Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
58 results · page 1 of 2
Oct 23, 2026Otter Blocks: Does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocksCVE-2026-109936 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while rendering blocks, so the pattern can consume the quote that closes an HTML attribute and pull adjacent unescaped data into the markup as new attributes. This allows unauthenticated users to achieve stored Cross-Site Scripting that executes in the browser of any visitor who views an affected page, including a logged-in administrator.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 23, 2026Otter Blocks: Does not enforce its block visibility conditionsCVE-2026-109935 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 23, 2026Otter Blocks: Does not correctly determine whether a post is publicly readable before returning its data through a REST API endpointCVE-2026-109934 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 23, 2026Otter Blocks: Does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheetCVE-2026-109933 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post.
- Product
- Otter Blocks
- Fixed in
- 3.2.8
- What to do
- Update Otter Blocks to 3.2.8 or newer.
Oct 18, 2026Otter Blocks: Does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout sessionCVE-2026-109937 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.
- Product
- Otter Blocks
- Fixed in
- 3.2.3
- What to do
- Update Otter Blocks to 3.2.3 or newer.
Oct 16, 2026OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /sCVE-2026-111701 · Other software · OtterMind · reported by VulnCheckHigh 8.3
OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /storage/v1/object/{bucketId}/{path} is treated as public for every HTTP method. Attackers knowing a tenant subdomain, bucket id and object path can download objects from private buckets and delete stored objects without an apikey or JWT.
- Product
- Nubase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/previCVE-2026-109562 · Other software · snapotter-hq · reported by VulnCheckMedium 5.3
SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage arbitrary files outside storage quota, served unauthenticated via /api/v1/download, and feed crafted input to image and video decoders.
- Product
- SnapOtter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.CVE-2026-32580 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2026Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Sensitive Information ExposureCVE-2026-102002 · WordPress plugins & themes · reported by WordfenceLow 3.1
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved — meaning the exposure is active on any standard site using the plugin's form feature.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 3.2.6
- What to do
- Affects up to 3.2.6. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 7, 2026Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Insecure Direct Object ReferenceCVE-2026-4945 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch_checkout' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to pay for a lower-cost product while obtaining entitlement for a premium product by manipulating the product_id parameter independently of the price_id parameter in the Stripe checkout URL.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2026WooCommerce Lottery: Time-Based SQL InjectionCVE-2026-18884 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WooCommerce Lottery
- Affected
- up to 2.2.9
- What to do
- Affects up to 2.2.9. Update WooCommerce Lottery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.netplugins.trac.wordpress.org
Jul 17, 2026Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{id} endpoint.CVE-2026-63307 · Other software · OtterMind · reported by VulnCheckHigh 7.1
Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{id} endpoint. The handler calls dataSourceService.queryExistent(id, ...) without an ownership check and returns the decrypted password field, allowing any authenticated non-admin user to enumerate datasource IDs and read the plaintext database credentials of datasources owned by other users.
- Product
- Chat2DB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026Otter Blocks: Purchase Verification BypassCVE-2026-2892 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due to the 'get_customer_data' method relying on an unsigned 'o_stripe_data' cookie to determine Stripe product ownership for unauthenticated users. The 'check_purchase' method trusts this cookie data without performing server-side verification against the Stripe API for one-time 'payment' mode purchases. This makes it possible for unauthenticated attackers to bypass Stripe purchase-gated content visibility conditions by forging the 'o_stripe_data' cookie with a target product ID, which is publicly exposed in the checkout block's HTML source.
- Product
- Otter Blocks
- Affected
- up to 3.1.4
- What to do
- Affects up to 3.1.4. Update Otter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026Improper Restriction of Excessive Authentication Attempts, Improper Authentication vulnerability in Doruk Communication and Automation Industry and Trade Inc.CVE-2025-7630 · Other software · Doruk Communication and Automation Industry and Trade Inc. · reported by iletisim@usom.gov.trMedium 5.3
Improper Restriction of Excessive Authentication Attempts, Improper Authentication vulnerability in Doruk Communication and Automation Industry and Trade Inc. Wispotter allows Password Brute Forcing, Brute Force. This issue affects Wispotter: from 1.0 before v2025.10.08.1.
- Product
- Wispotter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 5, 2025Thai Lottery Widget: Stored Cross-Site ScriptingCVE-2025-13678 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `thailottery` shortcode in all versions up to, and including, 2.5. This is due to insufficient input sanitization and output escaping on the user supplied `width` and `height` shortcode attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Thai Lottery Widget
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Thai Lottery Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 24, 2025Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../rCVE-2025-60803 · Other software · reported by MITRECritical 9.8
Antabot White-Jotter up to commit 9bcadc was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the component /api/aaa;/../register.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025Otter - Gutenberg Block: Insertion of Sensitive Information Into Sent DataCVE-2025-55715 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Retrieve Embedded Sensitive Data.This issue affects Otter - Gutenberg Block: from n/a through <= 3.1.0.
- Product
- Otter - Gutenberg Block
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Otter - Gutenberg Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 7, 2025A vulnerability was found in Antabot White-Jotter 0.22.CVE-2025-8708 · Other software · Antabot · reported by VulDBLow 1.3
A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieRememberMeManager of the file ShiroConfiguration.java of the component com.gm.wj.config.ShiroConfiguration. The manipulation with the input EVANNIGHTLY_WAOU leads to deserialization. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- White-Jotter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive endpoints via a craftCVE-2024-57176 · Other software · Antabot · reported by MITREHigh 7.6
An issue in the shiroFilter function of White-Jotter project v0.2.2 allows attackers to execute a directory traversal and access sensitive endpoints via a crafted URL.
- Product
- White-jotter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025magayo Lottery Results: Cross-Site Request ForgeryCVE-2024-13522 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- magayo Lottery Results
- Affected
- up to 2.0.12
- What to do
- Affects up to 2.0.12. Update magayo Lottery Results to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Dec 29, 2024A vulnerability classified as problematic was found in Antabot White-Jotter up to 0.2.2.CVE-2024-13032 · Other software · Antabot · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in Antabot White-Jotter up to 0.2.2. Affected by this vulnerability is an unknown functionality of the file /admin/content/editor of the component Article Editor. The manipulation of the argument articleCover leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- White-Jotter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2024A vulnerability classified as problematic has been found in Antabot White-Jotter up to 0.2.2.CVE-2024-13031 · Other software · Antabot · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in Antabot White-Jotter up to 0.2.2. Affected is an unknown function of the file /admin/content/editor of the component Article Content Editor. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- White-Jotter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2024A vulnerability, which was classified as problematic, was found in Antabot White-Jotter up to 0.2.2.CVE-2024-13029 · Other software · Antabot · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Antabot White-Jotter up to 0.2.2. Affected is an unknown function of the file /admin/content/book of the component Edit Book Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- White-Jotter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2024A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2.CVE-2024-13028 · Other software · Antabot · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2. This issue affects some unknown processing of the file /login. The manipulation of the argument username leads to observable response discrepancy. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- White-Jotter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Path TraversalCVE-2024-11219 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.0.6 via the get_image function. This makes it possible for unauthenticated attackers to view arbitrary images on the server, which can contain sensitive information.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 19, 2024Otter - Gutenberg Block: Missing AuthorizationCVE-2024-51671 · WordPress plugins & themes · reported by PatchstackLow 2.7
Missing Authorization vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Otter - Gutenberg Block: from n/a through <= 3.0.3.
- Product
- Otter - Gutenberg Block
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Otter - Gutenberg Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Stored Cross-Site ScriptingCVE-2024-10367 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 3.0.4
- What to do
- Affects up to 3.0.4. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 16, 2024Digital Lottery: Unrestricted Upload of File with Dangerous TypeCVE-2024-49242 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery digital-lottery allows Upload a Web Shell to a Web Server.This issue affects Digital Lottery: from n/a through <= 3.0.5.
- Product
- Digital Lottery
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Digital Lottery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 8, 2024Otter Blocks PRO: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-35682 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11.
- Product
- Otter Blocks PRO
- Affected
- up to 2.6.11
- What to do
- Affects up to 2.6.11. Update Otter Blocks PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Stored Cross-Site ScriptingCVE-2024-3725 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Grid widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping on user supplied attributes such as 'titleTag'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 2.6.9
- What to do
- Affects up to 2.6.9. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 18, 2024Otter Blocks: Does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered blockCVE-2024-2729 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Otter Blocks WordPress plugin before 2.6.6 does not properly escape its mainHeadings blocks' attribute before appending it to the final rendered block, allowing contributors to conduct Stored XSS attacks.
- Product
- Otter Blocks
- Fixed in
- 2.6.6
- What to do
- Update Otter Blocks to 2.6.6 or newer.
Apr 11, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Stored Cross-Site ScriptingCVE-2024-3344 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 2.6.8
- What to do
- Affects up to 2.6.8. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 11, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Stored Cross-Site ScriptingCVE-2024-3343 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 2.6.8
- What to do
- Affects up to 2.6.8. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 9, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Stored Cross-Site ScriptingCVE-2024-2226 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id parameter in the google-map block in all versions up to, and including, 2.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 29, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Stored Cross-Site ScriptingCVE-2024-2841 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping on user supplied attributes such as 'id'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 2.6.5
- What to do
- Affects up to 2.6.5. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 13, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO: Stored Cross-Site ScriptingCVE-2024-1691 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file upload form, which allows SVG uploads, in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that the patch in 2.6.4 allows SVG uploads but the uploaded SVG files are sanitized.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordstore.themeisle.comwordfence.com
Mar 13, 2024Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE: Stored Cross-Site ScriptingCVE-2024-1684 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contact form file field CSS metabox in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Affected
- up to 2.6.3
- What to do
- Affects up to 2.6.3. Update Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordstore.themeisle.comwordfence.com
May 30, 2023Otter: Does not sanitize some user-controlled file paths before performing file operations on themCVE-2023-2288 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper.
- Product
- Otter
- Fixed in
- 2.2.6
- What to do
- Update Otter to 2.2.6 or newer.
May 1, 2023File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to function coversUpload.CVE-2023-29635 · Other software · Antabot White-jotter Project · reported by MITRECritical 9.8
File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to function coversUpload.
- Product
- Antabot White-jotter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /blotter/blotter.php.CVE-2022-35175 · Other software · Barangay Management System Project · reported by MITRECritical 9.8
Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /blotter/blotter.php.
- Product
- Barangay Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2021Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referencedCVE-2020-8569 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 4.3
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, is automatically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an endless crashloop. Only the volume snapshot feature is affected by this vulnerability. When exploited, users can’t take snapshots of their volumes or delete the snapshots. All other Kubernetes functionality is not affected.
- Product
- CSI Snapshotter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Dec 5, 2019Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.CVE-2019-11255 · Other software · Kubernetes · reported by jordan@liggitt.netMedium 4.8
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
- Product
- kubernetes-csi external-provisioner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Mar 29, 2019PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting (XSS) via the err value in a .ico picture upload.CVE-2019-9605 · Other software · Online Lottery PHP Readymade Script Project · reported by MITREMedium 5.4
PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Reflected Cross-site Scripting (XSS) via the err value in a .ico picture upload.
- Product
- Online Lottery PHP Readymade Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Mar 29, 2019PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Cross-Site Request Forgery (CSRF) for Edit Profile actions.CVE-2019-9604 · Other software · Online Lottery PHP Readymade Script Project · reported by MITREHigh 8.8
PHP Scripts Mall Online Lottery PHP Readymade Script 1.7.0 has Cross-Site Request Forgery (CSRF) for Edit Profile actions.
- Product
- Online Lottery PHP Readymade Script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackingvila.wordpress.comhackingvila.wordpress.com
Oct 23, 2018A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call.CVE-2018-17877 · Other software · Greedy599 · reported by MITREHigh 7.5
A lottery smart contract implementation for Greedy 599, an Ethereum gambling game, generates a random value that is predictable via an external contract call. The developer used the extcodesize() function to prevent a malicious contract from being called, but the attacker can bypass it by writing the core code in the constructor of their exploit code. Therefore, it allows attackers to always win and get rewards.
- Product
- Greedy 599
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2018The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readCVE-2018-17071 · Other software · Lucky9 · reported by MITREHigh 7.5
The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly readable variable entry_number. This variable is private, yet it is readable by eth.getStorageAt function. Also, attackers can purchase a ticket at a low price by directly calling the fallback function with small msg.value, because the developer set the currency unit incorrectly. Therefore, it allows attackers to always win and get rewards.
- Product
- Lucky9io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2018The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with pubCVE-2018-15552 · Other software · Theethereumlottery · reported by MITREHigh 7.5
The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.
- Product
- The Ethereum Lottery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2018The mintToken function of a smart contract implementation for Lottery, an Ethereum token, has an integer overflow that allows the owner of the contract to set tCVE-2018-13678 · Other software · Lottery Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for Lottery, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Lottery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2018The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readabCVE-2018-12454 · Other software · 1000guess · reported by MITREHigh 7.5
The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call). Therefore, it allows attackers to always win and get rewards.
- Product
- 1000 Guess
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2017Indeo Otter through 1.7.4 mishandles a "</script>" substring in an initial DP payload, which allows remote attackers to cause a denial of service (crash) or posCVE-2017-17086 · Other software · Inedo · reported by MITRECritical 9.8
Indeo Otter through 1.7.4 mishandles a "</script>" substring in an initial DP payload, which allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact, as demonstrated by the Plan Editor.
- Product
- Otter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinedo.myjetbrains.cominedo.myjetbrains.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.