Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

230 results · page 4 of 5

Nov 27, 2023Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view pCVE-2023-43754 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled.
Product
Mattermost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Nov 22, 2023WP Customer Reviews: Sensitive Information ExposureCVE-2023-4686 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.
Product
WP Customer Reviews
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 7, 2023ReviewX – Multi-criteria Rating & Reviews for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46809 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.
Product
ReviewX – Multi-criteria Rating & Reviews for WooCommerce
Affected
up to 1.6.7
What to do
Affects up to 1.6.7. Update ReviewX – Multi-criteria Rating & Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Site Reviews: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46801 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.
Product
Site Reviews
Affected
up to 6.2.0
What to do
Affects up to 6.2.0. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 7, 2023Product Reviews Import Export for WooCommerce: Improper Neutralization of Formula Elements in a CSV FileCVE-2022-46802 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
Product
Product Reviews Import Export for WooCommerce
Affected
up to 1.4.8
What to do
Affects up to 1.4.8. Update Product Reviews Import Export for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023WP Customer Reviews: Stored Cross-Site ScriptingCVE-2023-4648 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Customer Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Customer Reviews
Affected
up to 3.6.6
What to do
Affects up to 3.6.6. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 18, 2023Widgets for Google Reviews: Cross-Site Request ForgeryCVE-2023-3254 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Widgets for Google Reviews
Affected
up to 10.9
What to do
Affects up to 10.9. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.CVE-2023-45048 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.
Affected
up to 5.00
What to do
Affects up to 5.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2023Absolute Reviews: Cross-Site Request ForgeryCVE-2021-4426 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Absolute Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.8. This is due to missing or incorrect nonce validation on the metabox_review_save() function. This makes it possible for unauthenticated attackers to save meta tags via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Absolute Reviews
Affected
up to 1.0.8
What to do
Affects up to 1.0.8. Update Absolute Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jun 6, 2023Ultimate Reviews: PHP Object InjectionCVE-2020-36726 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input in several vulnerable functions. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin.
Product
Ultimate Reviews
Affected
up to 2.1.32
What to do
Affects up to 2.1.32. Update Ultimate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com plugins.trac.wordpress.org
Jun 2, 2023Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in pCVE-2023-25731 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite global objects in privileged code. This vulnerability affects Firefox < 110.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
May 16, 2023NetReviews SAS Verified Reviews: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2023-23720 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NetReviews SAS Verified Reviews (Avis Vérifiés) plugin <= 2.3.13 versions.
Product
NetReviews SAS Verified Reviews
Affected
up to 2.3.13
What to do
Affects up to 2.3.13. Update NetReviews SAS Verified Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 2, 2023Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews) in evasys before 8.2 Build 2286CVE-2023-31435 · Other software · Evasys · reported by MITREHigh 8.1
Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire previews) in evasys before 8.2 Build 2286 and 9.x before 9.0 Build 2401 allow authenticated attackers to read and write to unauthorized data by accessing functions directly.
Product
Evasys
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cves.at cves.at
May 2, 2023Site Reviews: Does not sanitise and escape some of its settingsCVE-2023-1525 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Site Reviews WordPress plugin before 6.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Site Reviews
Fixed in
6.7.1
What to do
Update Site Reviews to 6.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2023MS-Reviews: Does not sanitise and escape reviewsCVE-2023-0424 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MS-Reviews WordPress plugin through 1.5 does not sanitise and escape reviews, which could allow users any authenticated users, such as Subscribers to perform Stored Cross-Site Scripting attacks
Product
MS-Reviews
Affected
up to 1.5
What to do
Affects up to 1.5. Update MS-Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 15, 2023SQL Injection (SQLi) vulnerability in RichPlugins Plugin for Google Reviews plugin <= 2.2.3 versions.CVE-2022-44580 · WordPress plugins & themes · reported by PatchstackCritical 9.1
SQL Injection (SQLi) vulnerability in RichPlugins Plugin for Google Reviews plugin <= 2.2.3 versions.
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 14, 2023PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.CVE-2023-25206 · Websites & servers · Prestashop · reported by MITREHigh 8.8
PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.
Product
Advanced Reviews
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record addons.prestashop.com friends-of-presta.github.io
Feb 13, 2023Customer Reviews for WooCommerce: Does not validate one of its shortcode attributeCVE-2023-0080 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their content. RCE could also be achieved if the attacker manage to upload a malicious image containing PHP code, and then include it via the affected attribute, on a default WP install, authors could easily achieve that given that they have the upload_file capability.
Product
Customer Reviews for WooCommerce
Fixed in
5.16.0
What to do
Update Customer Reviews for WooCommerce to 5.16.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 13, 2023Judge.me Product Reviews for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0061 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Judge.me Product Reviews for WooCommerce WordPress plugin before 1.3.21 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Judge.me Product Reviews for WooCommerce
Fixed in
1.3.21
What to do
Update Judge.me Product Reviews for WooCommerce to 1.3.21 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 30, 2023Widgets for Google Reviews: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4470 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
Widgets for Google Reviews
Fixed in
9.8
What to do
Update Widgets for Google Reviews to 9.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 22, 2022Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection tiCVE-2022-41952 · Other software · matrix-org · reported by GitHubMedium 6.5
Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast). This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled. Version 1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview. Upgrade to 1.53.0 to fully resolve the issue. As a workaround, turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.
Product
synapse
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 23, 2022Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPressCVE-2022-40194 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.CVE-2022-38470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 23, 2022Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.CVE-2022-38134 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
Affected
up to 5.3.5
What to do
Affects up to 5.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Sep 2, 2022This package is a PrestaShop module that allows users to post reviews and rate products.CVE-2022-35933 · Websites & servers · PrestaShop · reported by GitHubMedium 6.1
This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.
Product
productcomments
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 22, 2022Yotpo Reviews for WooCommerce: Lacks nonce checkCVE-2022-2555 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Yotpo Reviews for WooCommerce WordPress plugin through 2.0.4 lacks nonce check when updating its settings, which could allow attacker to make a logged in admin change them via a CSRF attack.
Product
Yotpo Reviews for WooCommerce
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Yotpo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 12, 2022BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next.CVE-2022-35953 · Other software · bookwyrm-social · reported by GitHubHigh 7.1
BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be vulnerable to tabnabbing, a form of phishing that gives attackers an opportunity to redirect a user to a malicious site. The issue was patched in version 0.4.5.
Product
bookwyrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Aug 5, 2022Rich Reviews by Starfish plugin <= 1.9.14 at: Cross-Site Request Forgery (CSRF)CVE-2021-36861 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Rich Reviews by Starfish plugin <= 1.9.14 at WordPress allows an attacker to delete reviews.
Product
Rich Reviews by Starfish plugin <= 1.9.14 at
Affected
up to 1.9.14
What to do
Affects up to 1.9.14. Update Rich Reviews by Starfish plugin <= 1.9.14 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jul 18, 2022plugin Wbcom Designs – BuddyPress Group Reviews: Unauthorized settings changes and review modificationCVE-2022-2108 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.
Product
plugin Wbcom Designs – BuddyPress Group Reviews
Affected
up to 2.8.3
What to do
Affects up to 2.8.3. Update plugin Wbcom Designs – BuddyPress Group Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 13, 2022Google Places Reviews: Does not properly escape its Google API key settingCVE-2022-1772 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account.
Product
Google Places Reviews
Fixed in
2.0.0
What to do
Update Google Places Reviews to 2.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 28, 2022Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).CVE-2022-23979 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
Affected
up to 3.0.15
What to do
Affects up to 3.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Jan 14, 2022Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews.CVE-2021-3965 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.5
Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews.
Product
Designjet T920 Cr355a Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com support.hp.com
Jan 3, 2022Site Reviews: Does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users)CVE-2021-24973 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin
Product
Site Reviews
Fixed in
5.17.3
What to do
Update Site Reviews to 5.17.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Dec 27, 2021Rich Reviews by Starfish: Does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statementCVE-2021-24753 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue
Product
Rich Reviews by Starfish
Fixed in
1.9.6
What to do
Update Rich Reviews by Starfish to 1.9.6 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Nov 23, 2021Reviews Plus: Does not validate the submitted ratingCVE-2021-24894 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Reviews Plus WordPress plugin before 1.2.14 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service in the review section when an authenticated user submit such rating and the reviews are set to be displayed on the post/page
Product
Reviews Plus
Fixed in
1.2.14
What to do
Update Reviews Plus to 1.2.14 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Sep 6, 2021Site Reviews: Does not sanitise some of its Review DetailsCVE-2021-24603 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed
Product
Site Reviews
Fixed in
5.13.1
What to do
Update Site Reviews to 5.13.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 2, 2021The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does nCVE-2021-24492 · WordPress plugins & themes · reported by WPScanHigh 8.8
The hndtst_action_instance_callback AJAX call of the Handsome Testimonials & Reviews WordPress plugin before 2.1.1, available to any authenticated users, does not sanitise, validate or escape the hndtst_previewShortcodeInstanceId POST parameter before using it in a SQL statement, leading to an SQL Injection issue.
Product
Handsome Testimonials & Reviews
Fixed in
2.1.1
What to do
Update Handsome Testimonials & Reviews to 2.1.1 or newer.
Full record and what to do →NVD record codevigilant.com wpscan.com
Jul 9, 2021Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.CVE-2020-21333 · Other software · Publiccms · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.
Product
Publiccms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 24, 2021WP Customer Reviews: Did not sanitise some of its settingsCVE-2021-24296 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings, allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled
Product
WP Customer Reviews
Fixed in
3.5.6
What to do
Update WP Customer Reviews to 3.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2021Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vCVE-2021-24135 · WordPress plugins & themes · reported by WPScanMedium 6.1
Unvalidated input and lack of output encoding in the WP Customer Reviews WordPress plugin, versions before 3.4.3, lead to multiple Stored Cross-Site Scripting vulnerabilities allowing remote attackers to inject arbitrary JavaScript code or HTML.
Product
WP Customer Reviews
Fixed in
3.4.3
What to do
Update WP Customer Reviews to 3.4.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 1, 2020The issue was resolved by clearing application previews when content is deleted.CVE-2020-9780 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
The issue was resolved by clearing application previews when content is deleted. This issue is fixed in iOS 13.4 and iPadOS 13.4. A local user may be able to view deleted content in the app switcher.
Product
iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Feb 4, 2020Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.CVE-2020-8119 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.3
Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.
Product
Nextcloud Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Dec 18, 2019There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center.CVE-2019-15006 · Websites & servers · Atlassian · reported by security@atlassian.comMedium 6.5
There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence Data Center communicated with the Companion application via the atlassian-domain-for-localhost-connections-only.com domain name, the DNS A record of which points at 127.0.0.1. Additionally, a signed certificate for the domain was publicly distributed with the Companion application. An attacker in the position to control DNS resolution of their victim could carry out a man-in-the-middle (MITM) attack between Confluence Server (or Confluence Data Center) and the atlassian-domain-for-localhost-connections-only.com domain intended to be used with the Companion application. This certificate has been revoked, however, usage of the atlassian-domain-for-localhost-connections-only.com domain name was still present in Confluence Server and Confluence Data Center. An attacker could perform the described attack by denying their victim access to certificate revocation information, and carry out a man
Product
Confluence Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com confluence.atlassian.com
Dec 18, 2019A logic issue existed with the display of notification previews.CVE-2019-8711 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.3
A logic issue existed with the display of notification previews. This issue was addressed with improved validation. This issue is fixed in iOS 13. Notification previews may show on Bluetooth accessories even when previews are disabled.
Product
iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Oct 23, 2019The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1CVE-2015-9526 · WordPress plugins & themes · reported by MITREMedium 6.1
The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Fixed in
1.8.7
What to do
Update the plugin to 1.8.7 or newer.
Full record and what to do →NVD record web.archive.org web.archive.org
Oct 2, 2019mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by an attacker, because an unpickle occurs.CVE-2019-17080 · Computers, phones & browsers · Linuxmint · reported by MITREHigh 7.8
mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by an attacker, because an unpickle occurs. This is resolved in 8.0.0 and backports.
Product
Mintinstall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com forums.linuxmint.com
Sep 11, 2019WordPress before 5.2.3 allows XSS in post previews by authenticated users.CVE-2019-16223 · WordPress plugins & themes · reported by MITREMedium 5.4
WordPress before 5.2.3 allows XSS in post previews by authenticated users.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record packetstormsecurity.com lists.debian.org
Sep 11, 2019WordPress before 5.2.3 allows XSS in shortcode previews.CVE-2019-16219 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 5.2.3 allows XSS in shortcode previews.
Fixed in
5.2.3
What to do
Update the plugin to 5.2.3 or newer.
Full record and what to do →NVD record fortiguard.com lists.debian.org
Aug 26, 2019The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js.CVE-2019-15560 · Other software · Reviews Module Project · reported by MITRECritical 9.8
The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js.
Product
Reviews Module
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 21, 2019The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.CVE-2016-10902 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
Product
wp-customer-reviews
Fixed in
3.0.9
What to do
Update wp-customer-reviews to 3.0.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.