SpiderCalendar <= 1.5.65 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue. Note: Vendor decided to close the plugin and it won't be...

Mozilla: Race condition when playing audio files

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Constructing audio sinks could have led to a race condition when playing audio files and closing windows. This could have lead to a use-after-free issue, causing a potentially exploitable crash...

WordPress Mitsol Social Post Feed plugin <= 1.10 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Big Tiger in WordPress Mitsol Social Post Feed plugin versions = 1.10. Solution Deactivate and delete. This plugin has been closed as of March 14, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Orange Form plugin <= 1.0 - SQL Injection (SQLi) via Cross-Site Request Forgery (CSRF) vulnerability

SQL Injection SQLi via Cross-Site Request Forgery CSRF vulnerability discovered by Francesco Carlucci in WordPress Orange Form plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of December 29, 2021 and is not available for download. This closure is temporary,...

Incorrect Lifetime Bounds on Closures in `rusqlite`

The lifetime bound on several closure-accepting rusqlite functions specifically, functions which register a callback to be later invoked by SQLite was too relaxed. If a closure referencing borrowed values on the stack is was passed to one of these functions, it could allow Rust code to access...

WordPress Filter Portfolio Gallery plugin <= 1.5 - Arbitrary Gallery Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Gallery Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Vishal Mohan in WordPress Filter Portfolio Gallery plugin versions = 1.5. Solution Deactivate and delete. This plugin has been closed as of October 7, 2021 and is not available for download. This closure is...

WordPress Improved Include Page plugin <= 1.2 - Arbitrary Posts/Pages Access vulnerability

Arbitrary Posts/Pages Access vulnerability discovered by Francesco Carlucci in WordPress Improved Include Page plugin versions = 1.2. Solution Deactivate and delete. This plugin has been closed as of October 8, 2021 and is not available for download. This closure is temporary, pending a full revi...

WordPress Inspirational Quote Rotator plugin <= 1.0.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Vishal Mohan in WordPress Inspirational Quote Rotator plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of September 23, 2021 and is not available for download. This closure is temporary, pending a...

CVE-2021-41170 Evaluation of closures can lead to execution of methods & functions in current program scope

neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function...

CVE-2021-41170

The CVE concerns neoan3-apps/template (Neoan3 minimal template engine). Prior to 1.1.1, closures could be passed into the template and executed if a value shared a name with a method or function in scope, enabling potential arbitrary execution when rendering templates. The issue affects users han...

WordPress Media Tags plugin <= 3.2.0.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Akash Rajendra Patil in WordPress Media Tags plugin versions = 3.2.0.2. Solution Deactivate and delete. This plugin has been closed as of October 25, 2021 and is not available for download. This closure is temporary, pending a full revie...

Friday Squid Blogging: Squid Eating Maine Shrimp

Squid are eating Maine shrimp, causing a collapse of the ecosystem. This seems to be a result of climate change. Maines shrimp fishery has been closed for nearly a decade since the stocks collapse in 2013. Scientists are now saying a species of squid that came into the Gulf of Maine during a...

WordPress Content Staging <= 2.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Thinkland Security Team in WordPress Content Staging versions = 2.0.1. Solution Deactivate and delete. This plugin has been closed as of October 15, 2021 and is not available for download. This closure is temporary, pending...

WordPress Job Board Vanila plugin <= 1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Thinkland Security Team in WordPress Job Board Vanila plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of October 13, 2021 and is not available for download. This closure is temporary,...

WordPress SMS OVH plugin <= 0.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress SMS OVH plugin versions = 0.1. Solution This plugin has been closed as of August 24, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress WP Design Maps & Places plugin <= 1.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress WP Design Maps & Places plugin versions = 1.2. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Notices Ticker plugin <= 6.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Notices Ticker plugin versions = 6.1. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Simple Popup Newsletter plugin <= 1.4.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Simple Popup Newsletter plugin versions = 1.4.7. Solution This plugin has been closed as of August 12, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Calendar_plugin <= 1.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by p7e4 in WordPress Calendarplugin versions = 1.0. Solution This plugin has been closed as of August 12, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Sticky Related Posts <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Sticky Related Posts versions = 1.0. Solution This plugin has been closed as of January 28, 2021 and is not available for download. This closure is permanent. Reason: Author Request...