Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,575 results · page 59 of 112
Jul 13, 2024Embed Peertube Playlist: Does not sanitise and escape some of its settingsCVE-2024-4602 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Embed Peertube Playlist WordPress plugin before 1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Embed Peertube Playlist
- Fixed in
- 1.10
- What to do
- Update Embed Peertube Playlist to 1.10 or newer.
Jul 13, 2024Support SVG: Does not sanitize SVG file contentsCVE-2024-4272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Support SVG WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
- Product
- Support SVG
- Fixed in
- 1.1.0
- What to do
- Update Support SVG to 1.1.0 or newer.
Jul 13, 2024SVG Block: Does not sanitize SVG file contentsCVE-2024-4269 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
- Product
- SVG Block
- Fixed in
- 1.1.20
- What to do
- Update SVG Block to 1.1.20 or newer.
Jul 13, 2024shortcodes-ultimate-pro: Does not properly escape some of its shortcodes' settingsCVE-2024-4217 · WordPress plugins & themes · reported by WPScanMedium 4.7
The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for attackers with a Contributor account to conduct Stored XSS attacks.
- Product
- shortcodes-ultimate-pro
- Fixed in
- 7.1.5
- What to do
- Update shortcodes-ultimate-pro to 7.1.5 or newer.
Jul 13, 2024Product Enquiry for WooCommerce: Does not sanitise and escape some of its settingsCVE-2024-3964 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Product Enquiry for WooCommerce WordPress plugin before 3.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Product Enquiry for WooCommerce
- Fixed in
- 3.1.8
- What to do
- Update Product Enquiry for WooCommerce to 3.1.8 or newer.
Jul 13, 2024Giveaways and Contests by RafflePress: Does not sanitise and escape some parametersCVE-2024-3963 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.14 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
- Product
- Giveaways and Contests by RafflePress
- Fixed in
- 1.12.14
- What to do
- Update Giveaways and Contests by RafflePress to 1.12.14 or newer.
Jul 13, 2024OpenPGP Form Encryption for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3919 · WordPress plugins & themes · reported by WPScanMedium 4.6
The OpenPGP Form Encryption for WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- OpenPGP Form Encryption for
- Fixed in
- 1.5.1
- What to do
- Update OpenPGP Form Encryption for to 1.5.1 or newer.
Jul 13, 2024Hostel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3753 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Hostel
- Fixed in
- 1.1.5.3
- What to do
- Update Hostel to 1.1.5.3 or newer.
Jul 13, 2024Seriously Simple Podcasting: Does not sanitise and escape some of its settingsCVE-2024-3751 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Seriously Simple Podcasting WordPress plugin before 3.3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Seriously Simple Podcasting
- Fixed in
- 3.3.0
- What to do
- Update Seriously Simple Podcasting to 3.3.0 or newer.
Jul 13, 2024Image Photo Gallery Final Tiles Grid: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-3710 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Image Photo Gallery Final Tiles Grid
- Fixed in
- 3.6.0
- What to do
- Update Image Photo Gallery Final Tiles Grid to 3.6.0 or newer.
Jul 13, 2024Smart Image Gallery: Does not have CSRF check in placeCVE-2024-3632 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Smart Image Gallery
- Fixed in
- 1.0.19
- What to do
- Update Smart Image Gallery to 1.0.19 or newer.
Jul 13, 2024WordPress Button Plugin MaxButtons: Does not sanitise and escape some parametersCVE-2024-3026 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Button Plugin MaxButtons WordPress plugin before 9.7.8 does not sanitise and escape some parameters, which could allow users with a role as low as editor to perform Cross-Site Scripting attacks
- Product
- WordPress Button Plugin MaxButtons
- Fixed in
- 9.7.8
- What to do
- Update WordPress Button Plugin MaxButtons to 9.7.8 or newer.
Jul 13, 2024socialdriver-framework: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-2870 · WordPress plugins & themes · reported by WPScanMedium 6.1
The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- socialdriver-framework
- Fixed in
- 2024.04.30
- What to do
- Update socialdriver-framework to 2024.04.30 or newer.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6024 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged in admin remove them via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6023 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6022 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2024Simple Video Directory: Does not sanitise and escape some of its settingsCVE-2024-5811 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Simple Video Directory WordPress plugin before 1.4.4 does not sanitise and escape some of its settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Simple Video Directory
- Fixed in
- 1.4.4
- What to do
- Update Simple Video Directory to 1.4.4 or newer.
Jul 12, 2024Inline Related Posts: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5626 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Inline Related Posts WordPress plugin before 3.7.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Inline Related Posts
- Fixed in
- 3.7.0
- What to do
- Update Inline Related Posts to 3.7.0 or newer.
Jul 12, 2024WP Secure Maintenance: Does not sanitise and escape some of its settingsCVE-2024-4753 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Secure Maintenance
- Fixed in
- 1.7
- What to do
- Update WP Secure Maintenance to 1.7 or newer.
Jul 12, 2024Quotes and Tips by BestWebSoft: Does not properly validate image files uploadedCVE-2024-3112 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- Quotes and Tips by BestWebSoft
- Fixed in
- 1.45
- What to do
- Update Quotes and Tips by BestWebSoft to 1.45 or newer.
Jul 12, 2024socialdriver-framework: Does not sanitise and escape some of its settingsCVE-2024-2696 · WordPress plugins & themes · reported by WPScanMedium 4.8
The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- socialdriver-framework
- Fixed in
- 2024.04.30
- What to do
- Update socialdriver-framework to 2024.04.30 or newer.
Jul 12, 2024Watu Quiz: Does not sanitise and escape some of its settingsCVE-2024-2640 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Watu Quiz WordPress plugin before 3.4.1.2 does not sanitise and escape some of its settings, which could allow users such as authors (if they've been authorized by admins) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Watu Quiz
- Fixed in
- 3.4.1.2
- What to do
- Update Watu Quiz to 3.4.1.2 or newer.
Jul 12, 2024Website Content in Page or Post: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2430 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Website Content in Page or Post
- Fixed in
- 2024.04.09
- What to do
- Update Website Content in Page or Post to 2024.04.09 or newer.
Jul 12, 2024Social Media Widget: Does not sanitise and escape some of its settingsCVE-2024-0974 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Media Widget
- Fixed in
- 4.0.9
- What to do
- Update Social Media Widget to 4.0.9 or newer.
Jul 11, 2024Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2024-6138 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Secure Copy Content Protection and Content Locking
- Fixed in
- 4.0.9
- What to do
- Update Secure Copy Content Protection and Content Locking to 4.0.9 or newer.
Jul 11, 2024Slider by 10Web: Does not sanitise and escape some of its Slide optionsCVE-2024-6026 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Slider by 10Web WordPress plugin before 1.2.56 does not sanitise and escape some of its Slide options, which could allow authenticated users with access to the Sliders (by default Administrator, however this can be changed via the Slider by 10Web WordPress plugin before 1.2.56's options) and the ability to add images (Editor+) to perform Stored Cross-Site Scripting attacks
- Product
- Slider by 10Web
- Fixed in
- 1.2.56
- What to do
- Update Slider by 10Web to 1.2.56 or newer.
Jul 11, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its Quiz settingsCVE-2024-6025 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.5 does not sanitise and escape some of its Quiz settings, which could allow contributors and higher to perform Stored Cross-Site Scripting attacks
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.5
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.5 or newer.
Jul 11, 2024Bible Text: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-5444 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Bible Text WordPress plugin through 0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Bible Text
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update Bible Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 11, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-4655 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Ultimate Blocks
- Fixed in
- 3.1.9
- What to do
- Update Ultimate Blocks to 3.1.9 or newer.
Jul 11, 2024VikRentCar Car Rental Management System: Does not have CSRF checks in some placesCVE-2024-1845 · WordPress plugins & themes · reported by WPScanHigh 8.8
The VikRentCar Car Rental Management System WordPress plugin before 1.3.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- VikRentCar Car Rental Management System
- Fixed in
- 1.3.2
- What to do
- Update VikRentCar Car Rental Management System to 1.3.2 or newer.
Jul 9, 2024Easy Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-6334 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Easy Table of Contents
- Fixed in
- 2.0.67.1
- What to do
- Update Easy Table of Contents to 2.0.67.1 or newer.
Jul 9, 2024URL Shortener by Myhop: Does not sanitise and escape some of its settingsCVE-2024-5802 · WordPress plugins & themes · reported by WPScanMedium 4.8
The URL Shortener by Myhop WordPress plugin through 1.0.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- URL Shortener by Myhop
- Affected
- up to 1.0.17
- What to do
- Affects up to 1.0.17. Update URL Shortener by Myhop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 9, 2024SEOPress: Does not properly protect some of its REST API routesCVE-2024-5488 · WordPress plugins & themes · reported by WPScanCritical 9.8
The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
- Product
- SEOPress
- Fixed in
- 7.9
- What to do
- Update SEOPress to 7.9 or newer.
Jul 9, 2024DN Footer Contacts: Does not sanitise and escape some of its settingsCVE-2024-3410 · WordPress plugins & themes · reported by WPScanMedium 4.3
The DN Footer Contacts WordPress plugin before 1.6.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- DN Footer Contacts
- Fixed in
- 1.6.3
- What to do
- Update DN Footer Contacts to 1.6.3 or newer.
Jul 3, 2024WPQA Builder: Does not have CSRF checks in some placesCVE-2024-2376 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- WPQA Builder
- Fixed in
- 6.1.1
- What to do
- Update WPQA Builder to 6.1.1 or newer.
Jul 3, 2024WPQA Builder: Does not sanitise and escape some of its Slider settingsCVE-2024-2375 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- WPQA Builder
- Fixed in
- 6.1.1
- What to do
- Update WPQA Builder to 6.1.1 or newer.
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2235 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 3, 2024Himer: Does not sanitise and escape some of its Post settingsCVE-2024-2234 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2233 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 3, 2024Himer: Does not have CSRF checks in some placesCVE-2024-2040 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack
- Product
- Himer
- Fixed in
- 2.1.1
- What to do
- Update Himer to 2.1.1 or newer.
Jul 2, 2024sitetweet: Does not have CSRF check in some placesCVE-2024-5767 · WordPress plugins & themes · reported by WPScanHigh 8.8
The sitetweet WordPress plugin through 0.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- sitetweet
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update sitetweet to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 2, 2024Quiz and Survey Master (QSM): Is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX actionCVE-2024-5606 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.2
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Jul 2, 2024Rank Math SEO: Does not sanitise and escape some of its settingsCVE-2024-4627 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Rank Math SEO WordPress plugin before 1.0.219 does not sanitise and escape some of its settings, which could allow users with access to the General Settings (by default admin, however such access can be given to lower roles via the Role Manager feature of the Rank Math SEO WordPress plugin before 1.0.219) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Rank Math SEO
- Fixed in
- 1.0.219
- What to do
- Update Rank Math SEO to 1.0.219 or newer.
Jul 2, 2024EazyDocs: Does not sanitise and escape some of its settingsCVE-2024-3999 · WordPress plugins & themes · reported by WPScanMedium 4.8
The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- EazyDocs
- Fixed in
- 2.5.0
- What to do
- Update EazyDocs to 2.5.0 or newer.
Jul 1, 2024Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-6130 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.26
- What to do
- Update Form Maker by 10Web to 1.15.26 or newer.
Jul 1, 2024Quiz and Survey Master (QSM): Does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embedCVE-2024-4934 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.0.2
- What to do
- Update Quiz and Survey Master (QSM) to 9.0.2 or newer.
Jun 28, 2024Pagerank tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5730 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pagerank tools WordPress plugin through 1.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Pagerank tools
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Pagerank tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Simple AL Slider: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5729 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple AL Slider WordPress plugin through 1.2.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Simple AL Slider
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Simple AL Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Animated AL List: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5728 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Animated AL List WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Animated AL List
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Animated AL List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2024Widget4Call: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-5727 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Widget4Call WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Widget4Call
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Widget4Call to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.