Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,408 results · page 76 of 389
Feb 21, 2025Ajax Search Lite: Does not sanitise and escape some of its settingsCVE-2024-13585 · WordPress plugins & themes · reported by WPScanLow 3.5
The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Ajax Search Lite
- Fixed in
- 4.12.5
- What to do
- Update Ajax Search Lite to 4.12.5 or newer.
Feb 21, 2025Carousel, Slider, Gallery by WP Carousel: Does not sanitise and escape some of its settingsCVE-2024-13314 · WordPress plugins & themes · reported by WPScanLow 3.5
The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Carousel, Slider, Gallery by WP Carousel
- Fixed in
- 2.7.4
- What to do
- Update Carousel, Slider, Gallery by WP Carousel to 2.7.4 or newer.
Feb 20, 2025Legoeso PDF Manager: Time-based SQL InjectionCVE-2025-0866 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Legoeso PDF Manager
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Legoeso PDF Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2025The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions.CVE-2024-6697 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 6.5
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. (CWE-280) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not handle invalid and missing permissions correctly, resulting in a denial of service. An adversary leverages a legitimate capability of an application in such a way as to achieve a negative technical impact.
- Product
- Pentaho Data Integration & Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025The product does not perform an authorization check when an actor attempts to access a resource or perform an action.CVE-2024-37363 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comMedium 6.5
The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.8, including 8.3.x, do not correctly perform an authorization check in the data source management service. When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service.
- Product
- Pentaho Data Integration & Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resoCVE-2024-5706 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. (CWE-99) Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not restrict JNDI identifiers during the creation of Community Dashboards, allowing control of system-level data sources. An attacker could gain access to or modify sensitive data or system resources. This could allow access to protected files or directories including configuration files and files containing sensitive information, which can lead to remote code execution by unauthorized users.
- Product
- Pentaho Data Integration & Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.CVE-2024-5705 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.8
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. (CWE-863) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, have modules enabled by default that allow execution of system level processes. When access control checks are incorrectly applied, users can access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures and denial of service.
- Product
- Pentaho Data Integration & Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that theCVE-2024-37359 · Other software · Hitachi Vantara · reported by security.vulnerabilities@hitachivantara.comHigh 8.6
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. (CWE-918) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, do not validate the Host header of incoming HTTP/HTTPS requests. By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
- Product
- Pentaho Data Integration & Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025Master Slider: Does not sanitise and escape some of its settingsCVE-2024-12173 · WordPress plugins & themes · reported by WPScanLow 3.5
The Master Slider WordPress plugin before 3.10.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Master Slider
- Fixed in
- 3.10.5
- What to do
- Update Master Slider to 3.10.5 or newer.
Feb 17, 2025Coder: Does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2024-13726 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
- Product
- Coder
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Coder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025OWL Carousel Slider: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13627 · WordPress plugins & themes · reported by WPScanMedium 4.7
The OWL Carousel Slider WordPress plugin through 2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- OWL Carousel Slider
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update OWL Carousel Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025VR-Frases (collect & share quotes): Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13626 · WordPress plugins & themes · reported by WPScanHigh 7.1
The VR-Frases (collect & share quotes) WordPress plugin through 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- VR-Frases (collect & share quotes)
- Affected
- up to 3.0.1
- What to do
- Affects up to 3.0.1. Update VR-Frases (collect & share quotes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025Tube Video Ads Lite: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13625 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Tube Video Ads Lite WordPress plugin through 1.5.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Tube Video Ads Lite
- Affected
- up to 1.5.7
- What to do
- Affects up to 1.5.7. Update Tube Video Ads Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025Track Logins: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2024-13608 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
- Product
- Track Logins
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Track Logins to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 17, 2025Wise Forms: Does not sanitise and escape some of its settingsCVE-2024-13603 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Wise Forms WordPress plugin through 1.2.0 does not sanitise and escape some of its settings, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks via malicious form submissions.
- Product
- Wise Forms
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update Wise Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 15, 2025DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning oCVE-2024-57971 · Other software · eng · reported by MITRECritical 9.1
DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name.
- Product
- KNOWAGE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2025Maps Plugin using Google Maps for WordPress: Does not sanitise and escape some of its settingsCVE-2024-13306 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Maps Plugin using Google Maps for WordPress
- Fixed in
- 1.9.4
- What to do
- Update Maps Plugin using Google Maps for WordPress to 1.9.4 or newer.
Feb 15, 2025Maps Plugin using Google Maps for WordPress: Does not sanitise and escape some of its settingsCVE-2024-13208 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Maps Plugin using Google Maps for WordPress WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Maps Plugin using Google Maps for WordPress
- Fixed in
- 1.9.4
- What to do
- Update Maps Plugin using Google Maps for WordPress to 1.9.4 or newer.
Feb 14, 2025Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections.CVE-2025-26819 · Other software · getmonero · reported by MITREHigh 8.6
Monero through 0.18.3.4 before ec74ff4 does not have response limits on HTTP server connections.
- Product
- Monero
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2025Forminator Forms: Does not sanitise and escape some of its settingsCVE-2024-7052 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Forminator Forms
- Fixed in
- 1.38.3
- What to do
- Update Forminator Forms to 1.38.3 or newer.
Feb 14, 2025Sensly Online Presence: Does not sanitise and escape some of its settingsCVE-2024-13493 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Sensly Online Presence
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update Sensly Online Presence to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025Simple Video Management System: Does not sanitise and escape some of its settingsCVE-2025-0692 · WordPress plugins & themes · reported by WPScanLow 3.5
The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Simple Video Management System
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Simple Video Management System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 13, 2025Everest Forms: Does not sanitise and escape some of its settingsCVE-2024-13125 · WordPress plugins & themes · reported by WPScanLow 3.5
The Everest Forms WordPress plugin before 3.0.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Everest Forms
- Fixed in
- 3.0.8.1
- What to do
- Update Everest Forms to 3.0.8.1 or newer.
Feb 13, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its settingsCVE-2024-13121 · WordPress plugins & themes · reported by WPScanLow 3.5
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.20
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.20 or newer.
Feb 13, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its settingsCVE-2024-13120 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.20
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.20 or newer.
Feb 13, 2025Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content: Does not sanitise and escape some of its settingsCVE-2024-13119 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content
- Fixed in
- 4.15.20
- What to do
- Update Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content to 4.15.20 or newer.
Feb 13, 2025Chalet-Montagne.com Tools: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-12586 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chalet-Montagne.com Tools WordPress plugin through 2.7.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Chalet-Montagne.com Tools
- Affected
- up to 2.7.8
- What to do
- Affects up to 2.7.8. Update Chalet-Montagne.com Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 12, 2025Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled.CVE-2025-0896 · Other software · Orthanc · reported by ics-cert@hq.dhs.govCritical 9.2
Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access by an attacker.
- Product
- Orthanc server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in the SetIPv6PppoeSettinCVE-2025-25741 · Other software · Dlink · reported by MITREMedium 5.4
D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the IPv6_PppoePassword parameter in the SetIPv6PppoeSettings module.
- Product
- Dir-853 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddear-sunshine-ba5.notion.site
Feb 11, 2025The login functionality of the web server in affected devices does not normalize the response times of login attempts.CVE-2023-37482 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information to distinguish between valid and invalid usernames.
- Product
- SIMATIC Drive Controller CPU 1504D TF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.com
Feb 11, 2025Stray Random Quotes: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13570 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Stray Random Quotes WordPress plugin through 1.9.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Stray Random Quotes
- Affected
- up to 1.9.9
- What to do
- Affects up to 1.9.9. Update Stray Random Quotes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 11, 2025Zarinpal Paid Download: Does not properly validate uploaded filesCVE-2024-13544 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
- Product
- Zarinpal Paid Download
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Zarinpal Paid Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 11, 2025Zarinpal Paid Download: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13543 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Zarinpal Paid Download
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Zarinpal Paid Download to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 10, 2025SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2025-24867 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application allows an unauthenticated attacker to craft a URL that embeds a malicious script within an unprotected parameter. When a victim clicks the link, the script will be executed in the browser, giving the attacker the ability to access and/or modify information related to the web client with no effect on availability.
- Product
- SAP BusinessObjects Platform (BI Launchpad)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability.CVE-2025-0054 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025Guten Free Options: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13492 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Guten Free Options
- Affected
- up to 0.9.5
- What to do
- Affects up to 0.9.5. Update Guten Free Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2025Legull: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13352 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Legull
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Legull to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 6, 2025LikeBot: Does not have CSRF check in some placesCVE-2025-0522 · WordPress plugins & themes · reported by WPScanMedium 4.7
The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- LikeBot
- Affected
- up to 0.85
- What to do
- Affects up to 0.85. Update LikeBot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 5, 2025IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flCVE-2024-38316 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.
- Product
- Aspera Shares
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025Sensei LMS: Does not properly protect some its REST API routesCVE-2025-0466 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information.
- Product
- Sensei LMS
- Fixed in
- 4.24.4
- What to do
- Update Sensei LMS to 4.24.4 or newer.
Feb 4, 2025Banner Garden Plugin for: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2025-0368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Banner Garden Plugin for WordPress plugin through 0.1.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users.
- Product
- Banner Garden Plugin for
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Banner Garden Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025TransFinanz: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13332 · WordPress plugins & themes · reported by WPScanMedium 6.1
The TransFinanz WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- TransFinanz
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update TransFinanz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025WP Dream Carousel: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Dream Carousel WordPress plugin through 1.0.1b does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- WP Dream Carousel
- Affected
- up to 1.0.1b
- What to do
- Affects up to 1.0.1b. Update WP Dream Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025JustRows free: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13330 · WordPress plugins & themes · reported by WPScanHigh 7.1
The JustRows free WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- JustRows free
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update JustRows free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Solidres: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13329 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Solidres WordPress plugin through 0.9.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Solidres
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Solidres to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Giga Messenger: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13328 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Giga Messenger WordPress plugin through 2.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Giga Messenger
- Affected
- up to 2.3.1
- What to do
- Affects up to 2.3.1. Update Giga Messenger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Musicbox: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13327 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Musicbox WordPress plugin through 2.0.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Musicbox
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update Musicbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025iBuildApp: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13326 · WordPress plugins & themes · reported by WPScanMedium 6.1
The iBuildApp WordPress plugin through 0.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- iBuildApp
- Affected
- up to 0.2.0
- What to do
- Affects up to 0.2.0. Update iBuildApp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025Glossy: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-13325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Glossy
- Affected
- up to 2.3.5
- What to do
- Affects up to 2.3.5. Update Glossy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 4, 2025WP Projects Portfolio with Client Testimonials: Does not have CSRF check in some placesCVE-2024-13115 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP Projects Portfolio with Client Testimonials WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
- Product
- WP Projects Portfolio with Client Testimonials
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update WP Projects Portfolio with Client Testimonials to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.