Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,575 results · page 63 of 112
Apr 26, 2024Salon booking system: Does not sanitise and escape some of its settingsCVE-2024-2439 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024Salon booking system: Does not have CSRF check in placeCVE-2024-2429 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Salon booking system
- Affected
- up to 9.6.5
- What to do
- Affects up to 9.6.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 26, 2024WP Google Review Slider: Does not sanitise and escape some of its settingsCVE-2024-2310 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP Google Review Slider
- Fixed in
- 13.6
- What to do
- Update WP Google Review Slider to 13.6 or newer.
Apr 26, 2024Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2159 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Social Sharing
- Fixed in
- 3.3.61
- What to do
- Update Social Sharing to 3.3.61 or newer.
Apr 26, 2024Fancy Product Designer: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0905 · WordPress plugins & themes · reported by WPScanMedium 6.3
The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users
- Product
- Fancy Product Designer
- Fixed in
- 6.1.8
- What to do
- Update Fancy Product Designer to 6.1.8 or newer.
Apr 25, 2024Advanced Search: Does not properly escape parameters appended to an SQL queryCVE-2024-3265 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making it possible for users with the administrator role to conduct SQL Injection attacks in the context of a multisite WordPress configurations.
- Product
- Advanced Search
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Advanced Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 25, 2024AGCA: Does not sanitise and escape some of its settingsCVE-2024-2907 · WordPress plugins & themes · reported by WPScanMedium 6.8
The AGCA WordPress plugin before 7.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AGCA
- Fixed in
- 7.2.2
- What to do
- Update AGCA to 7.2.2 or newer.
Apr 24, 2024Strong Testimonials: Does not validate and escape some of its Testimonial fields before outputting them back in a page/postCVE-2024-3261 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The attack requires a specific view to be performed
- Product
- Strong Testimonials
- Fixed in
- 3.1.12
- What to do
- Update Strong Testimonials to 3.1.12 or newer.
Apr 24, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-2972 · WordPress plugins & themes · reported by WPScanLow 3.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
- Fixed in
- 3.1.9
- What to do
- Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.1.9 or newer.
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2404 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow low privilege users such as Subscribers to perform Stored Cross-Site Scripting attacks.
- Product
- Better Comments
- Fixed in
- 1.5.6
- What to do
- Update Better Comments to 1.5.6 or newer.
Apr 24, 2024Better Comments: Does not sanitise and escape some of its settingsCVE-2024-2402 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Better Comments WordPress plugin before 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Better Comments
- Fixed in
- 1.5.6
- What to do
- Update Better Comments to 1.5.6 or newer.
Apr 24, 2024WooCommerce Customers Manager: Does not have authorisation and CSRF in an AJAX actionCVE-2024-1756 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WooCommerce Customers Manager WordPress plugin before 29.8 does not have authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber, to call it and retrieve the list of customer email addresses along with their id, first name and last name
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.8
- What to do
- Update WooCommerce Customers Manager to 29.8 or newer.
Apr 24, 2024WooCommerce Customers Manager: Does not sanitise and escape various parameters before outputting them back in pages and attributesCVE-2024-1743 · WordPress plugins & themes · reported by WPScanMedium 5.9
The WooCommerce Customers Manager WordPress plugin before 29.8 does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.8
- What to do
- Update WooCommerce Customers Manager to 29.8 or newer.
Apr 24, 2024Import WP: Does not prevent users with the administrator role from pinging conducting SSRF attacksCVE-2023-7253 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Import WP WordPress plugin before 2.13.1 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations.
- Product
- Import WP
- Fixed in
- 2.13.1
- What to do
- Update Import WP to 2.13.1 or newer.
Apr 22, 2024Tickera: Does not prevent users from leaking other users' ticketsCVE-2023-7252 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Tickera WordPress plugin before 3.5.2.5 does not prevent users from leaking other users' tickets.
- Product
- Tickera
- Fixed in
- 3.5.2.5
- What to do
- Update Tickera to 3.5.2.5 or newer.
Apr 19, 2024Genesis Blocks: Does not properly escape data input provided to some of its blocksCVE-2024-2761 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks.
- Product
- Genesis Blocks
- Fixed in
- 3.1.3
- What to do
- Update Genesis Blocks to 3.1.3 or newer.
Apr 18, 2024Otter Blocks: Does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered blockCVE-2024-2729 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.
- Product
- Otter Blocks
- Fixed in
- 2.6.6
- What to do
- Update Otter Blocks to 2.6.6 or newer.
Apr 17, 2024WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro: Does not sanitise and escape some of its settingsCVE-2024-2309 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro
- Fixed in
- 3.4.0
- What to do
- Update WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro to 3.4.0 or newer.
Apr 17, 2024Social Media Share Buttons & Social Sharing Icons: Does not sanitise and escape some of its settingsCVE-2024-2118 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 2.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Social Media Share Buttons & Social Sharing Icons
- Fixed in
- 2.8.9
- What to do
- Update Social Media Share Buttons & Social Sharing Icons to 2.8.9 or newer.
Apr 17, 2024Salon booking system: Does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameterCVE-2024-2102 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Bookings' page and the malicious script is executed in the admin context.
- Product
- Salon booking system
- Fixed in
- 9.6.3
- What to do
- Update Salon booking system to 9.6.3 or newer.
Apr 17, 2024Salon booking system: Does not properly sanitize and escape the 'Mobile Phone' fieldCVE-2024-2101 · WordPress plugins & themes · reported by WPScanMedium 5.7
The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Customers' page and the malicious script is executed in the admin context.
- Product
- Salon booking system
- Fixed in
- 9.6.3
- What to do
- Update Salon booking system to 9.6.3 or newer.
Apr 17, 2024Easy Social Feed: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-1219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
- Product
- Easy Social Feed
- Fixed in
- 6.5.6
- What to do
- Update Easy Social Feed to 6.5.6 or newer.
Apr 15, 2024Simple Buttons Creator: Does not have CSRF checks in some placesCVE-2024-2858 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simple Buttons Creator WordPress plugin through 1.04 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Simple Buttons Creator
- Affected
- up to 1.04
- What to do
- Affects up to 1.04. Update Simple Buttons Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024Simple Buttons Creator: Does not have any authorisationCVE-2024-2857 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
- Product
- Simple Buttons Creator
- Affected
- up to 1.04
- What to do
- Affects up to 1.04. Update Simple Buttons Creator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024Social Share, Social Login and Social Comments: Does not sanitise and escape some of its settingsCVE-2024-2836 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.64 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Social Share, Social Login and Social Comments
- Fixed in
- 7.13.64
- What to do
- Update Social Share, Social Login and Social Comments to 7.13.64 or newer.
Apr 15, 2024Advanced Search: Does not have CSRF checks in some placesCVE-2024-2739 · WordPress plugins & themes · reported by WPScanHigh 8.7
The Advanced Search WordPress plugin through 1.1.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- Advanced Search
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update Advanced Search to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URLCVE-2024-1849 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URL
- Product
- WP Customer Reviews
- Fixed in
- 3.7.1
- What to do
- Update WP Customer Reviews to 3.7.1 or newer.
Apr 15, 2024Responsive Tabs: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1846 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Tabs
- Fixed in
- 4.0.7
- What to do
- Update Responsive Tabs to 4.0.7 or newer.
Apr 15, 2024NPS computy: Does not have CSRF checks in some placesCVE-2024-1755 · WordPress plugins & themes · reported by WPScanHigh 8.8
The NPS computy WordPress plugin through 2.7.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- Product
- NPS computy
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update NPS computy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024NPS computy: Does not sanitise and escape some of its settingsCVE-2024-1754 · WordPress plugins & themes · reported by WPScanMedium 4.7
The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- NPS computy
- Affected
- up to 2.7.5
- What to do
- Affects up to 2.7.5. Update NPS computy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2024Testimonial Slider: Does not sanitise and escape some of its settingsCVE-2024-1746 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Testimonial Slider WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Testimonial Slider
- Fixed in
- 2.3.8
- What to do
- Update Testimonial Slider to 2.3.8 or newer.
Apr 15, 2024Carousel Slider: Does not sanitise and escape some of its settingsCVE-2024-1712 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Carousel Slider
- Fixed in
- 2.2.7
- What to do
- Update Carousel Slider to 2.2.7 or newer.
Apr 15, 2024Top Bar: Does not sanitise and escape some of its settingsCVE-2024-1660 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Top Bar WordPress plugin before 3.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Top Bar
- Fixed in
- 3.0.5
- What to do
- Update Top Bar to 3.0.5 or newer.
Apr 15, 2024WooCommerce: Does not prevent users with at least the contributor role from leaking products they shouldn't have access toCVE-2024-1310 · WordPress plugins & themes · reported by WPScanMedium 4.9
The WooCommerce WordPress plugin before 8.6 does not prevent users with at least the contributor role from leaking products they shouldn't have access to. (e.g. private, draft and trashed products)
- Product
- WooCommerce
- Fixed in
- 8.6
- What to do
- Update WooCommerce to 8.6 or newer.
Apr 15, 2024Smart Forms: Does not have proper authorization in some actionsCVE-2024-1307 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Smart Forms WordPress plugin before 2.6.94 does not have proper authorization in some actions, which could allow users with a role as low as a subscriber to call them and perform unauthorized actions
- Product
- Smart Forms
- Fixed in
- 2.6.94
- What to do
- Update Smart Forms to 2.6.94 or newer.
Apr 15, 2024Smart Forms: Does not have CSRF checks in some placesCVE-2024-1306 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk.
- Product
- Smart Forms
- Fixed in
- 2.6.94
- What to do
- Update Smart Forms to 2.6.94 or newer.
Apr 15, 2024Meta Box: Does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's postsCVE-2024-1204 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Meta Box WordPress plugin before 5.9.4 does not prevent users with at least the contributor role from access arbitrary custom fields assigned to other user's posts.
- Product
- Meta Box
- Fixed in
- 5.9.4
- What to do
- Update Meta Box to 5.9.4 or newer.
Apr 15, 2024Fancy Product Designer: Does not sanitise and escape some of its settingsCVE-2024-0902 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Fancy Product Designer
- Fixed in
- 6.1.81
- What to do
- Update Fancy Product Designer to 6.1.81 or newer.
Apr 15, 2024WooCommerce Customers Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0399 · WordPress plugins & themes · reported by WPScanHigh 8.1
The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.
- Product
- WooCommerce Customers Manager
- Fixed in
- 29.7
- What to do
- Update WooCommerce Customers Manager to 29.7 or newer.
Apr 15, 2024Everest Backup: Does not properly validate backup files to be uploadedCVE-2023-7201 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- Everest Backup
- Fixed in
- 2.2.5
- What to do
- Update Everest Backup to 2.2.5 or newer.
Apr 15, 2024WP User Profile Avatar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- WP User Profile Avatar
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 13, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not properly escape some of its shortcodes attributes before they are echoed back to usersCVE-2024-2583 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.0.5 does not properly escape some of its shortcodes attributes before they are echoed back to users, making it possible for users with the contributor role to conduct Stored XSS attacks.
- Product
- WP Shortcodes Plugin — Shortcodes Ultimate
- Fixed in
- 7.0.5
- What to do
- Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.0.5 or newer.
Apr 11, 2024Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel: Does not have proper authorizationCVE-2024-0881 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX actions, allowing unauthenticated users to read such posts
- Product
- Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel
- Fixed in
- 2.2.76
- What to do
- Update Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel to 2.2.76 or newer.
Apr 10, 2024Ultimate Video Player For WordPress: Does not have proper capability checkCVE-2024-2428 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Ultimate Video Player For WordPress WordPress plugin before 2.2.3 does not have proper capability check when updating its settings via a REST route, allowing Contributor and above users to update them. Furthermore, due to the lack of escaping in one of the settings, this also allows them to perform Stored XSS attacks
- Product
- Ultimate Video Player For WordPress
- Fixed in
- 2.2.3
- What to do
- Update Ultimate Video Player For WordPress to 2.2.3 or newer.
Apr 10, 2024WordPress Ping Optimizer: Does not have CSRF checks in some placesCVE-2023-6385 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as clearing logs.
- Product
- WordPress Ping Optimizer
- Affected
- up to 2.35.1.3.0
- What to do
- Affects up to 2.35.1.3.0. Update WordPress Ping Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2024Responsive Gallery Grid: Does not sanitise and escape some of its settingsCVE-2024-1664 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Responsive Gallery Grid WordPress plugin before 2.3.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Responsive Gallery Grid
- Fixed in
- 2.3.11
- What to do
- Update Responsive Gallery Grid to 2.3.11 or newer.
Apr 8, 2024BackWPup: Does not prevent Directory Listing in its temporary backup folderCVE-2023-7164 · WordPress plugins & themes · reported by WPScanHigh 7.5
The BackWPup WordPress plugin before 4.0.4 does not prevent Directory Listing in its temporary backup folder, allowing unauthenticated attackers to download backups of a site's database.
- Product
- BackWPup
- Fixed in
- 4.0.4
- What to do
- Update BackWPup to 4.0.4 or newer.
Apr 8, 2024WPB Show Core: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-1958 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Apr 8, 2024wpb-show-core: Does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated requestCVE-2024-1956 · WordPress plugins & themes · reported by WPScanMedium 6.1
The wpb-show-core WordPress plugin before 2.7 does not sanitise and escape the parameters before outputting it back in the response of an unauthenticated request, leading to a Reflected Cross-Site Scripting
- Product
- wpb-show-core
- Fixed in
- 2.7
- What to do
- Update wpb-show-core to 2.7 or newer.
Apr 8, 2024Font Farsi: Does not sanitise and escape some of its settingsCVE-2024-1752 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Font Farsi
- Affected
- up to 1.6.6
- What to do
- Affects up to 1.6.6. Update Font Farsi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.