Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 18 of 39
Jun 7, 2024ARForms - Premium WordPress Form Builder: Does not sanitise and escape some of its settingsCVE-2024-4621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- ARForms - Premium WordPress Form Builder
- Fixed in
- 6.6
- What to do
- Update ARForms - Premium WordPress Form Builder to 6.6 or newer.
Jun 4, 2024Antispam Bee: Authentication Bypass by SpoofingCVE-2023-41134 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Antispam Bee: from n/a through 2.11.3.
- Product
- Antispam Bee
- Affected
- up to 2.11.3
- What to do
- Affects up to 2.11.3. Update Antispam Bee to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024FS Product Inquiry: Does not sanitise and escape some form submissionsCVE-2024-4857 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape some form submissions, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
- Product
- FS Product Inquiry
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update FS Product Inquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2024FS Product Inquiry: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4856 · WordPress plugins & themes · reported by WPScanHigh 8.2
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
- Product
- FS Product Inquiry
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update FS Product Inquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2024Simple Ajax Chat: Does not sanitise and escape some of its settingsCVE-2024-2470 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Ajax Chat
- Fixed in
- 20240412
- What to do
- Update Simple Ajax Chat to 20240412 or newer.
Jun 3, 2024Just Writing Statistics: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35641 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GregRoss Just Writing Statistics allows Stored XSS.This issue affects Just Writing Statistics: from n/a through 4.5.
- Product
- Just Writing Statistics
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update Just Writing Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 29, 2024Playlist for Youtube: Does not sanitise and escape some of its settingsCVE-2024-3937 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Playlist for Youtube
- Affected
- up to 1.32
- What to do
- Affects up to 1.32. Update Playlist for Youtube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2024Gianism: Does not sanitise and escape some of its settingsCVE-2024-3921 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Gianism
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Gianism to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2024Ditty: Does not sanitise and escape some of its settingsCVE-2024-3939 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ditty
- Fixed in
- 3.1.36
- What to do
- Update Ditty to 3.1.36 or newer.
May 23, 2024Flattr: Does not sanitise and escape some of its settingsCVE-2024-3920 · WordPress plugins & themes · reported by WPScanLow 3.5
The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Flattr
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Flattr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024Pet Manager: Does not sanitise and escape some of its Pet settingsCVE-2024-3918 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Pet Manager
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Pet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024Pet Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3917 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Pet Manager
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Pet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024IDonate: Does not sanitise and escape some of its settingsCVE-2024-3594 · WordPress plugins & themes · reported by WPScanHigh 8.7
The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- IDonate
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update IDonate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024Button contact VR: Does not sanitise and escape some of its settingsCVE-2024-2220 · WordPress plugins & themes · reported by WPScanLow 3.5
The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Button contact VR
- Affected
- up to 4.7
- What to do
- Affects up to 4.7. Update Button contact VR to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Carousel Slider: Does not sanitise and escape some parametersCVE-2024-4372 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Carousel Slider WordPress plugin before 2.2.11 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
- Product
- Carousel Slider
- Fixed in
- 2.2.11
- What to do
- Update Carousel Slider to 2.2.11 or newer.
May 21, 2024Sailthru Triggermail: Does not sanitise and escape some of its settingsCVE-2024-4290 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Sailthru Triggermail: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-4289 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Sailthru Triggermail
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Sailthru Triggermail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 21, 2024Survey Maker: Does not sanitise and escape some of its settingsCVE-2024-4061 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Survey Maker
- Fixed in
- 4.2.9
- What to do
- Update Survey Maker to 4.2.9 or newer.
May 21, 2024Social Icons Widget & Block by WPZOOM: Does not sanitise and escape some of its Widget settingsCVE-2024-2189 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Icons Widget & Block by WPZOOM
- Fixed in
- 4.2.18
- What to do
- Update Social Icons Widget & Block by WPZOOM to 4.2.18 or newer.
May 17, 2024Popup4Phone: Does not sanitise and escape some of its settingsCVE-2024-3580 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Popup4Phone
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Popup4Phone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2024Popup4Phone: Does not sanitise and escape some parametersCVE-2024-3231 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
- Product
- Popup4Phone
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Popup4Phone to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 17, 2024NextGEN Gallery: Does not sanitise and escape some of its settingsCVE-2024-2744 · WordPress plugins & themes · reported by WPScanMedium 4.3
The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- NextGEN Gallery
- Fixed in
- 3.59.1
- What to do
- Update NextGEN Gallery to 3.59.1 or newer.
May 16, 2024Newsletter Popup: Does not sanitise and escape some of its settingsCVE-2024-3644 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2024Newsletter Popup: Does not sanitise and escape some parametersCVE-2024-3641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024month name translation benaceur: Does not sanitise and escape some of its settingsCVE-2024-3634 · WordPress plugins & themes · reported by WPScanMedium 4.8
The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- month name translation benaceur
- Fixed in
- 2.3.8
- What to do
- Update month name translation benaceur to 2.3.8 or newer.
May 15, 2024HL Twitter: Does not sanitise and escape some of its settingsCVE-2024-3630 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3548 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.1.2
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.2 or newer.
May 14, 2024Save as PDF Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2023-5971 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as PDF Plugin by Pdfcrowd
- Fixed in
- 3.2.0
- What to do
- Update Save as PDF Plugin by Pdfcrowd to 3.2.0 or newer.
May 7, 2024EasyEvent: Does not sanitise and escape some of its settingsCVE-2024-3628 · WordPress plugins & themes · reported by WPScanLow 3.8
The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- EasyEvent
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update EasyEvent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024MF Gig Calendar: Does not sanitise and escape some of its settingsCVE-2024-3755 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- MF Gig Calendar
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024Crelly Slider: Does not sanitise and escape some of its settingsCVE-2024-3752 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Crelly Slider
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Crelly Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024Fancy Product Designer: Does not sanitise and escape some of its settingsCVE-2024-0904 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fancy Product Designer
- Fixed in
- 6.1.81
- What to do
- Update Fancy Product Designer to 6.1.81 or newer.
May 3, 2024Responsive Contact Form Builder & Lead Generation: Does not sanitise and escape some of its settingsCVE-2024-3637 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Contact Form Builder & Lead Generation
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 29, 2024Smart Forms: Does not sanitise and escape some of its settingsCVE-2024-1905 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Smart Forms
- Fixed in
- 2.6.96
- What to do
- Update Smart Forms to 2.6.96 or newer.
Apr 26, 2024Call Now Button: Does not sanitise and escape some of its settingsCVE-2024-2908 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Call Now Button
- Fixed in
- 1.4.7
- What to do
- Update Call Now Button to 1.4.7 or newer.
Apr 26, 2024WP Chat App: Does not sanitise and escape some of its settingsCVE-2024-2837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WP Chat App
- Fixed in
- 3.6.4
- What to do
- Update WP Chat App to 3.6.4 or newer.
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2603 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2439 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2024-2310 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Google Review Slider
- Fixed in
- 13.6
- What to do
- Update WP Google Review Slider to 13.6 or newer.
Apr 26, 2024Fancy Product Designer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0905 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users
- Product
- Fancy Product Designer
- Fixed in
- 6.1.8
- What to do
- Update Fancy Product Designer to 6.1.8 or newer.
Apr 25, 2024AGCA: Does not sanitise and escape some of its settingsCVE-2024-2907 · WordPress plugins & themes · reported by WPScanMedium 6.8
The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AGCA
- Fixed in
- 7.2.2
- What to do
- Update AGCA to 7.2.2 or newer.
Apr 24, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-2972 · WordPress plugins & themes · reported by WPScanLow 3.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
- Fixed in
- 3.1.9
- What to do
- Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.1.9 or newer.
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2404 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers to perform Stored Cross-Site Scripting attacks.
- Product
- Better Comments
- Fixed in
- 1.5.6
- What to do
- Update Better Comments to 1.5.6 or newer.
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2402 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Better Comments
- Fixed in
- 1.5.6
- What to do
- Update Better Comments to 1.5.6 or newer.
Apr 24, 2024WooCommerce Customers Manager: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-1743 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.8
- What to do
- Update WooCommerce Customers Manager to 29.8 or newer.
Apr 17, 2024WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro: Does not sanitise and escape some of its settingsCVE-2024-2309 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro
- Fixed in
- 3.4.0
- What to do
- Update WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro to 3.4.0 or newer.
Apr 17, 2024Social Media Share Buttons & Social Sharing Icons: Does not sanitise and escape some of its settingsCVE-2024-2118 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Media Share Buttons & Social Sharing Icons
- Fixed in
- 2.8.9
- What to do
- Update Social Media Share Buttons & Social Sharing Icons to 2.8.9 or newer.
Apr 15, 2024Social Share, Social Login and Social Comments: Does not sanitise and escape some of its settingsCVE-2024-2836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.64
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.64 or newer.
Apr 15, 2024NPS computy: Does not sanitise and escape some of its settingsCVE-2024-1754 · WordPress plugins & themes · reported by WPScanMedium 4.7
The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- NPS computy
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update NPS computy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.