Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,575 results · page 53 of 112
Jan 27, 2025WP Customer Area: Does not have CSRF checks in some placesCVE-2024-12436 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- WP Customer Area
- Affected
- up to 8.2.4
- What to do
- Affects up to 8.2.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WC Affiliate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12321 · WordPress plugins & themes · reported by WPScanHigh 7.1
The WC Affiliate WordPress plugin through 2.3.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- WC Affiliate
- Affected
- up to 2.3.9
- What to do
- Affects up to 2.3.9. Update WC Affiliate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025WP Customer Area: Does not have CSRF check in placeCVE-2024-12280 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack
- Product
- WP Customer Area
- Affected
- up to 8.2.4
- What to do
- Affects up to 8.2.4. Update WP Customer Area to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 18, 2025List category posts: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-9020 · WordPress plugins & themes · reported by WPScanMedium 5.4
The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- List category posts
- Fixed in
- 0.90.3
- What to do
- Update List category posts to 0.90.3 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its Workflow settingsCVE-2024-12568 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its form settingsCVE-2024-12567 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of form settingsCVE-2024-12566 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 13, 2025Email Subscribers by Icegram Express: Does not sanitise and escape some of its Text Block optionsCVE-2024-11636 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.45
- What to do
- Update Email Subscribers by Icegram Express to 5.7.45 or newer.
Jan 11, 2025Contact Form Master: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12587 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Contact Form Master
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Contact Form Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025BU Section Editing: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12736 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BU Section Editing WordPress plugin through 0.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- BU Section Editing
- Affected
- up to 0.9.9
- What to do
- Affects up to 0.9.9. Update BU Section Editing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Aklamator INfeed: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12731 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Aklamator INfeed
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Aklamator INfeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Aklamator INfeed: Does not sanitise and escape some of its settingsCVE-2024-12717 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Aklamator INfeed
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Aklamator INfeed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Asgard Security Scanner: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12715 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Asgard Security Scanner WordPress plugin through 0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Asgard Security Scanner
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Asgard Security Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025Backlink Monitoring Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12714 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Backlink Monitoring Manager WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Backlink Monitoring Manager
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Backlink Monitoring Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025PostLists: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-10815 · WordPress plugins & themes · reported by WPScanMedium 4.2
The PostLists WordPress plugin through 2.0.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- PostLists
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update PostLists to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2025Property Hive: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12585 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Property Hive
- Fixed in
- 2.1.1
- What to do
- Update Property Hive to 2.1.1 or newer.
Jan 8, 2025Auto iFrame: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-10151 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Auto iFrame
- Fixed in
- 2.0
- What to do
- Update Auto iFrame to 2.0 or newer.
Jan 7, 2025Category Posts Widget: Does not sanitise and escape some of its settingsCVE-2024-9638 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Category Posts Widget
- Fixed in
- 4.9.18
- What to do
- Update Category Posts Widget to 4.9.18 or newer.
Jan 7, 2025WordPress Auction: Does not sanitise and escape some of its settingsCVE-2024-8857 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks.
- Product
- WordPress Auction
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WordPress Auction: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-8855 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks
- Product
- WordPress Auction
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Tabs Shortcode: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11606 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Tabs Shortcode
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Tabs Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10562 · WordPress plugins & themes · reported by WPScanLow 2.7
The Form Maker by 10Web WordPress plugin before 1.15.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.31
- What to do
- Update Form Maker by 10Web to 1.15.31 or newer.
Jan 7, 2025Photo Gallery, Images, Slider in Rbs Image Gallery: Does not sanitise and escape some of its Gallery settingsCVE-2024-10102 · WordPress plugins & themes · reported by WPScanLow 2.7
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Fixed in
- 3.2.22
- What to do
- Update Photo Gallery, Images, Slider in Rbs Image Gallery to 3.2.22 or newer.
Jan 6, 2025Email Subscribers by Icegram Express: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12311 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Email Subscribers by Icegram Express
- Fixed in
- 5.7.44
- What to do
- Update Email Subscribers by Icegram Express to 5.7.44 or newer.
Jan 6, 2025Icegram Engage: Does not sanitise and escape some of its Campaign settingsCVE-2024-12302 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks
- Product
- Icegram Engage
- Fixed in
- 3.1.32
- What to do
- Update Icegram Engage to 3.1.32 or newer.
Jan 6, 2025Pods: Does not sanitise and escape some of its settingsCVE-2024-11849 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pods WordPress plugin before 3.2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pods
- Fixed in
- 3.2.8.1
- What to do
- Update Pods to 3.2.8.1 or newer.
Jan 6, 2025tourmaster: Does not sanitise and escape some parametersCVE-2024-11356 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.
- Product
- tourmaster
- Fixed in
- 5.3.4
- What to do
- Update tourmaster to 5.3.4 or newer.
Jan 2, 2025AHAthat: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-12595 · WordPress plugins & themes · reported by WPScanMedium 4.7
The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- AHAthat
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update AHAthat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025goodlayers-core: Does not sanitise and escape some of its settingsCVE-2024-11357 · WordPress plugins & themes · reported by WPScanMedium 5.9
The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- goodlayers-core
- Fixed in
- 2.0.10
- What to do
- Update goodlayers-core to 2.0.10 or newer.
Jan 2, 2025wp-enable-svg: Does not sanitize SVG filesCVE-2024-11184 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts
- Product
- wp-enable-svg
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update wp-enable-svg to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 1, 2025The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against higCVE-2024-11846 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 5.2.4
- What to do
- Update the plugin to 5.2.4 or newer.
Dec 31, 2024Hunk Companion: Does not correctly authorize some REST API endpointsCVE-2024-11972 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have been closed.
- Product
- Hunk Companion
- Fixed in
- 1.9.0
- What to do
- Update Hunk Companion to 1.9.0 or newer.
Dec 27, 2024GiveWP: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-11921 · WordPress plugins & themes · reported by WPScanMedium 4.8
The GiveWP WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- GiveWP
- Fixed in
- 3.19.0
- What to do
- Update GiveWP to 3.19.0 or newer.
Dec 27, 2024DN Shipping by Weight for WooCommerce: Does not have CSRF check in placeCVE-2024-11842 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- DN Shipping by Weight for WooCommerce
- Fixed in
- 1.2
- What to do
- Update DN Shipping by Weight for WooCommerce to 1.2 or newer.
Dec 27, 2024float block: Does not sanitise and escape some of its settingsCVE-2024-11645 · WordPress plugins & themes · reported by WPScanMedium 4.8
The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- float block
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update float block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 27, 2024WP-SVG: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11644 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- WP-SVG
- Affected
- up to 0.9
- What to do
- Affects up to 0.9. Update WP-SVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 27, 2024wp-publications: Does not escape filenames before outputting them back in the pageCVE-2024-11605 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- wp-publications
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update wp-publications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 26, 2024WPForms: Does not sanitise and escape some of its settingsCVE-2024-11223 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WPForms
- Fixed in
- 1.9.2.3
- What to do
- Update WPForms to 1.9.2.3 or newer.
Dec 26, 2024Broken Link Checker: Does not validate a the link URLs before making a request to themCVE-2024-10903 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
- Product
- Broken Link Checker
- Fixed in
- 2.4.2
- What to do
- Update Broken Link Checker to 2.4.2 or newer.
Dec 25, 2024Jetpack: Does not properly checks the postmessage origin in its 13CVE-2024-10858 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.
- Product
- Jetpack
- Fixed in
- 14.1
- What to do
- Update Jetpack to 14.1 or newer.
Dec 24, 2024Exhibit to WP Gallery: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12096 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Exhibit to WP Gallery WordPress plugin through 0.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Exhibit to WP Gallery
- Affected
- up to 0.0.2
- What to do
- Affects up to 0.0.2. Update Exhibit to WP Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 21, 2024GTPayment Donations: Does not have CSRF check in some placesCVE-2024-11607 · WordPress plugins & themes · reported by WPScanMedium 6.1
The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- GTPayment Donations
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update GTPayment Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 20, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some of its settingsCVE-2024-8968 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WordPress Button Plugin MaxButtons
- Fixed in
- 9.8.1
- What to do
- Update WordPress Button Plugin MaxButtons to 9.8.1 or newer.
Dec 20, 2024Serious Slider: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11108 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Serious Slider
- Fixed in
- 1.2.7
- What to do
- Update Serious Slider to 1.2.7 or newer.
Dec 20, 2024Download Manager: Does not sanitise and escape some of its settingsCVE-2024-10706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Download Manager
- Fixed in
- 3.3.03
- What to do
- Update Download Manager to 3.3.03 or newer.
Dec 20, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some of its settingsCVE-2024-10555 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WordPress Button Plugin MaxButtons
- Fixed in
- 9.8.1
- What to do
- Update WordPress Button Plugin MaxButtons to 9.8.1 or newer.
Dec 18, 2024Cost Calculator Builder: Does not have CSRF checks in some AJAX actionsCVE-2024-10892 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
- Product
- Cost Calculator Builder
- Fixed in
- 3.2.43
- What to do
- Update Cost Calculator Builder to 3.2.43 or newer.
Dec 16, 2024Tithe.ly Giving Button: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-11841 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Tithe.ly Giving Button
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Tithe.ly Giving Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Image Widget: Does not sanitise and escape some of its Image Widget settingsCVE-2024-10939 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Image Widget
- Fixed in
- 4.4.11
- What to do
- Update Image Widget to 4.4.11 or newer.
Dec 13, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-10678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.2.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Ultimate Blocks
- Fixed in
- 3.2.4
- What to do
- Update Ultimate Blocks to 3.2.4 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.