce checksCVE-2021-24804 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.
- Product
- Simple JWT Login
- Fixed in
- 3.2.1
- What to do
- Update Simple JWT Login to 3.2.1 or newer.
Nov 17, 2021Colorful Categories: Does not enforce nonce checksCVE-2021-24802 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack
- Product
- Colorful Categories
- Fixed in
- 2.0.15
- What to do
- Update Colorful Categories to 2.0.15 or newer.
Nov 17, 2021My Tickets: Does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboardCVE-2021-24796 · WordPress plugins & themes · reported by WPScanMedium 6.1
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
- Product
- My Tickets
- Fixed in
- 1.8.31
- What to do
- Update My Tickets to 1.8.31 or newer.
Nov 17, 2021Client Invoicing by Sprout Invoices: Does not sanitise and escape some of its settingsCVE-2021-24787 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Client Invoicing by Sprout Invoices WordPress plugin before 19.9.7 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Client Invoicing by Sprout Invoices
- Fixed in
- 19.9.7
- What to do
- Update Client Invoicing by Sprout Invoices to 19.9.7 or newer.
Nov 17, 2021WP Performance Score Booster: Does not have CSRF checkCVE-2021-24776 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Performance Score Booster WordPress plugin before 2.1 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- WP Performance Score Booster
- Fixed in
- 2.1
- What to do
- Update WP Performance Score Booster to 2.1 or newer.
Nov 17, 2021Stream: Does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statementCVE-2021-24772 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Stream WordPress plugin before 3.8.2 does not sanitise and validate the order GET parameter from the Stream Records admin dashboard before using it in a SQL statement, leading to an SQL injection issue.
- Product
- Stream
- Fixed in
- 3.8.2
- What to do
- Update Stream to 3.8.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 17, 2021Email Log: Does not properly validateCVE-2021-24758 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Email Log WordPress plugin before 2.4.7 does not properly validate, sanitise and escape the "orderby" and "order" GET parameters before using them in SQL statement in the admin dashboard, leading to SQL injections
- Product
- Email Log
- Fixed in
- 2.4.7
- What to do
- Update Email Log to 2.4.7 or newer.
Nov 17, 2021Testimonial: Does not escape some testimonial fieldsCVE-2021-24598 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Testimonial WordPress plugin before 1.6.0 does not escape some testimonial fields which could allow high privilege users to perform Cross Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Testimonial
- Fixed in
- 1.6.0
- What to do
- Update Testimonial to 1.6.0 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Nov 15, 2021IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies.CVE-2021-38977 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 212782.
- Product
- Security Key Lifecycle Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.