Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,575 results · page 62 of 112
May 16, 2024Newsletter Popup: Does not have CSRF checkCVE-2024-3642 · WordPress plugins & themes · reported by WPScanMedium 6.9
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2024Newsletter Popup: Does not sanitise and escape some parametersCVE-2024-3641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins
- Product
- Newsletter Popup
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Newsletter Popup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not have CSRF check in placeCVE-2024-3824 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not have CSRF checkCVE-2024-3823 · WordPress plugins & themes · reported by WPScanLow 2.4
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Base64 Encoder/Decoder: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3822 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Base64 Encoder/Decoder
- Affected
- up to 0.9.2
- What to do
- Affects up to 0.9.2. Update Base64 Encoder/Decoder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024month name translation benaceur: Does not sanitise and escape some of its settingsCVE-2024-3634 · WordPress plugins & themes · reported by WPScanMedium 4.8
The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- month name translation benaceur
- Fixed in
- 2.3.8
- What to do
- Update month name translation benaceur to 2.3.8 or newer.
May 15, 2024HL Twitter: Does not have CSRF checkCVE-2024-3631 · WordPress plugins & themes · reported by WPScanMedium 4.3
The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024HL Twitter: Does not sanitise and escape some of its settingsCVE-2024-3630 · WordPress plugins & themes · reported by WPScanMedium 5.4
The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024HL Twitter: Does not have CSRF check in placeCVE-2024-3629 · WordPress plugins & themes · reported by WPScanLow 2.4
The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- HL Twitter
- Affected
- up to 2014.1.18
- What to do
- Affects up to 2014.1.18. Update HL Twitter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3548 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.1.2
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.2 or newer.
May 15, 2024WP Prayer: Does not have CSRF checks in some placesCVE-2024-3407 · WordPress plugins & themes · reported by WPScanMedium 5.3
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- WP Prayer
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update WP Prayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Prayer: Does not have CSRF check in placeCVE-2024-3406 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Prayer
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update WP Prayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024WP Prayer: Does not have CSRF check in placeCVE-2024-3405 · WordPress plugins & themes · reported by WPScanHigh 7.6
The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- WP Prayer
- Affected
- up to 2.0.9
- What to do
- Affects up to 2.0.9. Update WP Prayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3241 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Ultimate Blocks
- Fixed in
- 3.1.7
- What to do
- Update Ultimate Blocks to 3.1.7 or newer.
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in some placesCVE-2024-3941 · WordPress plugins & themes · reported by WPScanMedium 4.7
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
- Product
- reCAPTCHA Jetpack
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024reCAPTCHA Jetpack: Does not have CSRF check in placeCVE-2024-3940 · WordPress plugins & themes · reported by WPScanHigh 8.8
The reCAPTCHA Jetpack WordPress plugin through 0.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- reCAPTCHA Jetpack
- Affected
- up to 0.2.2
- What to do
- Affects up to 0.2.2. Update reCAPTCHA Jetpack to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Add Custom CSS and JS: Does not have CSRF check in some placesCVE-2024-3903 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in as author and above add Stored XSS payloads via a CSRF attack
- Product
- Add Custom CSS and JS
- Affected
- up to 1.20
- What to do
- Affects up to 1.20. Update Add Custom CSS and JS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024LetterPress: Does not have CSRF checks in some placesCVE-2024-3590 · WordPress plugins & themes · reported by WPScanMedium 6.1
The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers
- Product
- LetterPress
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update LetterPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024UnGallery: Does not have CSRF check in some placesCVE-2024-3582 · WordPress plugins & themes · reported by WPScanMedium 4.8
The UnGallery WordPress plugin through 2.2.4 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- UnGallery
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update UnGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Post Grid Gutenberg Blocks and WordPress Blog
- Fixed in
- 4.0.2
- What to do
- Update Post Grid Gutenberg Blocks and WordPress Blog to 4.0.2 or newer.
May 14, 2024Save as PDF Plugin by Pdfcrowd: Does not sanitise and escape some of its settingsCVE-2023-5971 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Save as PDF Plugin by Pdfcrowd WordPress plugin before 3.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Save as PDF Plugin by Pdfcrowd
- Fixed in
- 3.2.0
- What to do
- Update Save as PDF Plugin by Pdfcrowd to 3.2.0 or newer.
May 8, 2024SSL Zen: Does not properly prevent directory listing of the private keys folderCVE-2024-1076 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support .htaccess files, like NGINX.
- Product
- SSL Zen
- Fixed in
- 4.6.0
- What to do
- Update SSL Zen to 4.6.0 or newer.
May 7, 2024EasyEvent: Does not sanitise and escape some of its settingsCVE-2024-3628 · WordPress plugins & themes · reported by WPScanLow 3.8
The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- EasyEvent
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update EasyEvent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024MF Gig Calendar: Does not have CSRF checks in some placesCVE-2024-3756 · WordPress plugins & themes · reported by WPScanHigh 7.5
The MF Gig Calendar WordPress plugin through 1.2.1 does not have CSRF checks in some places, which could allow attackers to make logged in Contributors and above delete arbitrary events via a CSRF attack
- Product
- MF Gig Calendar
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024MF Gig Calendar: Does not sanitise and escape some of its settingsCVE-2024-3755 · WordPress plugins & themes · reported by WPScanMedium 5.4
The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- MF Gig Calendar
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update MF Gig Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024Crelly Slider: Does not sanitise and escape some of its settingsCVE-2024-3752 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Crelly Slider
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Crelly Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 6, 2024Fancy Product Designer: Does not sanitise and escape some of its settingsCVE-2024-0904 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fancy Product Designer
- Fixed in
- 6.1.81
- What to do
- Update Fancy Product Designer to 6.1.81 or newer.
May 3, 2024Carousel Slider: Does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embedCVE-2024-3703 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Carousel Slider
- Fixed in
- 2.2.10
- What to do
- Update Carousel Slider to 2.2.10 or newer.
May 3, 2024Gutenverse: Does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embedCVE-2024-3692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Gutenverse
- Fixed in
- 1.9.1
- What to do
- Update Gutenverse to 1.9.1 or newer.
May 3, 2024Responsive Contact Form Builder & Lead Generation: Does not sanitise and escape some of its settingsCVE-2024-3637 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Contact Form Builder & Lead Generation
- Affected
- up to 1.8.9
- What to do
- Affects up to 1.8.9. Update Responsive Contact Form Builder & Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 2, 2024Counter Box: Does not have CSRF checks in some bulk actionsCVE-2024-3481 · WordPress plugins & themes · reported by WPScanMedium 5.2
The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks
- Product
- Counter Box
- Fixed in
- 1.2.4
- What to do
- Update Counter Box to 1.2.4 or newer.
May 2, 2024Herd Effects: Does not have CSRF checks in some bulk actionsCVE-2024-3478 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks
- Product
- Herd Effects
- Fixed in
- 5.2.7
- What to do
- Update Herd Effects to 5.2.7 or newer.
May 2, 2024Popup Box: Does not have CSRF checks in some bulk actionsCVE-2024-3477 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting popups via CSRF attacks
- Product
- Popup Box
- Fixed in
- 2.2.7
- What to do
- Update Popup Box to 2.2.7 or newer.
May 2, 2024Side Menu Lite: Does not have CSRF checks in some bulk actionsCVE-2024-3476 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Side Menu Lite
- Fixed in
- 4.2.1
- What to do
- Update Side Menu Lite to 4.2.1 or newer.
May 2, 2024Sticky Buttons: Does not have CSRF checks in some bulk actionsCVE-2024-3475 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Sticky Buttons
- Fixed in
- 3.2.4
- What to do
- Update Sticky Buttons to 3.2.4 or newer.
May 2, 2024Wow Skype Buttons: Does not have CSRF checks in some bulk actionsCVE-2024-3474 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks
- Product
- Wow Skype Buttons
- Fixed in
- 4.0.4
- What to do
- Update Wow Skype Buttons to 4.0.4 or newer.
May 2, 2024Modal Window: Does not have CSRF check in placeCVE-2024-3472 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack
- Product
- Modal Window
- Fixed in
- 5.3.10
- What to do
- Update Modal Window to 5.3.10 or newer.
May 2, 2024Button Generator: Does not have CSRF check in placeCVE-2024-3471 · WordPress plugins & themes · reported by WPScanLow 3.4
The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin delete buttons via a CSRF attack
- Product
- Button Generator
- Fixed in
- 3.0
- What to do
- Update Button Generator to 3.0 or newer.
May 2, 2024Float menu: Does not have CSRF check in its bulk actionsCVE-2024-2405 · WordPress plugins & themes · reported by WPScanMedium 4.5
The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.
- Product
- Float menu
- Fixed in
- 6.0.1
- What to do
- Update Float menu to 6.0.1 or newer.
Apr 29, 2024Smart Forms: Does not sanitise and escape some of its settingsCVE-2024-1905 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Smart Forms WordPress plugin before 2.6.96 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Smart Forms
- Fixed in
- 2.6.96
- What to do
- Update Smart Forms to 2.6.96 or newer.
Apr 26, 2024MM-email2image: Does not have CSRF check in some placesCVE-2024-3076 · WordPress plugins & themes · reported by WPScanLow 3.8
The MM-email2image WordPress plugin through 0.2.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- MM-email2image
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.1.0
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Apr 26, 2024MM-email2image: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3075 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- MM-email2image
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024ENL Newsletter: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-3060 · WordPress plugins & themes · reported by WPScanMedium 4.5
The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024ENL Newsletter: Does not have CSRF checks in some placesCVE-2024-3059 · WordPress plugins & themes · reported by WPScanMedium 5.7
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024ENL Newsletter: Does not have CSRF check in some placesCVE-2024-3058 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
- Product
- ENL Newsletter
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update ENL Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Bannerlid: Does not escape generated URLs before outputting them in attributesCVE-2024-3048 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators
- Product
- Bannerlid
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Bannerlid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Call Now Button: Does not sanitise and escape some of its settingsCVE-2024-2908 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Call Now Button
- Fixed in
- 1.4.7
- What to do
- Update Call Now Button to 1.4.7 or newer.
Apr 26, 2024WP Chat App: Does not sanitise and escape some of its settingsCVE-2024-2837 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- WP Chat App
- Fixed in
- 3.6.4
- What to do
- Update WP Chat App to 3.6.4 or newer.
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2603 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.