Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,709 results · page 30 of 115
Jan 9, 2025Mailing Group Listserv: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-22527 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows SQL Injection.This issue affects Mailing Group Listserv: from n/a through <= 2.0.9.
- Product
- Mailing Group Listserv
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Mailing Group Listserv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (ReDCVE-2024-46242 · Other software · reported by MITREHigh 7.5
An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (ReDoS) via supplying a crafted string as e-mail address during registration.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025SpeakOut! Email Petitions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22309 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RopeSwingHld SpeakOut! Email Petitions speakout allows DOM-Based XSS.This issue affects SpeakOut! Email Petitions: from n/a through <= 4.4.2.
- Product
- SpeakOut! Email Petitions
- Affected
- up to 4.4.2
- What to do
- Affects up to 4.4.2. Update SpeakOut! Email Petitions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WP Mailster: Insertion of Sensitive Information Into Sent DataCVE-2025-22303 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
- Product
- WP Mailster
- Affected
- up to 1.8.17.0
- What to do
- Affects up to 1.8.17.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Email Reminders: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56292 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevelop Email Reminders email-reminders allows Stored XSS.This issue affects Email Reminders: from n/a through <= 2.0.5.
- Product
- Email Reminders
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Email Reminders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025SmartEmailing.cz: Reflected Cross-Site ScriptingCVE-2024-12261 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SmartEmailing.cz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'se-lists-updated' parameter in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- SmartEmailing.cz
- Affected
- up to 2.2.0
- What to do
- Affects up to 2.2.0. Update SmartEmailing.cz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jan 7, 2025Popup – MailChimp, GetResponse and ActiveCampaign Intergrations: Unauthorized loss of dataCVE-2024-12158 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'upc_delete_db_data' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated attackers to delete the DB data for the plugin.
- Product
- Popup – MailChimp, GetResponse and ActiveCampaign Intergrations
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Popup – MailChimp, GetResponse and ActiveCampaign Intergrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 7, 2025Popup – MailChimp, GetResponse and ActiveCampaign Intergrations: SQL InjectionCVE-2024-12157 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'upc_delete_db_record' AJAX action in all versions up to, and including, 3.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Popup – MailChimp, GetResponse and ActiveCampaign Intergrations
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Popup – MailChimp, GetResponse and ActiveCampaign Intergrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 6, 2025information disclosure while invoking the mailbox read API.CVE-2024-43063 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
information disclosure while invoking the mailbox read API.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.CVE-2024-23366 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.6
Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025Email Subscribers by Icegram Express: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12311 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.44
- What to do
- Update Email Subscribers by Icegram Express to 5.7.44 or newer.
Jan 2, 2025Email Address Encoder: Cross-Site Request Forgery (CSRF)CVE-2024-43927 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Till Krüss Email Address Encoder email-address-encoder allows Cross Site Request Forgery.This issue affects Email Address Encoder: from n/a through <= 1.0.23.
- Product
- Email Address Encoder
- Affected
- up to 1.0.23
- What to do
- Affects up to 1.0.23. Update Email Address Encoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Metorik – Reports & Email Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-38691 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Metorik Metorik – Reports & Email Automation for WooCommerce metorik-helper allows Cross Site Request Forgery.This issue affects Metorik – Reports & Email Automation for WooCommerce: from n/a through <= 1.7.1.
- Product
- Metorik – Reports & Email Automation for WooCommerce
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update Metorik – Reports & Email Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 202510CentMail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56030 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carver Lab 10CentMail 10centmail-subscription-management-and-analytics allows Reflected XSS.This issue affects 10CentMail: from n/a through <= 2.1.50.
- Product
- 10CentMail
- Affected
- up to 2.1.50
- What to do
- Affects up to 2.1.50. Update 10CentMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests CVE-2024-53647 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 6.5
Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests without any restriction, potentially leading to abuse or denial of service.
- Product
- Trend Micro ID Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.com
Dec 30, 2024TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.CVE-2024-50702 · Other software · TeamPass · reported by MITREMedium 5.4
TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.
- Product
- TeamPass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2024In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() It should be size of the sCVE-2024-56684 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: fix wrong use of sizeof in cmdq_get_clocks() It should be size of the struct clk_bulk_data, not data pointer pass to devm_kcalloc().
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 19, 2024An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.CVE-2024-54663 · Email & office · Synacor · reported by MITREHigh 7.5
An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.
- Product
- Zimbra Collaboration Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwiki.zimbra.comwiki.zimbra.com
Dec 19, 2024A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting dCVE-2024-12727 · Network & remote access · Sophos · reported by security-alert@sophos.comCritical 9.8
A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.
- Product
- Sophos Firewall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2024Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMACVE-2024-55196 · Other software · reported by MITREHigh 7.5
Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords for the configured IMAP and SMTP servers.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).CVE-2024-55492 · Other software · Magicwinmail · reported by MITREMedium 6.1
Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).
- Product
- Winmail Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2024Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailiCVE-2024-55104 · Websites & servers · Phpgurukul · reported by MITREHigh 7.2
Online Nurse Hiring System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component /admin/add-nurse.php via the gender and emailid parameters.
- Product
- Online Nurse Hiring System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comphpgurukul.com
Dec 16, 2024Caldera SMTP Mailer: Missing AuthorizationCVE-2024-56003 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Cramer Caldera SMTP Mailer caldera-smtp-mailer.This issue affects Caldera SMTP Mailer: from n/a through <= 1.0.1.
- Product
- Caldera SMTP Mailer
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Caldera SMTP Mailer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024Multiple Admin Emails: Cross-Site Request Forgery (CSRF)CVE-2024-54388 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Phuc Pham Multiple Admin Emails multiple-admin-emails allows Cross Site Request Forgery.This issue affects Multiple Admin Emails: from n/a through <= 1.0.
- Product
- Multiple Admin Emails
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Multiple Admin Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024WP Mailster: Cross-Site Request Forgery (CSRF)CVE-2024-54355 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in brandtoss WP Mailster wp-mailster allows Cross Site Request Forgery.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
- Product
- WP Mailster
- Affected
- up to 1.8.17.0
- What to do
- Affects up to 1.8.17.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Smaily for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-54286 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smaily Smaily for WP smaily-for-wp allows Stored XSS.This issue affects Smaily for WP: from n/a through <= 3.1.5.
- Product
- Smaily for WP
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update Smaily for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Mail Picker: Deserialization of Untrusted DataCVE-2024-54273 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.
- Product
- Mail Picker
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Mail Picker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024MailChimp Forms by MailMunch: Missing AuthorizationCVE-2023-40203 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailMunch MailChimp Forms by MailMunch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MailChimp Forms by MailMunch: from n/a through 3.1.4.
- Product
- MailChimp Forms by MailMunch
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update MailChimp Forms by MailMunch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Woo Custom Emails: Missing AuthorizationCVE-2023-32507 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Missing Authorization vulnerability in wp3sixty Woo Custom Emails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Custom Emails: from n/a through 2.2.
- Product
- Woo Custom Emails
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Woo Custom Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2024BP Email Assign Templates: Reflected Cross-Site ScriptingCVE-2024-12441 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2025-24631 is likely a duplicate of this.
- Product
- BP Email Assign Templates
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update BP Email Assign Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 10, 2024Email Reminders: Stored Cross-Site ScriptingCVE-2024-11945 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Reminders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Email Reminders
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Email Reminders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 9, 2024An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages seCVE-2024-12174 · Other software · Tenable · reported by vulnreport@tenable.comLow 2.7
An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server.
- Product
- Security Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024GoDaddy Email Marketing: Missing AuthorizationCVE-2023-49156 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in GoDaddy GoDaddy Email Marketing godaddy-email-marketing-sign-up-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDaddy Email Marketing: from n/a through <= 1.4.3.
- Product
- GoDaddy Email Marketing
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update GoDaddy Email Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Mail Bank - #1 Mail SMTP Plugin for: Missing AuthorizationCVE-2023-48332 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Varun Sharma Mail Bank - #1 Mail SMTP Plugin for WordPress wp-mail-bank allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mail Bank - #1 Mail SMTP Plugin for WordPress: from n/a through <= 4.0.14.
- Product
- Mail Bank - #1 Mail SMTP Plugin for
- Affected
- up to 4.0.14
- What to do
- Affects up to 4.0.14. Update Mail Bank - #1 Mail SMTP Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024BlossomThemes Email Newsletter: Missing AuthorizationCVE-2023-47849 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Blossom Themes BlossomThemes Email Newsletter blossomthemes-email-newsletter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BlossomThemes Email Newsletter: from n/a through <= 2.2.4.
- Product
- BlossomThemes Email Newsletter
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update BlossomThemes Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Welcome Email Editor: Missing AuthorizationCVE-2023-47756 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in David Vongries Welcome Email Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcome Email Editor: from n/a through 5.0.6.
- Product
- Welcome Email Editor
- Affected
- up to 5.0.6
- What to do
- Affects up to 5.0.6. Update Welcome Email Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 8, 2024MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation.CVE-2024-55560 · Other software · mailcleaner · reported by MITRECritical 9.8
MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation.
- Product
- mailcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2024Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Reflected Cross-Site ScriptingCVE-2024-11436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Affected
- up to 1.4.19
- What to do
- Affects up to 1.4.19. Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2024WP Mailster: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53807 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brandtoss WP Mailster wp-mailster allows Blind SQL Injection.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
- Product
- WP Mailster
- Affected
- up to 1.8.16.0
- What to do
- Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WP Mailster: Missing AuthorizationCVE-2024-53805 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in brandtoss WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
- Product
- WP Mailster
- Affected
- up to 1.8.16.0
- What to do
- Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WP Mailster: Insertion of Sensitive Information Into Sent DataCVE-2024-53804 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
- Product
- WP Mailster
- Affected
- up to 1.8.16.0
- What to do
- Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024WP Mailster: Missing AuthorizationCVE-2024-53803 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in brandtoss WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
- Product
- WP Mailster
- Affected
- up to 1.8.16.0
- What to do
- Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 4, 2024Email Address Obfuscation: Stored Cross-Site ScriptingCVE-2024-11935 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Email Address Obfuscation
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Email Address Obfuscation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 3, 2024WP Mailster: Stored Cross-Site ScriptingCVE-2024-11782 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Mailster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mst_subscribe' shortcode in all versions up to, and including, 1.8.17.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP Mailster
- Affected
- up to 1.8.17.0
- What to do
- Affects up to 1.8.17.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 2, 2024Post By Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52463 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Westwood Post By Email post-by-email allows Reflected XSS.This issue affects Post By Email: from n/a through <= 1.0.4b.
- Product
- Post By Email
- Affected
- up to 1.0.4b
- What to do
- Affects up to 1.0.4b. Update Post By Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024WP e-Commerce Style Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52462 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob Schwartz WP e-Commerce Style Email wp-e-commerce-style-email allows Reflected XSS.This issue affects WP e-Commerce Style Email: from n/a through <= 0.6.2.
- Product
- WP e-Commerce Style Email
- Affected
- up to 0.6.2
- What to do
- Affects up to 0.6.2. Update WP e-Commerce Style Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 30, 2024Mail Picker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53772 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Mail Picker mail-picker allows DOM-Based XSS.This issue affects Mail Picker: from n/a through <= 1.0.15.
- Product
- Mail Picker
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update Mail Picker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 29, 2024A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected intCVE-2024-11990 · Other software · NetWin · reported by cve-coordination@incibe.esMedium 4.6
A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected into vulnerable parameters.
- Product
- SurgeMail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2024WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-53737 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
- Product
- WP Mailster
- Affected
- up to 1.8.16.0
- What to do
- Affects up to 1.8.16.0. Update WP Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticaCVE-2024-11599 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comHigh 8.2
Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.