Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,575 results · page 56 of 112
Sep 12, 2024CM Pop-Up Banners for: Does not sanitise and escape some of its popup fieldsCVE-2024-5799 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Pop-Up Banners for WordPress plugin before 1.7.3 does not sanitise and escape some of its popup fields, which could allow high privilege users such as Contributors to perform Cross-Site Scripting attacks.
- Product
- CM Pop-Up Banners for
- Fixed in
- 1.7.3
- What to do
- Update CM Pop-Up Banners for to 1.7.3 or newer.
Sep 12, 2024Easy Property Listings: Does not have CSRF checkCVE-2024-3163 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Easy Property Listings
- Fixed in
- 3.5.4
- What to do
- Update Easy Property Listings to 3.5.4 or newer.
Sep 11, 2024Logo Slider: Does not sanitise and escape some of its settingsCVE-2024-7716 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Logo Slider WordPress plugin before 3.6.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Logo Slider
- Fixed in
- 3.6.9
- What to do
- Update Logo Slider to 3.6.9 or newer.
Sep 11, 2024Gallery Plugin for WordPress: Does not sanitise and escape some of its image settingsCVE-2024-3899 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks.
- Product
- Gallery Plugin for WordPress
- Fixed in
- 1.8.15
- What to do
- Update Gallery Plugin for WordPress to 1.8.15 or newer.
Sep 10, 2024Starbox: Does not sanitise and escape some of its settingsCVE-2024-7955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Starbox
- Fixed in
- 3.5.2
- What to do
- Update Starbox to 3.5.2 or newer.
Sep 10, 2024Floating Contact Button: Does not sanitise and escape some of its settingsCVE-2024-7891 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Contact Button WordPress plugin before 2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Floating Contact Button
- Fixed in
- 2.8
- What to do
- Update Floating Contact Button to 2.8 or newer.
Sep 9, 2024Pocket Widget: Does not sanitise and escape some of its settingsCVE-2024-7918 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Pocket Widget WordPress plugin through 0.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Pocket Widget
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Pocket Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024Snapshot Backup: Does not have CSRF check in some placesCVE-2024-7689 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- Snapshot Backup
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update Snapshot Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024AZIndex: Does not have CSRF checks in some placesCVE-2024-7688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The AZIndex WordPress plugin through 0.8.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin delete arbitrary indexes via a CSRF attack
- Product
- AZIndex
- Affected
- up to 0.8.1
- What to do
- Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024AZIndex: Does not have CSRF check in some placesCVE-2024-7687 · WordPress plugins & themes · reported by WPScanMedium 4.3
The AZIndex WordPress plugin through 0.8.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- AZIndex
- Affected
- up to 0.8.1
- What to do
- Affects up to 0.8.1. Update AZIndex to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2024EventON: Does not sanitise and escape some of its settingsCVE-2024-6910 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- EventON
- Fixed in
- 2.2.17
- What to do
- Update EventON to 2.2.17 or newer.
Sep 9, 2024Popup Maker: Does not sanitise and escape some of its settingsCVE-2024-5561 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup Maker WordPress plugin before 1.19.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Popup Maker
- Fixed in
- 1.19.1
- What to do
- Update Popup Maker to 1.19.1 or newer.
Sep 8, 2024Opti Marketing: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6928 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Opti Marketing
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update Opti Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024TrueBooker: Does not have CSRF check in placeCVE-2024-6925 · WordPress plugins & themes · reported by WPScanMedium 4.3
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
- Product
- TrueBooker
- Fixed in
- 1.0.3
- What to do
- Update TrueBooker to 1.0.3 or newer.
Sep 8, 2024TrueBooker: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6924 · WordPress plugins & themes · reported by WPScanCritical 9.8
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- TrueBooker
- Fixed in
- 1.0.3
- What to do
- Update TrueBooker to 1.0.3 or newer.
Sep 8, 2024WP MultiTasking: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6859 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6856 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF checkCVE-2024-6855 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF checkCVE-2024-6853 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 8, 2024WP MultiTasking: Does not have CSRF check in placeCVE-2024-6852 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP MultiTasking
- Affected
- up to 0.1.12
- What to do
- Affects up to 0.1.12. Update WP MultiTasking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2024WP ULike: Does not properly sanitize user display namesCVE-2024-6792 · WordPress plugins & themes · reported by WPScanLow 3.5
The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.
- Product
- WP ULike
- Fixed in
- 4.7.2.1
- What to do
- Update WP ULike to 4.7.2.1 or newer.
Sep 5, 2024Chatbot with ChatGPT: Does not validate access on some REST routesCVE-2024-6846 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs
- Product
- Chatbot with ChatGPT
- Fixed in
- 2.4.5
- What to do
- Update Chatbot with ChatGPT to 2.4.5 or newer.
Sep 4, 2024Sensei LMS: Does not properly protect some its REST API routesCVE-2024-7786 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.
- Product
- Sensei LMS
- Fixed in
- 4.24.2
- What to do
- Update Sensei LMS to 4.24.2 or newer.
Sep 4, 2024Viral Signup: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-6926 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Viral Signup
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Viral Signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 4, 2024Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2024-6889 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Secure Copy Content Protection and Content Locking
- Fixed in
- 4.1.7
- What to do
- Update Secure Copy Content Protection and Content Locking to 4.1.7 or newer.
Sep 4, 2024Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2024-6888 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Secure Copy Content Protection and Content Locking
- Fixed in
- 4.1.7
- What to do
- Update Secure Copy Content Protection and Content Locking to 4.1.7 or newer.
Sep 4, 2024Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot: Does not sanitise and escape some of its settingsCVE-2024-6722 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatbot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 4, 2024Sign-up Sheets: Does not escape some generated URLsCVE-2024-6020 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Sign-up Sheets WordPress plugin before 2.2.13 does not escape some generated URLs, as well as the $_SERVER['REQUEST_URI'] parameter before outputting them back in attributes, which could lead to Reflected Cross-Site Scripting.
- Product
- Sign-up Sheets
- Fixed in
- 2.2.13
- What to do
- Update Sign-up Sheets to 2.2.13 or newer.
Sep 2, 2024Flaming Forms: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-7692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Flaming Forms
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2024Flaming Forms: Does not sanitise and escape some parametersCVE-2024-7691 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Flaming Forms WordPress plugin through 1.0.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators.
- Product
- Flaming Forms
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Flaming Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2024DN Popup: Does not have CSRF check in placeCVE-2024-7690 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- DN Popup
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update DN Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2024Ninja Forms: Does not escape an URL before outputting it back in an attributeCVE-2024-7354 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ninja Forms
- Fixed in
- 3.8.11
- What to do
- Update Ninja Forms to 3.8.11 or newer.
Aug 30, 2024Web Directory Free: Does not validate a parameter before using it in an include()CVE-2024-3673 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.
- Product
- Web Directory Free
- Fixed in
- 1.7.3
- What to do
- Update Web Directory Free to 1.7.3 or newer.
Aug 29, 2024Page Builder Gutenberg Blocks: Does not escape the content of post embed via one of its blockCVE-2024-7132 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts (editor and admin by default) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Page Builder Gutenberg Blocks
- Fixed in
- 3.1.13
- What to do
- Update Page Builder Gutenberg Blocks to 3.1.13 or newer.
Aug 29, 2024Viral Signup: Does not sanitise and escape some of its settingsCVE-2024-6927 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Viral Signup WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Viral Signup
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Viral Signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024Gutentor: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-5417 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Gutentor
- Fixed in
- 3.3.6
- What to do
- Update Gutentor to 3.3.6 or newer.
Aug 26, 2024Shield Security: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-7313 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shield Security WordPress plugin before 20.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Shield Security
- Fixed in
- 20.0.6
- What to do
- Update Shield Security to 20.0.6 or newer.
Aug 23, 2024WP Table Builder: Does not sanitise and escape some of its Table dataCVE-2024-3282 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Table Builder WordPress plugin through 1.5.0 does not sanitise and escape some of its Table data, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Table Builder
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update WP Table Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2024Chatbot with ChatGPT: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-6847 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot.
- Product
- Chatbot with ChatGPT
- Fixed in
- 2.4.5
- What to do
- Update Chatbot with ChatGPT to 2.4.5 or newer.
Aug 19, 2024Chatbot with ChatGPT: Does not sanitise and escape user inputsCVE-2024-6843 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not sanitise and escape user inputs, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
- Product
- Chatbot with ChatGPT
- Fixed in
- 2.4.5
- What to do
- Update Chatbot with ChatGPT to 2.4.5 or newer.
Aug 19, 2024GEO my WP: Does not prevent unauthenticated attackers from including arbitrary files in PHP's execution contextCVE-2024-6330 · WordPress plugins & themes · reported by WPScanCritical 9.8
The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution.
- Product
- GEO my WP
- Fixed in
- 4.5.0.2
- What to do
- Update GEO my WP to 4.5.0.2 or newer.
Aug 13, 2024Generate Images: Does not sanitise and escape some of its settingsCVE-2024-6724 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Generate Images WordPress plugin before 5.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Generate Images
- Fixed in
- 5.2.8
- What to do
- Update Generate Images to 5.2.8 or newer.
Aug 12, 2024Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget: Does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the WCVE-2024-6158 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validate and escape some of its "Category Posts" widget settings before outputting them back in a page/post where the Widget is embed, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget
- Fixed in
- 4.9.17
- What to do
- Update Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget to 4.9.17 or newer.
Aug 12, 2024wp-cart-for-digital-products: Does not have CSRF checks in some placesCVE-2024-6136 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- wp-cart-for-digital-products
- Fixed in
- 8.5.6
- What to do
- Update wp-cart-for-digital-products to 8.5.6 or newer.
Aug 12, 2024wp-cart-for-digital-products: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6134 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- wp-cart-for-digital-products
- Fixed in
- 8.5.6
- What to do
- Update wp-cart-for-digital-products to 8.5.6 or newer.
Aug 12, 2024wp-cart-for-digital-products: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6133 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wp-cart-for-digital-products WordPress plugin before 8.5.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- wp-cart-for-digital-products
- Fixed in
- 8.5.6
- What to do
- Update wp-cart-for-digital-products to 8.5.6 or newer.
Aug 8, 2024Gutenberg Blocks with AI by Kadence WP: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-6884 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutenberg Blocks with AI by Kadence WP WordPress plugin before 3.2.39 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Gutenberg Blocks with AI by Kadence WP
- Fixed in
- 3.2.39
- What to do
- Update Gutenberg Blocks with AI by Kadence WP to 3.2.39 or newer.
Aug 8, 2024Search & Filter Pro: Does not sanitise and escape some of its settingsCVE-2024-6481 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Search & Filter Pro WordPress plugin before 2.5.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Search & Filter Pro
- Fixed in
- 2.5.18
- What to do
- Update Search & Filter Pro to 2.5.18 or newer.
Aug 7, 2024WordPress File Upload: Does not properly sanitize and escape certain parametersCVE-2024-6494 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.
- Product
- WordPress File Upload
- Fixed in
- 4.24.8
- What to do
- Update WordPress File Upload to 4.24.8 or newer.
Aug 7, 2024House Manager: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3973 · WordPress plugins & themes · reported by WPScanMedium 4.8
The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- House Manager
- Affected
- up to 1.0.8.4
- What to do
- Affects up to 1.0.8.4. Update House Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.