Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,575 results · page 55 of 112
Oct 30, 2024Download Manager: Doesn't sanitize some of it's shortcode parametersCVE-2024-8444 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting.
- Product
- Download Manager
- Fixed in
- 3.3.00
- What to do
- Update Download Manager to 3.3.00 or newer.
Oct 21, 2024TS Poll: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-8625 · WordPress plugins & themes · reported by WPScanHigh 7.2
The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- TS Poll
- Fixed in
- 2.4.0
- What to do
- Update TS Poll to 2.4.0 or newer.
Oct 17, 2024Logo Slider: Does not validate and escape some of its Slider Settings before outputting them back in attributesCVE-2024-5429 · WordPress plugins & themes · reported by WPScanHigh 7.6
The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 4.1.0
- What to do
- Update Logo Slider to 4.1.0 or newer.
Oct 10, 2024WP-Advanced-Search: Does not sanitize and escape the t parameter before using it in a SQL statementCVE-2024-9796 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
- Product
- WP-Advanced-Search
- Fixed in
- 3.3.9.2
- What to do
- Update WP-Advanced-Search to 3.3.9.2 or newer.
Oct 9, 2024Photo Gallery by 10Web: Does not properly sanitise and escape some of its Gallery settingsCVE-2024-5968 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Photo Gallery by 10Web WordPress plugin before 1.8.28 does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.8.28
- What to do
- Update Photo Gallery by 10Web to 1.8.28 or newer.
Oct 8, 2024Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to peCVE-2024-8983 · WordPress plugins & themes · reported by WPScanMedium 4.8
Custom Twitter Feeds WordPress plugin before 2.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Fixed in
- 2.2.3
- What to do
- Update the plugin to 2.2.3 or newer.
Oct 2, 2024Migration, Backup, Staging: Does not use sufficient randomness in the filename that is createdCVE-2024-7315 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Migration, Backup, Staging WordPress plugin before 0.9.106 does not use sufficient randomness in the filename that is created when generating a backup, which could be bruteforced by attackers to leak sensitive information about said backups.
- Product
- Migration, Backup, Staging
- Fixed in
- 0.9.106
- What to do
- Update Migration, Backup, Staging to 0.9.106 or newer.
Sep 30, 2024Ultimate Blocks: Does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embedCVE-2024-8536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Ultimate Blocks
- Fixed in
- 3.2.2
- What to do
- Update Ultimate Blocks to 3.2.2 or newer.
Sep 30, 2024Cost Calculator Builder: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-8379 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- Cost Calculator Builder
- Fixed in
- 3.2.29
- What to do
- Update Cost Calculator Builder to 3.2.29 or newer.
Sep 30, 2024Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-8283 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Slider by 10Web
- Fixed in
- 1.2.59
- What to do
- Update Slider by 10Web to 1.2.59 or newer.
Sep 30, 2024Starbox: Does not properly render social media profiles URLs in certain contextsCVE-2024-8239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role to conduct Stored XSS attacks.
- Product
- Starbox
- Fixed in
- 3.5.3
- What to do
- Update Starbox to 3.5.3 or newer.
Sep 30, 2024Post Grid: Does not sanitise and escape some of its Grid settingsCVE-2024-3635 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Post Grid
- Fixed in
- 7.5.0
- What to do
- Update Post Grid to 7.5.0 or newer.
Sep 26, 2024Contact Form 7 Math Captcha: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6517 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users.
- Product
- Contact Form 7 Math Captcha
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Contact Form 7 Math Captcha to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2024adstxt: Does not have CSRF check in placeCVE-2024-7892 · WordPress plugins & themes · reported by WPScanMedium 4.3
The adstxt Plugin WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- adstxt
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update adstxt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2024WP ULike: Does not sanitise and escape some of its settingsCVE-2024-7878 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP ULike
- Fixed in
- 4.7.4
- What to do
- Update WP ULike to 4.7.4 or newer.
Sep 25, 2024Chatbot with ChatGPT: Does not have proper authorization in one of its REST endpointCVE-2024-6845 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key
- Product
- Chatbot with ChatGPT
- Fixed in
- 2.4.6
- What to do
- Update Chatbot with ChatGPT to 2.4.6 or newer.
Sep 23, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-8758 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.1.3
- What to do
- Update Quiz and Survey Master (QSM) to 9.1.3 or newer.
Sep 17, 2024Posts reminder: Does not have CSRF check in placeCVE-2024-8093 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Posts reminder
- Affected
- up to 0.20
- What to do
- Affects up to 0.20. Update Posts reminder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Accordion Image Menu: Does not have CSRF check in some placesCVE-2024-8092 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Accordion Image Menu WordPress plugin through 3.1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Accordion Image Menu
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update Accordion Image Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Enhanced Search Box: Does not have CSRF check in placeCVE-2024-8091 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Search Box WordPress plugin through 0.6.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Enhanced Search Box
- Affected
- up to 0.6.1
- What to do
- Affects up to 0.6.1. Update Enhanced Search Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Review Ratings: Does not have CSRF check in some placesCVE-2024-8052 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Review Ratings WordPress plugin through 1.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Review Ratings
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Review Ratings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Special Feed Items: Does not have CSRF check in some placesCVE-2024-8051 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Special Feed Items
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Special Feed Items to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Visual Sound (old): Does not have CSRF check in placeCVE-2024-8047 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visual Sound (old) WordPress plugin through 1.06 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Visual Sound (old)
- Affected
- up to 1.06
- What to do
- Affects up to 1.06. Update Visual Sound (old) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024infolinks Ad Wrap: Does not have CSRF check in placeCVE-2024-8044 · WordPress plugins & themes · reported by WPScanMedium 6.5
The infolinks Ad Wrap WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- infolinks Ad Wrap
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update infolinks Ad Wrap to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Vikinghammer Tweet: Does not have CSRF check in some placesCVE-2024-8043 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Vikinghammer Tweet WordPress plugin through 0.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Vikinghammer Tweet
- Affected
- up to 0.2.4
- What to do
- Affects up to 0.2.4. Update Vikinghammer Tweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Logo Manager For Enamad: Does not sanitise and escape in its widgets settingsCVE-2024-5170 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Logo Manager For Enamad WordPress plugin through 0.7.1 does not sanitise and escape in its widgets settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Logo Manager For Enamad
- Affected
- up to 0.7.1
- What to do
- Affects up to 0.7.1. Update Logo Manager For Enamad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2024Favicon Generator (CLOSED): Does not have CSRF and path validation in the output_sub_admin_page_0() functionCVE-2024-7864 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server
- Product
- Favicon Generator (CLOSED)
- Fixed in
- 2.1
- What to do
- Update Favicon Generator (CLOSED) to 2.1 or newer.
Sep 13, 2024Favicon Generator (CLOSED): Does not validate files to be uploaded and does not have CSRF checksCVE-2024-7863 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server
- Product
- Favicon Generator (CLOSED)
- Fixed in
- 2.1
- What to do
- Update Favicon Generator (CLOSED) to 2.1 or newer.
Sep 13, 2024Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not validate and escape some of its settings before outputting them back in the pageCVE-2024-7133 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputting them back in the page, which could allow users with a high role to perform Stored Cross-Site Scripting attacks.
- Product
- Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
- Fixed in
- 2.7.3
- What to do
- Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.7.3 or newer.
Sep 13, 2024Appointment Booking Calendar: Does not escape template syntax provided via user inputCVE-2024-7129 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user input, leading to Twig Template Injection which further exploited can result to remote code Execution by high privilege such as admins
- Product
- Appointment Booking Calendar
- Fixed in
- 1.6.7.43
- What to do
- Update Appointment Booking Calendar to 1.6.7.43 or newer.
Sep 13, 2024Carousel Slider: Does not sanitise and escape some of its settingsCVE-2024-6850 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Carousel Slider WordPress plugin before 2.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Carousel Slider
- Fixed in
- 2.2.4
- What to do
- Update Carousel Slider to 2.2.4 or newer.
Sep 13, 2024AI Engine: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-6723 · WordPress plugins & themes · reported by WPScanMedium 4.7
The AI Engine WordPress plugin before 2.4.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by admin users when viewing chatbot discussions.
- Product
- AI Engine
- Fixed in
- 2.4.8
- What to do
- Update AI Engine to 2.4.8 or newer.
Sep 13, 2024NinjaTeam Header Footer Custom Code: Does not sanitise and escape some of its settingsCVE-2024-6617 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- NinjaTeam Header Footer Custom Code
- Fixed in
- 1.2
- What to do
- Update NinjaTeam Header Footer Custom Code to 1.2 or newer.
Sep 13, 2024NinjaTeam Header Footer Custom Code: Does not sanitise and escape some of its settingsCVE-2024-6493 · WordPress plugins & themes · reported by WPScanMedium 4.8
The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- NinjaTeam Header Footer Custom Code
- Fixed in
- 1.2
- What to do
- Update NinjaTeam Header Footer Custom Code to 1.2 or newer.
Sep 12, 2024MM-Breaking News: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-8056 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- MM-Breaking News
- Affected
- up to 0.7.9
- What to do
- Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024MM-Breaking News: Does not have CSRF check in some placesCVE-2024-8054 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- MM-Breaking News
- Affected
- up to 0.7.9
- What to do
- Affects up to 0.7.9. Update MM-Breaking News to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024blogintroduction-wordpress-plugin: Does not have CSRF check in placeCVE-2024-7862 · WordPress plugins & themes · reported by WPScanMedium 6.5
The blogintroduction-wordpress-plugin WordPress plugin through 0.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- blogintroduction-wordpress-plugin
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update blogintroduction-wordpress-plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Paypal: Does not have CSRF check in some placesCVE-2024-7861 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Misiek Paypal WordPress plugin through 1.1.20090324 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Misiek Paypal
- Affected
- up to 1.1.20090324
- What to do
- Affects up to 1.1.20090324. Update Misiek Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Simple Headline Rotator: Does not have CSRF check in some placesCVE-2024-7860 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Simple Headline Rotator
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Simple Headline Rotator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Visual Sound: Does not have CSRF check in placeCVE-2024-7859 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Visual Sound
- Affected
- up to 1.03
- What to do
- Affects up to 1.03. Update Visual Sound to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Quick Code: Does not have CSRF check in some placesCVE-2024-7822 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quick Code WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Quick Code
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Quick Code to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024ILC Thickbox: Does not have CSRF check in placeCVE-2024-7820 · WordPress plugins & themes · reported by WPScanMedium 6.5
The ILC Thickbox WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- ILC Thickbox
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update ILC Thickbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Photo Album: Does not have CSRF check in some placesCVE-2024-7818 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Misiek Photo Album
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Misiek Photo Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Misiek Photo Album: Does not have CSRF checks in some placesCVE-2024-7817 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Misiek Photo Album WordPress plugin through 1.4.3 does not have CSRF checks in some places, which could allow attackers to make logged in users delete arbitrary albums via a CSRF attack
- Product
- Misiek Photo Album
- Affected
- up to 1.4.3
- What to do
- Affects up to 1.4.3. Update Misiek Photo Album to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Gixaw Chat: Does not have CSRF check in some placesCVE-2024-7816 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gixaw Chat WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Gixaw Chat
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Gixaw Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Adicon Server: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-7766 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Adicon Server WordPress plugin through 1.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Adicon Server
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Adicon Server to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Giveaways and Contests by RafflePress: Does not sanitise and escape some of its Giveaways settingsCVE-2024-6887 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, which could allow high privilege users such as editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.12.16
- What to do
- Update Giveaways and Contests by RafflePress to 1.12.16 or newer.
Sep 12, 2024Music Request Manager: Does not sanitise and escape incoming music requestsCVE-2024-6019 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators
- Product
- Music Request Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Music Request Manager: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-6018 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- Music Request Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 12, 2024Music Request Manager: Does not have CSRF check in some placesCVE-2024-6017 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Music Request Manager WordPress plugin through 1.3 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Music Request Manager
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update Music Request Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.