Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,408 results · page 73 of 389
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properCVE-2025-28408 · Other software · Ruoyi · reported by MITRECritical 9.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not properly validate the deptId parameter
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether CVE-2025-28407 · Other software · Ruoyi · reported by MITREHigh 8.8
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether the requesting user has permission to modify the specified dictId
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has admCVE-2025-28403 · Other software · Ruoyi · reported by MITREHigh 7.2
An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has administrative privileges before allowing modifications to system configuration settings
- Product
- Ruoyi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2025Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.CVE-2024-45552 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.2
Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025Maps: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2025-2279 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Maps WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- Maps
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 3, 2025MapPress Maps for: Does not sanitise and escape some parametersCVE-2025-2055 · WordPress plugins & themes · reported by WPScanMedium 6.8
The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.
- Product
- MapPress Maps for
- Fixed in
- 2.94.9
- What to do
- Update MapPress Maps for to 2.94.9 or newer.
Apr 2, 2025Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for CVE-2025-31728 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.5
Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins AsakusaSatellite Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another usCVE-2024-25051 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.6
IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system.
- Product
- Jazz Reporting Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme_tcp_recv_pdu() doesnCVE-2025-21927 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest. Fix this by rejecting packets with an unexpected header length.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Xen doesn't offer MSR_FAM10H_MMIOCVE-2025-21913 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Xen doesn't offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results in the following warning: unchecked MSR access error: RDMSR from 0xc0010058 at rIP: 0xffffffff8101d19f (xen_do_read_msr+0x7f/0xa0) Call Trace: xen_read_msr+0x1e/0x30 amd_get_mmconfig_range+0x2b/0x80 quirk_amd_mmconfig_area+0x28/0x100 pnp_fixup_device+0x39/0x50 __pnp_add_device+0xf/0x150 pnp_add_device+0x3d/0x100 pnpacpi_add_device_handler+0x1f9/0x280 acpi_ns_get_device_callback+0x104/0x1c0 acpi_ns_walk_namespace+0x1d0/0x260 acpi_get_devices+0x8a/0xb0 pnpacpi_init+0x50/0x80 do_one_initcall+0x46/0x2e0 kernel_init_freeable+0x1da/0x2f0 kernel_init+0x16/0x1b0 ret_from_fork+0x30/0x50 ret_from_fork_asm+0x1b/0x30 based on quirks for a "PNP0c01" device. Treating MMCFG as disabled is the right course of action, so no change is needed there. This was most likely exposed by fixing the Xen MSR accessors to not be silently-safe.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 1, 2025Authentication Bypass Issue If the path does not contain / and contain., authentication is not required.CVE-2024-56325 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users Return: {"code":401,"error":"HTTP 401 Unauthorized"} Malicious Request and Response Example curl -X POST -H "Content-Type: application/json" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; . Return: {"users":{}} A new user gets added bypassing authentication, enabling the user to control Pinot.
- Product
- Apache Pinot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Apr 1, 2025Lana Downloads Manager: Does not validate user input used in a pathCVE-2025-2048 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server
- Product
- Lana Downloads Manager
- Fixed in
- 1.10.0
- What to do
- Update Lana Downloads Manager to 1.10.0 or newer.
Apr 1, 2025Gutentor: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-1986 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Gutentor
- Fixed in
- 3.4.7
- What to do
- Update Gutentor to 3.4.7 or newer.
Mar 31, 2025Photo Gallery by 10Web: Does not sanitised and escaped comment added on images by unauthenticated usersCVE-2025-0613 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.8.34
- What to do
- Update Photo Gallery by 10Web to 1.8.34 or newer.
Mar 28, 2025The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory.CVE-2025-2782 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 6.3
The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.
- Product
- SSO Terminal Services Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Mar 28, 2025The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory.CVE-2025-2781 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3Medium 6.3
The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.
- Product
- Mobile VPN with SSL Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.watchguard.comwatchguard.com
Mar 28, 2025Event Tickets with Ticket Scanner: Does not have CSRF check in placeCVE-2025-1762 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Event Tickets with Ticket Scanner
- Fixed in
- 2.5.4
- What to do
- Update Event Tickets with Ticket Scanner to 2.5.4 or newer.
Mar 27, 2025In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: bsg: Fix crash when arpmb command fails If the device doesn't support arpCVE-2025-21873 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: bsg: Fix crash when arpmb command fails If the device doesn't support arpmb we'll crash due to copying user data in bsg_transport_sg_io_fn(). In the case where ufs_bsg_exec_advanced_rpmb_req() returns an error, do not set the job's reply_len. Memory crash backtrace: 3,1290,531166405,-;ufshcd 0000:00:12.5: ARPMB OP failed: error code -22 4,1308,531166555,-;Call Trace: 4,1309,531166559,-; <TASK> 4,1310,531166565,-; ? show_regs+0x6d/0x80 4,1311,531166575,-; ? die+0x37/0xa0 4,1312,531166583,-; ? do_trap+0xd4/0xf0 4,1313,531166593,-; ? do_error_trap+0x71/0xb0 4,1314,531166601,-; ? usercopy_abort+0x6c/0x80 4,1315,531166610,-; ? exc_invalid_op+0x52/0x80 4,1316,531166622,-; ? usercopy_abort+0x6c/0x80 4,1317,531166630,-; ? asm_exc_invalid_op+0x1b/0x20 4,1318,531166643,-; ? usercopy_abort+0x6c/0x80 4,1319,531166652,-; __check_heap_object+0xe3/0x120 4,1320,531166661,-; check_heap_object+0x185/0x1d0 4,1321,531166670,-; __check_object_size.part.0+0x72/0x150 4,1322,531166679,-; __check_object_size+0x23/0x30 4,1323,531166688,-; bsg_transport_sg_io_fn+0x314/0x3b0
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 26, 2025HCL SX does not set the secure attribute on authorization tokens or session cookies.CVE-2024-30155 · Other software · HCL Software · reported by psirt@hcl.comMedium 5.5
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).
- Product
- HCL SX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Mar 26, 2025Booknetic: Does not have CSRF checkCVE-2024-13146 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack
- Product
- Booknetic
- Fixed in
- 4.1.5
- What to do
- Update Booknetic to 4.1.5 or newer.
Mar 26, 2025Smart Maintenance Mode: Does not sanitise and escape some of its settingsCVE-2024-12683 · WordPress plugins & themes · reported by WPScanLow 3.5
The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Smart Maintenance Mode
- Fixed in
- 1.5.2
- What to do
- Update Smart Maintenance Mode to 1.5.2 or newer.
Mar 26, 2025wp-svg-upload: Does not sanitize SVG file contentsCVE-2024-11847 · WordPress plugins & themes · reported by WPScanMedium 4.8
The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
- Product
- wp-svg-upload
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update wp-svg-upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2025The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site SCVE-2025-1798 · WordPress plugins & themes · reported by WPScanMedium 6.1
The does not sanitise and escape some parameters when outputting them back in a page, allowing unauthenticated users the ability to perform stored Cross-Site Scripting attacks.
- Fixed in
- 1.1.2
- What to do
- Update the plugin to 1.1.2 or newer.
Mar 25, 2025Favorites: Does not sanitise and escape some of its settingsCVE-2025-1452 · WordPress plugins & themes · reported by WPScanLow 3.5
The Favorites WordPress plugin before 2.3.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Favorites
- Fixed in
- 2.3.5
- What to do
- Update Favorites to 2.3.5 or newer.
Mar 25, 2025WP-Recall: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-9770 · WordPress plugins & themes · reported by WPScanMedium 4.7
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- WP-Recall
- Fixed in
- 16.26.12
- What to do
- Update WP-Recall to 16.26.12 or newer.
Mar 25, 2025Stylish Google Sheet Reader 4.0: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13863 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Stylish Google Sheet Reader 4.0
- Fixed in
- 4.1
- What to do
- Update Stylish Google Sheet Reader 4.0 to 4.1 or newer.
Mar 25, 2025aoa-downloadable: Doesn't validate a parameter in its download functionCVE-2024-13617 · WordPress plugins & themes · reported by WPScanHigh 8.6
The aoa-downloadable WordPress plugin through 0.1.0 doesn't validate a parameter in its download function, allowing unauthenticated attackers to download arbitrary files from the server
- Product
- aoa-downloadable
- Affected
- up to 0.1.0
- What to do
- Affects up to 0.1.0. Update aoa-downloadable to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 25, 2025AFI: Does not sanitise and escape some of its settingsCVE-2024-13123 · WordPress plugins & themes · reported by WPScanLow 3.5
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AFI
- Fixed in
- 1.100.0
- What to do
- Update AFI to 1.100.0 or newer.
Mar 25, 2025AFI: Does not sanitise and escape some of its settingsCVE-2024-13122 · WordPress plugins & themes · reported by WPScanLow 3.5
The AFI WordPress plugin before 1.100.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- AFI
- Fixed in
- 1.100.0
- What to do
- Update AFI to 1.100.0 or newer.
Mar 25, 2025IP Based Login: Does not have CSRF checks in some placesCVE-2024-13118 · WordPress plugins & themes · reported by WPScanMedium 4.3
The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack
- Product
- IP Based Login
- Fixed in
- 2.4.1
- What to do
- Update IP Based Login to 2.4.1 or newer.
Mar 25, 2025Simple Banner: Does not sanitise and escape some of its settingsCVE-2024-12769 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Banner
- Fixed in
- 3.0.4
- What to do
- Update Simple Banner to 3.0.4 or newer.
Mar 25, 2025Smart Maintenance Mode: Does not sanitise and escape some of its settingsCVE-2024-12682 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Smart Maintenance Mode
- Fixed in
- 1.5.2
- What to do
- Update Smart Maintenance Mode to 1.5.2 or newer.
Mar 25, 2025Product Labels For Woocommerce (Sale Badges): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-12109 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Product Labels For Woocommerce (Sale Badges)
- Fixed in
- 1.5.9
- What to do
- Update Product Labels For Woocommerce (Sale Badges) to 1.5.9 or newer.
Mar 25, 2025WP Tabs: Does not sanitise and escape some of its settingsCVE-2024-11503 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WP Tabs
- Fixed in
- 2.2.7
- What to do
- Update WP Tabs to 2.2.7 or newer.
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11273 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Contact Form & SMTP Plugin for WordPress by PirateForms
- Fixed in
- 2.6.0
- What to do
- Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Mar 25, 2025Contact Form & SMTP Plugin for WordPress by PirateForms: Does not sanitise and escape some of its settingsCVE-2024-11272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Contact Form & SMTP Plugin for WordPress by PirateForms
- Fixed in
- 2.6.0
- What to do
- Update Contact Form & SMTP Plugin for WordPress by PirateForms to 2.6.0 or newer.
Mar 25, 2025Registrations for the Events Calendar: Does not sanitise and escape some of its settingsCVE-2024-10703 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Registrations for the Events Calendar WordPress plugin before 2.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Registrations for the Events Calendar
- Fixed in
- 2.13.4
- What to do
- Update Registrations for the Events Calendar to 2.13.4 or newer.
Mar 25, 2025Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-10679 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Quiz and Survey Master (QSM) WordPress plugin before 9.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.2.1
- What to do
- Update Quiz and Survey Master (QSM) to 9.2.1 or newer.
Mar 25, 2025Product Labels For Woocommerce (Sale Badges): Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-10638 · WordPress plugins & themes · reported by WPScanMedium 4.1
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.11 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Product Labels For Woocommerce (Sale Badges)
- Fixed in
- 1.5.11
- What to do
- Update Product Labels For Woocommerce (Sale Badges) to 1.5.11 or newer.
Mar 25, 2025Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10566 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Slider by 10Web
- Fixed in
- 1.2.62
- What to do
- Update Slider by 10Web to 1.2.62 or newer.
Mar 25, 2025Slider by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10565 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Slider by 10Web WordPress plugin before 1.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Slider by 10Web
- Fixed in
- 1.2.62
- What to do
- Update Slider by 10Web to 1.2.62 or newer.
Mar 25, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10560 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.30
- What to do
- Update Form Maker by 10Web to 1.15.30 or newer.
Mar 25, 2025WordPress WP-Advanced-Search: Does not sanitise and escape some of its settingsCVE-2024-10554 · WordPress plugins & themes · reported by WPScanLow 3.5
The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- WordPress WP-Advanced-Search
- Fixed in
- 3.3.9.3
- What to do
- Update WordPress WP-Advanced-Search to 3.3.9.3 or newer.
Mar 25, 2025Stylish Price List: Does not sanitise and escape some of its settingsCVE-2024-10472 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Stylish Price List
- Fixed in
- 7.1.12
- What to do
- Update Stylish Price List to 7.1.12 or newer.
Mar 25, 2025Job Postings: Does not sanitise and escape some of its settingsCVE-2024-10105 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Job Postings
- Fixed in
- 2.7.11
- What to do
- Update Job Postings to 2.7.11 or newer.
Mar 24, 2025The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This CVE-2025-2748 · Other software · Kentico · reported by VulnCheckMedium 6.1
The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.
- Product
- Xperience
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2025Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its settingsCVE-2025-1203 · WordPress plugins & themes · reported by WPScanLow 3.5
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Slider, Gallery, and Carousel by MetaSlider
- Fixed in
- 3.95.0
- What to do
- Update Slider, Gallery, and Carousel by MetaSlider to 3.95.0 or newer.
Mar 24, 2025Slider, Gallery, and Carousel by MetaSlider: Does not sanitise and escape some of its settingsCVE-2025-1062 · WordPress plugins & themes · reported by WPScanLow 3.5
The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.95.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Slider, Gallery, and Carousel by MetaSlider
- Fixed in
- 3.95.0
- What to do
- Update Slider, Gallery, and Carousel by MetaSlider to 3.95.0 or newer.
Mar 24, 2025Photo Gallery by 10Web: Does not sanitise and escape some of its settingsCVE-2024-13124 · WordPress plugins & themes · reported by WPScanLow 3.5
The Photo Gallery by 10Web WordPress plugin before 1.8.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Photo Gallery by 10Web
- Fixed in
- 1.8.33
- What to do
- Update Photo Gallery by 10Web to 1.8.33 or newer.
Mar 24, 2025Form Maker by 10Web: Does not sanitise and escape some of its settingsCVE-2024-10558 · WordPress plugins & themes · reported by WPScanLow 3.5
The Form Maker by 10Web WordPress plugin before 1.15.30 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Form Maker by 10Web
- Fixed in
- 1.15.30
- What to do
- Update Form Maker by 10Web to 1.15.30 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.