Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,633 results · page 38 of 73
May 2, 2022Visual Form Builder: Does not sanitise and escape the form's 'Email to' fieldCVE-2022-1046 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Visual Form Builder
- Fixed in
- 3.0.7
- What to do
- Update Visual Form Builder to 3.0.7 or newer.
Apr 29, 2022Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, whichCVE-2022-0984 · Other software · Moodle · reported by Red HatMedium 4.3
Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Apr 25, 2022Donations: Does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated usersCVE-2022-0782 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Donations WordPress plugin through 1.8 does not sanitise and escape the nd_donations_id parameter before using it in a SQL statement via the nd_donations_single_cause_form_validate_fields_php_function AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- Product
- Donations
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 19, 2022Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.CVE-2022-29315 · Other software · Invicti · reported by MITREHigh 8.8
Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.
- Product
- Acunetix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthe-it-wonders.blogspot.comthe-it-wonders.blogspot.com
Apr 19, 2022Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field duringCVE-2021-41570 · Other software · Veritas · reported by MITREMedium 5.4
Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field during a Settings/Configuration Add operation.
- Product
- Netbackup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordveritas.comveritas.com
Apr 18, 2022Thank Me Later: Does not sanitise and escape the Message Subject field before outputting it in the Messages listCVE-2022-1063 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could allow high privileges users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Thank Me Later
- Affected
- up to 3.3.4
- What to do
- Affects up to 3.3.4. Update Thank Me Later to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2.CVE-2020-13590 · Other software · Rukovoditel · reported by talos-cna@cisco.comHigh 7.2
Multiple exploitable SQL injection vulnerabilities exist in the 'entities/fields' page of the Rukovoditel Project Management App 2.7.2. A specially crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities, this can be done either with administrator credentials or through cross-site request forgery.
- Product
- Project Management App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Apr 15, 2022SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.CVE-2022-27474 · Other software · Salesagility · reported by MITREHigh 7.2
SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2022In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitivCVE-2022-22968 · Other software · VMware · reported by security@vmware.comMedium 5.3
In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comtanzu.vmware.com
Apr 14, 2022MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.CVE-2022-27451 · Other software · Mariadb · reported by MITREHigh 7.5
MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orgsecurity.netapp.com
Apr 13, 2022Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.CVE-2021-43154 · Other software · Cmsmadesimple · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.
- Product
- CMS Made Simple
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordelprofesor.meelprofesor.me
Apr 13, 2022Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810.CVE-2022-1347 · Other software · causefx · reported by security@huntr.devHigh 8.4
Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation
- Product
- causefx/organizr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.CVE-2022-27382 · Other software · Mariadb · reported by MITREHigh 7.5
MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orgsecurity.netapp.com
Apr 12, 2022An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via speciallCVE-2022-27381 · Other software · Mariadb · reported by MITREHigh 7.5
An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orglists.debian.org
Apr 11, 2022Easy Social Icons: Does not properly escape the image_file fieldCVE-2022-0840 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfiltered_html capability is disallowed.
- Product
- Easy Social Icons
- Fixed in
- 3.2.1
- What to do
- Update Easy Social Icons to 3.2.1 or newer.
Apr 7, 2022D-Link DIR-878 has inadequate filtering for special characters in the webpage input field.CVE-2022-26670 · Network & remote access · D-Link · reported by twcert@cert.org.twHigh 8.8
D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform command injection attack to execute arbitrary system commands to control the system or disrupt service.
- Product
- DIR-878
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 5, 2022In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fieldsCVE-2022-28651 · Other software · JetBrains · reported by cve@jetbrains.comHigh 8.4
In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 4, 2022A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in iCVE-2021-43464 · Other software · Intelliants · reported by MITREHigh 8.8
A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval().
- Product
- Subrion CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Profile Builder: Does not sanitise and escape Form Fields titles and descriptionCVE-2022-0884 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Profile Builder
- Fixed in
- 3.6.8
- What to do
- Update Profile Builder to 3.6.8 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 2, 2022Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input filCVE-2022-28368 · Other software · Dompdf Project · reported by MITRECritical 9.8
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 1, 2022Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field.CVE-2022-1068 · Other software · Modbus Tools · reported by ics-cert@hq.dhs.govMedium 5.5
Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.
- Product
- Modbus Slave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.CVE-2022-25017 · Other software · Hitrontech · reported by MITRECritical 9.1
Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.
- Product
- Chita Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 31, 2022A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.CVE-2021-42946 · Other software · Htmly · reported by MITREMedium 4.8
A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.CVE-2021-42867 · Other software · Htmly · reported by MITREMedium 4.8
A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.phpCVE-2021-42866 · Other software · Pixelimity · reported by MITREMedium 4.8
A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php
- Product
- Pixelimity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1: Missing authorizationCVE-2022-23183 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.5
Missing authorization vulnerability in Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 allows a remote authenticated attacker to view the information on the database without the access permission.
- Product
- Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1
- What to do
- Update Advanced Custom Fields versions prior to 5.12.1 and Advanced Custom Fields Pro versions prior to 5.12.1 to the newest version.
Mar 29, 2022CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby paramCVE-2021-43701 · Other software · Cszcms · reported by MITREMedium 6.5
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby parameters.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 28, 2022Interactive Medical Drawing of Human Body: Does not sanitise and escape the Link fieldCVE-2022-0388 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Interactive Medical Drawing of Human Body
- Fixed in
- 2.6
- What to do
- Update Interactive Medical Drawing of Human Body to 2.6 or newer.
Mar 26, 2022Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields.CVE-2022-26205 · Other software · Marky Project · reported by MITRECritical 9.8
Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields. This vulnerability allows attackers to execute arbitrary code via injection of a crafted payload.
- Product
- Marky
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2022Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field.CVE-2022-26198 · Other software · Notable · reported by MITRECritical 9.8
Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field.
- Product
- Notable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index UCVE-2021-3422 · Other software · Splunk · reported by prodsec@splunk.comHigh 7.5
The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2022In Yokogawa WideField3 R1.01 - R4.03, a buffer overflow could be caused when a user loads a maliciously crafted project file.CVE-2020-16232 · Other software · Yokogawa · reported by ics-cert@hq.dhs.govLow 2.8
In Yokogawa WideField3 R1.01 - R4.03, a buffer overflow could be caused when a user loads a maliciously crafted project file.
- Product
- WideField3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.CVE-2021-45792 · Other software · Slims · reported by MITREMedium 4.8
Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.
- Product
- Senayan Library Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.CVE-2022-25486 · Other software · Cuppacms · reported by MITREHigh 7.8
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php.
- Product
- Cuppacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stCVE-2022-27207 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.8
Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
- Product
- Jenkins global-build-stats Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 15, 2022The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) CVE-2022-0968 · Other software · microweber · reported by security@huntr.devMedium 5.5
The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2022The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a CVE-2022-0961 · Other software · microweber · reported by security@huntr.devMedium 5.5
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Contact Form Submissions: Does not sanitise and escape additional fields in contact form requests before outputting them in the related submissionCVE-2022-0248 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
- Product
- Contact Form Submissions
- Fixed in
- 1.7.3
- What to do
- Update Contact Form Submissions to 1.7.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Patreon: Does not sanitise and escape the field "Custom Patreon Page name"CVE-2021-25026 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Patreon
- Fixed in
- 1.8.2
- What to do
- Update Patreon to 1.8.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 14, 2022Add Subtitle: Does not sanitise or escape the sub-title field (available only with classic editor)CVE-2021-24897 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
- Product
- Add Subtitle
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Add Subtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 14, 2022GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().CVE-2022-24574 · Other software · Gpac · reported by MITREMedium 5.5
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2022Custom Content Shortcode: Does not escape custom fields before outputting themCVE-2021-24826 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)
- Product
- Custom Content Shortcode
- Fixed in
- 4.0.2
- What to do
- Update Custom Content Shortcode to 4.0.2 or newer.
Mar 7, 2022The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, toCVE-2021-24824 · WordPress plugins & themes · reported by WPScanMedium 4.3
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
- Product
- [field] shortcode included with the Custom Content Shortcode
- Fixed in
- 4.0.1
- What to do
- Update [field] shortcode included with the Custom Content Shortcode to 4.0.1 or newer.
Mar 7, 2022WP Event Manager: Does not escape some of its Field Editor settingsCVE-2021-24810 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- WP Event Manager
- Fixed in
- 3.1.23
- What to do
- Update WP Event Manager to 3.1.23 or newer.
Feb 28, 2022A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of aCVE-2022-25022 · Other software · Htmly · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of a blog post.
- Product
- Htmly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcvedetails.com
Feb 28, 2022Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.CVE-2022-26332 · Other software · Cipi · reported by MITREMedium 5.4
Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.
- Product
- Cipi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 28, 2022Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field).CVE-2022-24572 · Other software · CAR Driving School Management System Project · reported by MITREMedium 6.1
Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability, an admin views the registered user details.
- Product
- CAR Driving School Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022EditableTable: Does not sanitise and escape any of the Table and Column fieldsCVE-2021-24898 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- EditableTable
- Affected
- up to 0.1.4
- What to do
- Affects up to 0.1.4. Update EditableTable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 21, 2022Image Photo Gallery Final Tiles Grid: Does not sanitise and escape the Description fieldCVE-2022-0186 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.5.3
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.5.3 or newer.
Feb 21, 2022Buffer Button: Was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text fieldCVE-2021-25058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.
- Product
- Buffer Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Buffer Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.