Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-0189

Publication date:

28/02/2022

The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2022-0150

Publication date:

28/02/2022

The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-4222

Publication date:

28/02/2022

The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-25112

Publication date:

28/02/2022

The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-25034

Publication date:

28/02/2022

The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the [wp_user] shortcode is used, leading to Reflected Cross-Site Scripting issues

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-25010

Publication date:

28/02/2022

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-24994

Publication date:

28/02/2022

The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated requests before outputting it in admin page, leading to a Stored Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-25042

Publication date:

28/02/2022

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or make a logged in user do it via a CSRF attack and add an arbitrary IP address to exclude. Furthermore, due to the lack of validation, sanitisation and escaping, users could set a malicious value and perform Cross-Site Scripting attacks against logged in admin

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-25081

Publication date:

28/02/2022

The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts and update the plugin&#39;s settings via a CSRF attack

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-24971

Publication date:

28/02/2022

The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin&#39;s settings and perform Cross-Site Scripting attacks against all visitor and users on the frontend

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-24933

Publication date:

28/02/2022

The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting issue

Severity CVSS v4.0: Pending analysis

Last modification:

08/03/2022

CVE-2021-24920

Publication date:

28/02/2022

The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Severity CVSS v4.0: Pending analysis

Last modification:

07/03/2022

Subscribe to Vulnerabilities