Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,575 results · page 64 of 112
Apr 8, 2024SendPress Newsletters: Does not sanitise and escape some of its settingsCVE-2024-1589 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SendPress Newsletters
- Affected
- up to 1.23.11.6
- What to do
- Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024SendPress Newsletters: Does not sanitise and escape some of its settingsCVE-2024-1588 · WordPress plugins & themes · reported by WPScanMedium 6.8
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- SendPress Newsletters
- Affected
- up to 1.23.11.6
- What to do
- Affects up to 1.23.11.6. Update SendPress Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 8, 2024WPB Show Core: Does not sanitise and escape some parameters before outputting them back in the pageCVE-2024-1292 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WPB Show Core WordPress plugin before 2.7 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WPB Show Core
- Fixed in
- 2.7
- What to do
- Update WPB Show Core to 2.7 or newer.
Apr 6, 2024Inline Related Posts: Does not sanitise and escape some of its settingsCVE-2024-2444 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Inline Related Posts WordPress plugin before 3.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Inline Related Posts
- Fixed in
- 3.5.0
- What to do
- Update Inline Related Posts to 3.5.0 or newer.
Apr 5, 2024Gutenberg Blocks by Kadence Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-2509 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Gutenberg Blocks by Kadence Blocks
- Fixed in
- 3.2.26
- What to do
- Update Gutenberg Blocks by Kadence Blocks to 3.2.26 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Apr 3, 2024WooCommerce Cart Abandonment Recovery: Does not have CSRF check in its bulk actionsCVE-2024-2322 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks.
- Product
- WooCommerce Cart Abandonment Recovery
- Fixed in
- 1.2.27
- What to do
- Update WooCommerce Cart Abandonment Recovery to 1.2.27 or newer.
Apr 2, 2024My Calendar: Does not sanitise and escape some parametersCVE-2024-1274 · WordPress plugins & themes · reported by WPScanMedium 5.4
The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)
- Product
- My Calendar
- Fixed in
- 3.4.24
- What to do
- Update My Calendar to 3.4.24 or newer.
Apr 2, 2024Page Builder Gutenberg Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-2369 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Page Builder Gutenberg Blocks
- Fixed in
- 3.1.7
- What to do
- Update Page Builder Gutenberg Blocks to 3.1.7 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perforCVE-2024-2278 · WordPress plugins & themes · reported by WPScanMedium 6.1
Themify WordPress plugin before 1.4.4 does not sanitise and escape some of its Filters settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site ScriptiCVE-2024-2263 · WordPress plugins & themes · reported by WPScanMedium 4.8
Themify WordPress plugin before 1.4.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Apr 1, 2024Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filtersCVE-2024-2262 · WordPress plugins & themes · reported by WPScanMedium 4.7
Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs
- Fixed in
- 1.4.4
- What to do
- Update the plugin to 1.4.4 or newer.
Apr 1, 2024Hubbub Lite: Does not ensure that user have access to password protected post before displaying its content in a meta tagCVE-2024-1526 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its content in a meta tag.
- Product
- Hubbub Lite
- Fixed in
- 1.33.1
- What to do
- Update Hubbub Lite to 1.33.1 or newer.
Mar 28, 2024Pz-LinkCard: Does not prevent users from pinging arbitrary hosts via some of its shortcodesCVE-2024-0677 · WordPress plugins & themes · reported by WPScanMedium 5.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.
- Product
- Pz-LinkCard
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2024Pz-LinkCard: Does not sanitise and escape some of its settingsCVE-2024-0673 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Pz-LinkCard
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2024Pz-LinkCard: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-0672 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Pz-LinkCard
- Affected
- up to 2.5.1
- What to do
- Affects up to 2.5.1. Update Pz-LinkCard to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2024Testimonial Slider: Does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2CVE-2024-1745 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Testimonial Slider WordPress plugin before 2.3.7 does not properly ensure that a user has the necessary capabilities to edit certain sensitive Testimonial Slider WordPress plugin before 2.3.7 settings, making it possible for users with at least the Author role to edit them.
- Product
- Testimonial Slider
- Fixed in
- 2.3.7
- What to do
- Update Testimonial Slider to 2.3.7 or newer.
Mar 26, 2024Backup and Restore WordPress: Does not protect some log files containing sensitive information suchCVE-2023-7232 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Backup and Restore WordPress WordPress plugin through 1.45 does not protect some log files containing sensitive information such as site configuration etc, allowing unauthenticated users to access such data
- Product
- Backup and Restore WordPress
- Affected
- up to 1.45
- What to do
- Affects up to 1.45. Update Backup and Restore WordPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CM Download Manager WordPress plugin before 2.9.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins edit downloads via a CSRF attack
- Product
- CM Download Manager
- Fixed in
- 2.9.1
- What to do
- Update CM Download Manager to 2.9.1 or newer.
Mar 25, 2024The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of posCVE-2024-1564 · WordPress plugins & themes · reported by WPScanMedium 4.3
The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode
- Product
- wp-schema-pro
- Fixed in
- 2.7.16
- What to do
- Update wp-schema-pro to 2.7.16 or newer.
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1232 · WordPress plugins & themes · reported by WPScanMedium 4.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete downloads via a CSRF attack
- Product
- CM Download Manager
- Fixed in
- 2.9.0
- What to do
- Update CM Download Manager to 2.9.0 or newer.
Mar 25, 2024CM Download Manager: Does not have CSRF checks in some placesCVE-2024-1231 · WordPress plugins & themes · reported by WPScanMedium 6.8
The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged in admins unpublish downloads via a CSRF attack
- Product
- CM Download Manager
- Fixed in
- 2.9.0
- What to do
- Update CM Download Manager to 2.9.0 or newer.
Mar 20, 2024Simple Ajax Chat: Does not prevent visitors from using malicious NamesCVE-2024-1983 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users.
- Product
- Simple Ajax Chat
- Fixed in
- 20240223
- What to do
- Update Simple Ajax Chat to 20240223 or newer.
Mar 20, 2024Appointment Booking Calendar: Does not have CSRF checks in some placesCVE-2024-0856 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.
- Product
- Appointment Booking Calendar
- Fixed in
- 1.3.83
- What to do
- Update Appointment Booking Calendar to 1.3.83 or newer.
Mar 20, 2024System Dashboard: Does not sanitize and escape some parametersCVE-2023-7246 · WordPress plugins & themes · reported by WPScanMedium 5.4
The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks
- Product
- System Dashboard
- Fixed in
- 2.8.10
- What to do
- Update System Dashboard to 2.8.10 or newer.
Mar 19, 2024Profile Box Shortcode And Widget: Does not sanitise and escape some of its settingsCVE-2024-1401 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Profile Box Shortcode And Widget WordPress plugin before 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Profile Box Shortcode And Widget
- Fixed in
- 1.2.1
- What to do
- Update Profile Box Shortcode And Widget to 1.2.1 or newer.
Mar 18, 2024Widget for Social Page Feeds: Does not sanitise and escape some of its settingsCVE-2024-0973 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Widget for Social Page Feeds WordPress plugin before 6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Widget for Social Page Feeds
- Fixed in
- 6.4
- What to do
- Update Widget for Social Page Feeds to 6.4 or newer.
Mar 18, 2024Advanced Social Feeds Widget & Shortcode: Does not sanitise and escape some of its settingsCVE-2024-0951 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Advanced Social Feeds Widget & Shortcode WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Advanced Social Feeds Widget & Shortcode
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Advanced Social Feeds Widget & Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Innovs HR: Does not have CSRF checks in some placesCVE-2024-0858 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
- Product
- Innovs HR
- Fixed in
- 1.0.3.7.1
- What to do
- Update Innovs HR to 1.0.3.7.1 or newer.
Mar 18, 2024Jobs for: Does not sanitise and escape some parametersCVE-2024-0820 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Jobs for WordPress plugin before 2.7.4 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Jobs for
- Fixed in
- 2.7.4
- What to do
- Update Jobs for to 2.7.4 or newer.
Mar 18, 2024Enjoy Social Feed plugin for WordPress website: Does not have authorisationCVE-2024-0780 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation when resetting its database, allowing any authenticated users, such as subscriber to perform such action
- Product
- Enjoy Social Feed plugin for WordPress website
- Affected
- up to 6.2.2
- What to do
- Affects up to 6.2.2. Update Enjoy Social Feed plugin for WordPress website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Enjoy Social Feed plugin for WordPress website: Does not have authorisation and CSRF in various function hooked to admin_initCVE-2024-0779 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Enjoy Social Feed plugin for WordPress website WordPress plugin through 6.2.2 does not have authorisation and CSRF in various function hooked to admin_init, allowing unauthenticated users to call them and unlink arbitrary users Instagram Account for example
- Product
- Enjoy Social Feed plugin for WordPress website
- Affected
- up to 6.2.2
- What to do
- Affects up to 6.2.2. Update Enjoy Social Feed plugin for WordPress website to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Tabs Shortcode and Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-0719 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tabs Shortcode and Widget WordPress plugin through 1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Tabs Shortcode and Widget
- Affected
- up to 1.17
- What to do
- Affects up to 1.17. Update Tabs Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Buttons Shortcode and Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-0711 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Buttons Shortcode and Widget
- Affected
- up to 1.16
- What to do
- Affects up to 1.16. Update Buttons Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Fancy Product Designer: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-0365 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Fancy Product Designer WordPress plugin before 6.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by adminstrators.
- Product
- Fancy Product Designer
- Fixed in
- 6.1.5
- What to do
- Update Fancy Product Designer to 6.1.5 or newer.
Mar 18, 2024Scalable Vector Graphics (SVG): Does not sanitize uploaded SVG filesCVE-2023-7085 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
- Product
- Scalable Vector Graphics (SVG)
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Scalable Vector Graphics (SVG) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 18, 2024Grid Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1658 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Grid Shortcodes
- Fixed in
- 1.1.1
- What to do
- Update Grid Shortcodes to 1.1.1 or newer.
Mar 18, 2024Responsive Pricing Table: Does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embedCVE-2024-1333 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks
- Product
- Responsive Pricing Table
- Fixed in
- 5.1.11
- What to do
- Update Responsive Pricing Table to 5.1.11 or newer.
Mar 18, 2024Team Members: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Team Members
- Fixed in
- 5.3.2
- What to do
- Update Team Members to 5.3.2 or newer.
Mar 11, 2024Photos and Files Contest Gallery: Does not sanitize and escape some parametersCVE-2024-1487 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users with a role as low as author to perform Cross-Site Scripting attacks.
- Product
- Photos and Files Contest Gallery
- Fixed in
- 21.3.1
- What to do
- Update Photos and Files Contest Gallery to 21.3.1 or newer.
Mar 11, 2024User Registration: Does not prevent users with at least the contributor role from rendering sensitive shortcodesCVE-2024-1290 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.
- Product
- User Registration
- Fixed in
- 2.12
- What to do
- Update User Registration to 2.12 or newer.
Mar 11, 2024Paid Memberships Pro: Does not prevent user with at least the contributor role from leaking other users' sensitive metadataCVE-2024-1279 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Paid Memberships Pro WordPress plugin before 2.12.9 does not prevent user with at least the contributor role from leaking other users' sensitive metadata.
- Product
- Paid Memberships Pro
- Fixed in
- 2.12.9
- What to do
- Update Paid Memberships Pro to 2.12.9 or newer.
Mar 11, 2024Starbox: Does not sanitise and escape some parametersCVE-2024-1273 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
- Product
- Starbox
- Fixed in
- 3.5.0
- What to do
- Update Starbox to 3.5.0 or newer.
Mar 11, 2024404 Solution: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-1068 · WordPress plugins & themes · reported by WPScanHigh 7.2
The 404 Solution WordPress plugin before 2.35.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins.
- Product
- 404 Solution
- Fixed in
- 2.35.8
- What to do
- Update 404 Solution to 2.35.8 or newer.
Mar 11, 2024Ultimate Posts Widget: Does not validate and escape some of its Widget options before outputting them back in attributesCVE-2024-0561 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Ultimate Posts Widget
- Fixed in
- 2.3.1
- What to do
- Update Ultimate Posts Widget to 2.3.1 or newer.
Mar 11, 2024Enhanced Text Widget: Does not validate and escape some of its Widget options before outputting them back in attributesCVE-2024-0559 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Enhanced Text Widget
- Fixed in
- 1.6.6
- What to do
- Update Enhanced Text Widget to 1.6.6 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Mar 11, 2024Login as User or Customer: Does not prevent users to log inCVE-2023-7247 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
- Product
- Login as User or Customer
- Affected
- up to 3.8
- What to do
- Affects up to 3.8. Update Login as User or Customer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddrive.google.comwpscan.com
Mar 4, 2024Events Tickets Plus: Does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of statusCVE-2024-1319 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the attendees list on any post type regardless of status. (e.g. draft, private, pending review, password-protected, and trashed posts).
- Product
- Events Tickets Plus
- Fixed in
- 5.9.1
- What to do
- Update Events Tickets Plus to 5.9.1 or newer.
Mar 4, 2024Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus: Does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access toCVE-2024-1316 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus WordPress plugin before 5.9.1 does not prevent users with at least the contributor role from leaking the existence of certain events they shouldn't have access to. (e.g. draft, private, pending review, pw-protected, and trashed events).
- Product
- Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus
- Fixed in
- 5.8.1
- What to do
- Update Event Tickets and Registration WordPress plugin before 5.8.1, Events Tickets Plus to 5.8.1 or newer.
Feb 27, 2024Shariff Wrapper: Does not sanitise and escape some of its settingsCVE-2024-1106 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Shariff Wrapper
- Fixed in
- 4.6.10
- What to do
- Update Shariff Wrapper to 4.6.10 or newer.
Feb 27, 2024Spiffy Calendar: Doesn't check the event_author parameterCVE-2024-0855 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Spiffy Calendar WordPress plugin before 4.9.9 doesn't check the event_author parameter, and allows any user to alter it when creating an event, leading to deceiving users/admins that a page was created by a Contributor+.
- Product
- Spiffy Calendar
- Fixed in
- 4.9.9
- What to do
- Update Spiffy Calendar to 4.9.9 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.