Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 17 of 39
Jul 12, 2024Inline Related Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5626 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Inline Related Posts
- Fixed in
- 3.7.0
- What to do
- Update Inline Related Posts to 3.7.0 or newer.
Jul 12, 2024WP Secure Maintenance: Does not sanitise and escape some of its settingsCVE-2024-4753 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Secure Maintenance
- Fixed in
- 1.7
- What to do
- Update WP Secure Maintenance to 1.7 or newer.
Jul 12, 2024socialdriver-framework: Does not sanitise and escape some of its settingsCVE-2024-2696 · WordPress plugins & themes · reported by WPScanMedium 4.8
The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- socialdriver-framework
- Fixed in
- 2024.04.30
- What to do
- Update socialdriver-framework to 2024.04.30 or newer.
Jul 12, 2024Watu Quiz: Does not sanitise and escape some of its settingsCVE-2024-2640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been authorized by admins) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Watu Quiz
- Fixed in
- 3.4.1.2
- What to do
- Update Watu Quiz to 3.4.1.2 or newer.
Jul 12, 2024Social Media Widget: Does not sanitise and escape some of its settingsCVE-2024-0974 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Media Widget
- Fixed in
- 4.0.9
- What to do
- Update Social Media Widget to 4.0.9 or newer.
Jul 11, 2024Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2024-6138 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Secure Copy Content Protection and Content Locking
- Fixed in
- 4.0.9
- What to do
- Update Secure Copy Content Protection and Content Locking to 4.0.9 or newer.
Jul 11, 2024Slider by 10Web: Does not sanitise and escape some of its Slide optionsCVE-2024-6026 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access to the Sliders (by default Administrator, however this can be changed via the Slider by 10Web WordPress plugin before 1.2.56's options) and the ability to add images (Editor+) to perform Stored Cross-Site Scripting attacks
- Product
- Slider by 10Web
- Fixed in
- 1.2.56
- What to do
- Update Slider by 10Web to 1.2.56 or newer.
Jul 11, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its Quiz settingsCVE-2024-6025 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.5
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.5 or newer.
Jul 9, 2024Easy Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-6334 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Easy Table of Contents
- Fixed in
- 2.0.67.1
- What to do
- Update Easy Table of Contents to 2.0.67.1 or newer.
Jul 9, 2024URL Shortener by Myhop: Does not sanitise and escape some of its settingsCVE-2024-5802 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortener by Myhop WordPress plugin through 1.0.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- URL Shortener by Myhop
- Affected
- up to 1.0.17
- What to do
- Affects up to 1.0.17. Update URL Shortener by Myhop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2024DN Footer Contacts: Does not sanitise and escape some of its settingsCVE-2024-3410 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DN Footer Contacts
- Fixed in
- 1.6.3
- What to do
- Update DN Footer Contacts to 1.6.3 or newer.
Jul 3, 2024WPQA Builder: Does not sanitise and escape some of its Slider settingsCVE-2024-2375 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WPQA Builder
- Fixed in
- 6.1.1
- What to do
- Update WPQA Builder to 6.1.1 or newer.
Jul 3, 2024Himer: Does not sanitise and escape some of its Post settingsCVE-2024-2234 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 2, 2024Rank Math SEO: Does not sanitise and escape some of its settingsCVE-2024-4627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings (by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO WordPress plugin before 1.0.219) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Rank Math SEO
- Fixed in
- 1.0.219
- What to do
- Update Rank Math SEO to 1.0.219 or newer.
Jul 2, 2024EazyDocs: Does not sanitise and escape some of its settingsCVE-2024-3999 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- EazyDocs
- Fixed in
- 2.5.0
- What to do
- Update EazyDocs to 2.5.0 or newer.
Jul 1, 2024Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-6130 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.26
- What to do
- Update Form Maker by 10Web to 1.15.26 or newer.
Jun 28, 2024Pagerank tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5730 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Pagerank tools
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Pagerank tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Simple AL Slider: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5729 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Simple AL Slider
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Simple AL Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Animated AL List: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5728 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Animated AL List
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Animated AL List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Widget4Call: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5727 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Widget4Call
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Widget4Call to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2024WP Chat App: Does not sanitise and escape some of its settingsCVE-2024-4664 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- WP Chat App
- Fixed in
- 3.6.5
- What to do
- Update WP Chat App to 3.6.5 or newer.
Jun 26, 2024Easy Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-5573 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Easy Table of Contents
- Fixed in
- 2.0.66
- What to do
- Update Easy Table of Contents to 2.0.66 or newer.
Jun 26, 2024Simple Photoswipe: Does not sanitise and escape some of its settingsCVE-2024-5473 · WordPress plugins & themes · reported by WPScanMedium 4
The Simple Photoswipe WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Photoswipe
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Simple Photoswipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Video Widget: Does not sanitise and escape some of its settingsCVE-2024-5169 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Widget WordPress plugin through 1.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Video Widget
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Video Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Frontend Checklist: Does not sanitise and escape some of its settingsCVE-2024-4959 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Frontend Checklist
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Frontend Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024Frontend Checklist: Does not sanitise and escape some of its settingsCVE-2024-4957 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Frontend Checklist
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Frontend Checklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2024WebP & SVG Support: Does not sanitise uploaded SVG filesCVE-2024-3633 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WebP & SVG Support WordPress plugin through 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- WebP & SVG Support
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update WebP & SVG Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2024Mime Types Extended: Does not sanitise uploaded SVG filesCVE-2024-4759 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Mime Types Extended
- Affected
- up to 0.11
- What to do
- Affects up to 0.11. Update Mime Types Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 24, 2024SEOPress: Does not sanitise and escape some of its Post settingsCVE-2024-4899 · WordPress plugins & themes · reported by WPScanMedium 5
The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
- Product
- SEOPress
- Fixed in
- 7.8
- What to do
- Update SEOPress to 7.8 or newer.
Jun 21, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Does not sanitise and escape some of its settingsCVE-2024-5447 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024Widget Bundle: Does not sanitise and escape some of its settingsCVE-2024-4970 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Widget Bundle
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Widget Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024Google CSE: Does not sanitise and escape some of its settingsCVE-2024-4755 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Google CSE
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Google CSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024Widget Bundle: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4616 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users
- Product
- Widget Bundle
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Widget Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024WP Logs Book: Does not sanitise and escape some of its log data before outputting them back in an admin dashboardCVE-2024-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting
- Product
- WP Logs Book
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024CSSable Countdown: Does not sanitise and escape some of its settingsCVE-2024-4384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CSSable Countdown
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update CSSable Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024CB (legacy): Does not sanitise and escape some of its settingsCVE-2024-4381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CB (legacy)
- Affected
- up to 0.9.4.18
- What to do
- Affects up to 0.9.4.18. Update CB (legacy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2024Expert Invoice: Does not sanitise and escape some of its settingsCVE-2024-5172 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Expert Invoice
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Expert Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2024Simple Share Buttons Adder: Does not sanitise and escape some of its settingsCVE-2024-4094 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Simple Share Buttons Adder
- Fixed in
- 8.5.1
- What to do
- Update Simple Share Buttons Adder to 8.5.1 or newer.
Jun 18, 2024Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium: Does not sanitise and escape some of its settingsCVE-2024-3276 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium
- Fixed in
- 2.7.28
- What to do
- Update Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium to 2.7.28 or newer.
Jun 17, 2024Popup Builder: Does not sanitise and escape some of its Notification fieldsCVE-2024-3236 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.
- Product
- Popup Builder
- Fixed in
- 1.1.33
- What to do
- Update Popup Builder to 1.1.33 or newer.
Jun 14, 2024Social Pixel: Does not sanitise and escape some of its settingsCVE-2024-4005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Pixel
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Social Pixel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024Amen: Does not sanitise and escape some of its settingsCVE-2024-3992 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Amen
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Amen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024WordPress Jitsi Shortcode: Does not sanitise and escape some of its settingsCVE-2024-3977 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Jitsi Shortcode
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WordPress Jitsi Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024Pray For Me: Does not sanitise and escape some parametersCVE-2024-3966 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripting attacks that trigger when an admin visits the Prayer Requests in the WP Admin
- Product
- Pray For Me
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Pray For Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024Alemha watermarker: Does not sanitise and escape some of its settingsCVE-2024-3754 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Alemha watermarker WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Alemha watermarker
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Alemha watermarker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024LuckyWP Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-2218 · WordPress plugins & themes · reported by WPScanMedium 4.6
The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- LuckyWP Table of Contents
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update LuckyWP Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-4149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
- Fixed in
- 3.2.3
- What to do
- Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.2.3 or newer.
Jun 13, 2024Web Directory Free: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-3552 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
- Product
- Web Directory Free
- Fixed in
- 1.7.0
- What to do
- Update Web Directory Free to 1.7.0 or newer.
Jun 12, 2024Social Sharing: Does not sanitise and escape some of its settingsCVE-2024-4924 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Sharing
- Fixed in
- 3.3.63
- What to do
- Update Social Sharing to 3.3.63 or newer.
Jun 7, 2024WP Backpack: Does not sanitise and escape some of its settingsCVE-2024-4756 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Backpack
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WP Backpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.