Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,575 results · page 57 of 112
Aug 6, 2024Light Poll: Does not have CSRF checks in some placesCVE-2024-6720 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Light Poll
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Light Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 6, 2024Ajax Search Lite: Does not sanitise and escape some parametersCVE-2024-7084 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks.
- Product
- Ajax Search Lite
- Fixed in
- 4.12.1
- What to do
- Update Ajax Search Lite to 4.12.1 or newer.
Aug 6, 2024Easy Table of Contents: Does not sanitise and escape some parametersCVE-2024-7082 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.
- Product
- Easy Table of Contents
- Fixed in
- 2.0.68
- What to do
- Update Easy Table of Contents to 2.0.68 or newer.
Aug 6, 2024shortcodes-ultimate-pro: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-6766 · WordPress plugins & themes · reported by WPScanMedium 5.4
The shortcodes-ultimate-pro WordPress plugin before 7.2.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- shortcodes-ultimate-pro
- Fixed in
- 7.2.1
- What to do
- Update shortcodes-ultimate-pro to 7.2.1 or newer.
Aug 6, 2024WordPress File Upload: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6651 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WordPress File Upload
- Fixed in
- 4.24.8
- What to do
- Update WordPress File Upload to 4.24.8 or newer.
Aug 5, 2024Ditty: Does not sanitise and escape some parametersCVE-2024-6710 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ditty WordPress plugin before 3.1.45 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Ditty
- Fixed in
- 3.1.45
- What to do
- Update Ditty to 3.1.45 or newer.
Aug 5, 2024Chatbot for WordPress by Collect.chat ⚡️: Does not sanitise and escape some of its settingsCVE-2024-6498 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Chatbot for WordPress by Collect.chat ⚡️ WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Chatbot for WordPress by Collect.chat ⚡️
- Fixed in
- 2.4.4
- What to do
- Update Chatbot for WordPress by Collect.chat ⚡️ to 2.4.4 or newer.
Aug 5, 2024Community Events: Does not sanitise and escape some of its settingsCVE-2024-6270 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Community Events
- Fixed in
- 1.5.1
- What to do
- Update Community Events to 1.5.1 or newer.
Aug 5, 2024wp-eMember: Does not have CSRF check in some placesCVE-2024-5081 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- wp-eMember
- Fixed in
- 10.7.0
- What to do
- Update wp-eMember to 10.7.0 or newer.
Aug 5, 2024Pinpoint Booking System: Does not sanitise and escape some of its settingsCVE-2024-3636 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Pinpoint Booking System
- Fixed in
- 2.9.9.4.8
- What to do
- Update Pinpoint Booking System to 2.9.9.4.8 or newer.
Aug 3, 2024Quiz and Survey Master (QSM): Does not properly sanitise and escape some of its Quizz settingsCVE-2024-6390 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.1.0
- What to do
- Update Quiz and Survey Master (QSM) to 9.1.0 or newer.
Aug 2, 2024Essential Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-5595 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Essential Blocks
- Fixed in
- 4.7.0
- What to do
- Update Essential Blocks to 4.7.0 or newer.
Aug 1, 2024Ultimate Classified Listings: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6529 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ultimate Classified Listings
- Fixed in
- 1.4
- What to do
- Update Ultimate Classified Listings to 1.4 or newer.
Aug 1, 2024Light Poll: Does not have CSRF checksCVE-2024-6496 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in users perform such action via a CSRF attack
- Product
- Light Poll
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Light Poll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any: Does not sanitise and escape some of its settingsCVE-2024-4090 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any
- Fixed in
- 2.7.2
- What to do
- Update Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any to 2.7.2 or newer.
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some bulk actionsCVE-2024-3983 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.1
- What to do
- Update WooCommerce Customers Manager to 30.1 or newer.
Aug 1, 2024socialdriver-framework: Does not sanitise and escape some of its settingsCVE-2024-2872 · WordPress plugins & themes · reported by WPScanMedium 4.8
The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- socialdriver-framework
- Fixed in
- 2024.04.30
- What to do
- Update socialdriver-framework to 2024.04.30 or newer.
Aug 1, 2024WooCommerce Customers Manager: Does not have CSRF checks in some placesCVE-2024-2843 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.1
- What to do
- Update WooCommerce Customers Manager to 30.1 or newer.
Aug 1, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in various AJAX actionsCVE-2024-1747 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
- Product
- WooCommerce Customers Manager
- Fixed in
- 30.2
- What to do
- Update WooCommerce Customers Manager to 30.2 or newer.
Jul 31, 2024HTML Forms: Does not have CSRF checks in some placesCVE-2024-6412 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HTML Forms WordPress plugin before 1.3.34 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- HTML Forms
- Fixed in
- 1.3.34
- What to do
- Update HTML Forms to 1.3.34 or newer.
Jul 31, 2024Slider by 10Web: Does not sanitise and escape its Slider TitleCVE-2024-6408 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Slider by 10Web
- Fixed in
- 1.2.57
- What to do
- Update Slider by 10Web to 1.2.57 or newer.
Jul 31, 2024SpiderContacts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- SpiderContacts
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update SpiderContacts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 31, 2024WANotifier: Does not sanitise and escape some of its settingsCVE-2024-6165 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WANotifier
- Fixed in
- 2.6.1
- What to do
- Update WANotifier to 2.6.1 or newer.
Jul 30, 2024Zephyr Project Manager: Does not sanitise and escape some of its settingsCVE-2024-6536 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Zephyr Project Manager
- Fixed in
- 3.3.99
- What to do
- Update Zephyr Project Manager to 3.3.99 or newer.
Jul 30, 2024پلاگین پرداخت دلخواه: Does not have CSRF check in placeCVE-2024-6230 · WordPress plugins & themes · reported by WPScanMedium 6.5
The پلاگین پرداخت دلخواه WordPress plugin through 2.9.8 does not have CSRF check in place when resetting its form fields, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- پلاگین پرداخت دلخواه
- Affected
- up to 2.9.8
- What to do
- Affects up to 2.9.8. Update پلاگین پرداخت دلخواه to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WpStickyBar: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6226 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WpStickyBar WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WpStickyBar
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Send email only on Reply to My Comment: Does not have CSRF check in some placesCVE-2024-6224 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Send email only on Reply to My Comment
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Send email only on Reply to My Comment: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6223 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Send email only on Reply to My Comment
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Donation Block For PayPal: Does not sanitise and escape form submissionsCVE-2024-6021 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site scripting vulnerability
- Product
- Donation Block For PayPal
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Donation Block For PayPal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024CZ Loan Management: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5975 · WordPress plugins & themes · reported by WPScanCritical 9.1
The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- CZ Loan Management
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update CZ Loan Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WP Ajax Contact Form: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5809 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users
- Product
- WP Ajax Contact Form
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WP Ajax Contact Form: Does not have CSRF check in placeCVE-2024-5808 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Ajax Contact Form WordPress plugin through 2.2.2 does not have CSRF check in place when deleting emails from the email list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- WP Ajax Contact Form
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update WP Ajax Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Business Card: Does not prevent high privilege users like administrators from uploading malicious PHP filesCVE-2024-5807 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Business Card WordPress plugin through 1.0.0 does not prevent high privilege users like administrators from uploading malicious PHP files, which could allow them to run arbitrary code on servers hosting their site, even in MultiSite configurations.
- Product
- Business Card
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Business Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024WpStickyBar: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-5765 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- WpStickyBar
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update WpStickyBar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Responsive Tabs: Does not sanitise and escape some of its Tab settingsCVE-2024-4096 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Responsive Tabs WordPress plugin through 4.0.8 does not sanitise and escape some of its Tab settings, which could allow high privilege users such as Contributors and above to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Tabs
- Affected
- up to 4.0.8
- What to do
- Affects up to 4.0.8. Update Responsive Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024SportsPress: Does not sanitise and escape some of its settingsCVE-2024-3986 · WordPress plugins & themes · reported by WPScanMedium 4.8
The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SportsPress
- Fixed in
- 2.7.22
- What to do
- Update SportsPress to 2.7.22 or newer.
Jul 30, 2024Web Directory Free: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3669 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Web Directory Free
- Fixed in
- 1.7.2
- What to do
- Update Web Directory Free to 1.7.2 or newer.
Jul 30, 2024FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection: Does not sanitise and escape some of its settingsCVE-2024-3113 · WordPress plugins & themes · reported by WPScanMedium 5.9
The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection
- Fixed in
- 2.12.2
- What to do
- Update FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection to 2.12.2 or newer.
Jul 30, 2024pmpro-member-directory: Does not prevent users with at least the contributor role from leaking other users' sensitive informationCVE-2024-1287 · WordPress plugins & themes · reported by WPScanMedium 6.5
The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.
- Product
- pmpro-member-directory
- Fixed in
- 1.2.6
- What to do
- Update pmpro-member-directory to 1.2.6 or newer.
Jul 30, 2024pmpro-membership-maps: Does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the siteCVE-2024-1286 · WordPress plugins & themes · reported by WPScanMedium 4.9
The pmpro-membership-maps WordPress plugin before 0.7 does not prevent users with at least the contributor role from leaking sensitive information about users with a membership on the site.
- Product
- pmpro-membership-maps
- Fixed in
- 0.7
- What to do
- Update pmpro-membership-maps to 0.7 or newer.
Jul 29, 2024Inline Related Posts: Does not sanitise and escape some of its settingsCVE-2024-6487 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Inline Related Posts
- Fixed in
- 3.8.0
- What to do
- Update Inline Related Posts to 3.8.0 or newer.
Jul 29, 2024User Profile Builder: Does not have proper authorisationCVE-2024-6366 · WordPress plugins & themes · reported by WPScanCritical 9.1
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
- Product
- User Profile Builder
- Fixed in
- 3.11.8
- What to do
- Update User Profile Builder to 3.11.8 or newer.
Jul 29, 2024Ultimate Blocks: Does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embedCVE-2024-6362 · WordPress plugins & themes · reported by WPScanMedium 4.6
The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Ultimate Blocks
- Fixed in
- 3.2.0
- What to do
- Update Ultimate Blocks to 3.2.0 or newer.
Jul 29, 2024Ultimate Classified Listings: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5883 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Classified Listings WordPress plugin before 1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ultimate Classified Listings
- Fixed in
- 1.3
- What to do
- Update Ultimate Classified Listings to 1.3 or newer.
Jul 29, 2024The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PCVE-2024-5882 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ultimate Classified Listings WordPress plugin before 1.3 does not validate the `ucl_page` and `layout` parameters allowing unauthenticated users to access PHP files on the server from the listings page
- Product
- Ultimate Classified Listings
- Fixed in
- 1.3
- What to do
- Update Ultimate Classified Listings to 1.3 or newer.
Jul 29, 2024wp-affiliate-platform: Does not have CSRF check in placeCVE-2024-5285 · WordPress plugins & themes · reported by WPScanMedium 5.5
The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logged in user change delete them via a CSRF attack
- Product
- wp-affiliate-platform
- Fixed in
- 6.5.2
- What to do
- Update wp-affiliate-platform to 6.5.2 or newer.
Jul 29, 2024Email Encoder: Does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin pageCVE-2024-4483 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting
- Product
- Email Encoder
- Fixed in
- 2.2.2
- What to do
- Update Email Encoder to 2.2.2 or newer.
Jul 24, 2024WP ULike: Does not sanitise and escape some of its settingsCVE-2024-6094 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP ULike WordPress plugin before 4.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP ULike
- Fixed in
- 4.7.1
- What to do
- Update WP ULike to 4.7.1 or newer.
Jul 23, 2024Hide My WP Ghost: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2024-6420 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
- Product
- Hide My WP Ghost
- Fixed in
- 5.2.02
- What to do
- Update Hide My WP Ghost to 5.2.02 or newer.
Jul 23, 2024Request a Quote: Does not sanitise and escape some of its settingsCVE-2024-6231 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Request a Quote
- Fixed in
- 2.4.1
- What to do
- Update Request a Quote to 2.4.1 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.