Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,184 results · page 29 of 64
Jun 21, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5448 · WordPress plugins & themes · reported by WPScanMedium 5.4
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode: Does not sanitise and escape some of its settingsCVE-2024-5447 · WordPress plugins & themes · reported by WPScanMedium 4.8
The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024Widget Bundle: Does not sanitise and escape some of its settingsCVE-2024-4970 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Widget Bundle
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Widget Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024Google CSE: Does not sanitise and escape some of its settingsCVE-2024-4755 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Google CSE
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Google CSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024Widget Bundle: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4616 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Widget Bundle WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users
- Product
- Widget Bundle
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Widget Bundle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024WP Logs Book: Does not sanitise and escape some of its log data before outputting them back in an admin dashboardCVE-2024-4477 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Logs Book WordPress plugin through 1.0.1 does not sanitise and escape some of its log data before outputting them back in an admin dashboard, leading to an Unauthenticated Stored Cross-Site Scripting
- Product
- WP Logs Book
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP Logs Book to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024CSSable Countdown: Does not sanitise and escape some of its settingsCVE-2024-4384 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CSSable Countdown WordPress plugin through 1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CSSable Countdown
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update CSSable Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024CB (legacy): Does not sanitise and escape some of its settingsCVE-2024-4381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- CB (legacy)
- Affected
- up to 0.9.4.18
- What to do
- Affects up to 0.9.4.18. Update CB (legacy) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 21, 2024DOP Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-4377 · WordPress plugins & themes · reported by WPScanMedium 5.4
The DOP Shortcodes WordPress plugin through 1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- DOP Shortcodes
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update DOP Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2024HTML5 Video Player: Does not sanitize and escape a parameter from a REST route before using it in a SQL statementCVE-2024-5522 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- HTML5 Video Player
- Fixed in
- 2.5.27
- What to do
- Update HTML5 Video Player to 2.5.27 or newer.
Jun 20, 2024Responsive video embed: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5475 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive video embed WordPress plugin before 0.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Responsive video embed
- Fixed in
- 0.5.1
- What to do
- Update Responsive video embed to 0.5.1 or newer.
Jun 18, 2024Expert Invoice: Does not sanitise and escape some of its settingsCVE-2024-5172 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Expert Invoice WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Expert Invoice
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Expert Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2024Simple Share Buttons Adder: Does not sanitise and escape some of its settingsCVE-2024-4094 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Share Buttons Adder WordPress plugin before 8.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Simple Share Buttons Adder
- Fixed in
- 8.5.1
- What to do
- Update Simple Share Buttons Adder to 8.5.1 or newer.
Jun 18, 2024Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium: Does not sanitise and escape some of its settingsCVE-2024-3276 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium WordPress plugin before 2.7.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium
- Fixed in
- 2.7.28
- What to do
- Update Lightbox & Modal Popup WordPress Plugin WordPress plugin before 2.7.28, foobox-image-lightbox-premium to 2.7.28 or newer.
Jun 17, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-4305 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Post Grid Gutenberg Blocks and WordPress Blog
- Fixed in
- 4.1.0
- What to do
- Update Post Grid Gutenberg Blocks and WordPress Blog to 4.1.0 or newer.
Jun 17, 2024Popup Builder: Does not sanitise and escape some of its Notification fieldsCVE-2024-3236 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.
- Product
- Popup Builder
- Fixed in
- 1.1.33
- What to do
- Update Popup Builder to 1.1.33 or newer.
Jun 14, 2024Social Pixel: Does not sanitise and escape some of its settingsCVE-2024-4005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Pixel
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Social Pixel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024Amen: Does not sanitise and escape some of its settingsCVE-2024-3992 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Amen
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update Amen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024WordPress Jitsi Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3978 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WordPress Jitsi Shortcode
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WordPress Jitsi Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024WordPress Jitsi Shortcode: Does not sanitise and escape some of its settingsCVE-2024-3977 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WordPress Jitsi Shortcode
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WordPress Jitsi Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024Pray For Me: Does not sanitise and escape some parametersCVE-2024-3966 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pray For Me WordPress plugin through 1.0.4 does not sanitise and escape some parameters, which could unauthenticated visitors to perform Cross-Site Scripting attacks that trigger when an admin visits the Prayer Requests in the WP Admin
- Product
- Pray For Me
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Pray For Me to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024Alemha watermarker: Does not sanitise and escape some of its settingsCVE-2024-3754 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Alemha watermarker WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Alemha watermarker
- Affected
- up to 1.3.1
- What to do
- Affects up to 1.3.1. Update Alemha watermarker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024LuckyWP Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-2218 · WordPress plugins & themes · reported by WPScanMedium 4.6
The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- LuckyWP Table of Contents
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update LuckyWP Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-4149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
- Fixed in
- 3.2.3
- What to do
- Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.2.3 or newer.
Jun 13, 2024Search & Replace: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-4145 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks (such as within a multi-site network).
- Product
- Search & Replace
- Fixed in
- 3.2.2
- What to do
- Update Search & Replace to 3.2.2 or newer.
Jun 13, 2024Web Directory Free: Does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-3552 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with different techniques like UNION, Time-Based and Error-Based.
- Product
- Web Directory Free
- Fixed in
- 1.7.0
- What to do
- Update Web Directory Free to 1.7.0 or newer.
Jun 13, 2024FooGallery WordPress plugin before 2.4.15, foogallery-premium: Does not validate and escape some of its Gallery settings before outputting them back in the pageCVE-2024-2762 · WordPress plugins & themes · reported by WPScanMedium 5.4
The FooGallery WordPress plugin before 2.4.15, foogallery-premium WordPress plugin before 2.4.15 does not validate and escape some of its Gallery settings before outputting them back in the page, which could allow users with a role as low as Author to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- FooGallery WordPress plugin before 2.4.15, foogallery-premium
- Fixed in
- 2.4.15
- What to do
- Update FooGallery WordPress plugin before 2.4.15, foogallery-premium to 2.4.15 or newer.
Jun 12, 2024Social Sharing: Does not sanitise and escape some of its settingsCVE-2024-4924 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Sharing
- Fixed in
- 3.3.63
- What to do
- Update Social Sharing to 3.3.63 or newer.
Jun 12, 2024ARForms - Premium WordPress Form Builder: Does not properly escape user-controlled inputCVE-2024-0427 · WordPress plugins & themes · reported by WPScanMedium 6.3
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions.
- Product
- ARForms - Premium WordPress Form Builder
- Fixed in
- 6.4.1
- What to do
- Update ARForms - Premium WordPress Form Builder to 6.4.1 or newer.
Jun 7, 2024WP Backpack: Does not sanitise and escape some of its settingsCVE-2024-4756 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Backpack WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Backpack
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update WP Backpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 7, 2024ARForms - Premium WordPress Form Builder: Does not sanitise and escape some of its settingsCVE-2024-4621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- ARForms - Premium WordPress Form Builder
- Fixed in
- 6.6
- What to do
- Update ARForms - Premium WordPress Form Builder to 6.6 or newer.
Jun 7, 2024Logo Slider: Does not validate and escape some of its Slider Settings before outputting them back in attributesCVE-2024-3288 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.0.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 4.0.0
- What to do
- Update Logo Slider to 4.0.0 or newer.
Jun 5, 2024Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'impoCVE-2024-5324 · WordPress plugins & themes · reported by WordfenceHigh 8.8
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 4, 2024Captcha Code: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48745 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9.
- Product
- Captcha Code
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Captcha Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024WP Forms Puzzle Captcha: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.
- Product
- WP Forms Puzzle Captcha
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update WP Forms Puzzle Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Captcha/Honeypot for Contact Form 7: Improper Restriction of Excessive Authentication AttemptsCVE-2023-45009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Forge12 Interactive GmbH Captcha/Honeypot for Contact Form 7 allows Functionality Bypass.This issue affects Captcha/Honeypot for Contact Form 7: from n/a through 1.11.3.
- Product
- Captcha/Honeypot for Contact Form 7
- Affected
- up to 1.11.3
- What to do
- Affects up to 1.11.3. Update Captcha/Honeypot for Contact Form 7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024WP Captcha: Improper Restriction of Excessive Authentication AttemptsCVE-2023-44235 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Devnath verma WP Captcha allows Functionality Bypass.This issue affects WP Captcha: from n/a through 2.0.0.
- Product
- WP Captcha
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update WP Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Cartpauj Register Captcha: : Improper Control of Interaction FrequencyCVE-2023-40673 · WordPress plugins & themes · reported by PatchstackMedium 6.5
: Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.
- Product
- Cartpauj Register Captcha
- Affected
- up to 1.0.02
- What to do
- Affects up to 1.0.02. Update Cartpauj Register Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024FS Product Inquiry: Does not sanitise and escape some form submissionsCVE-2024-4857 · WordPress plugins & themes · reported by WPScanMedium 6.1
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape some form submissions, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks
- Product
- FS Product Inquiry
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update FS Product Inquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2024FS Product Inquiry: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-4856 · WordPress plugins & themes · reported by WPScanHigh 8.2
The FS Product Inquiry WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
- Product
- FS Product Inquiry
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update FS Product Inquiry to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2024wp-eMember: Does not sanitize and escape the "fieldId" parameter before outputting it back in the pageCVE-2024-4749 · WordPress plugins & themes · reported by WPScanHigh 8.3
The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- wp-eMember
- Fixed in
- 10.3.9
- What to do
- Update wp-eMember to 10.3.9 or newer.
Jun 4, 2024Gutenberg Blocks with AI by Kadence WP: Does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embedCVE-2024-4057 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.37 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Gutenberg Blocks with AI by Kadence WP
- Fixed in
- 3.2.37
- What to do
- Update Gutenberg Blocks with AI by Kadence WP to 3.2.37 or newer.
Jun 4, 2024Simple Ajax Chat: Does not sanitise and escape some of its settingsCVE-2024-2470 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Ajax Chat WordPress plugin before 20240412 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Ajax Chat
- Fixed in
- 20240412
- What to do
- Update Simple Ajax Chat to 20240412 or newer.
May 29, 2024Playlist for Youtube: Does not sanitise and escape some of its settingsCVE-2024-3937 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Playlist for Youtube
- Affected
- up to 1.32
- What to do
- Affects up to 1.32. Update Playlist for Youtube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 29, 2024Gianism: Does not sanitise and escape some of its settingsCVE-2024-3921 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Gianism
- Affected
- up to 5.1.0
- What to do
- Affects up to 5.1.0. Update Gianism to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2024KKProgressbar2 Free: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-4533 · WordPress plugins & themes · reported by WPScanMedium 6.5
The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks
- Product
- KKProgressbar2 Free
- Affected
- up to 1.1.4.2
- What to do
- Affects up to 1.1.4.2. Update KKProgressbar2 Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 27, 2024Ditty: Does not sanitise and escape some of its settingsCVE-2024-3939 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ditty
- Fixed in
- 3.1.36
- What to do
- Update Ditty to 3.1.36 or newer.
May 23, 2024Flattr: Does not sanitise and escape some of its settingsCVE-2024-3920 · WordPress plugins & themes · reported by WPScanLow 3.5
The Flattr WordPress plugin through 1.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Flattr
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Flattr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024Pet Manager: Does not sanitise and escape some of its Pet settingsCVE-2024-3918 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pet Manager WordPress plugin through 1.4 does not sanitise and escape some of its Pet settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks.
- Product
- Pet Manager
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Pet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 23, 2024Pet Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3917 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pet Manager WordPress plugin through 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Pet Manager
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Pet Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.