Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
758 results · page 10 of 16
Nov 28, 2024File Manager Pro – Filester: Local JavaScript File InclusionCVE-2024-9669 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The File Manager Pro – Filester plugin for WordPress is vulnerable to Local JavaScript File Inclusion in all versions up to, and including, 1.8.5 via the 'fm_locale' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The vulnerability was partially patched in version 1.8.5.
- Product
- File Manager Pro – Filester
- Affected
- up to 1.8.5
- What to do
- Affects up to 1.8.5. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 28, 2024File Manager Pro – Filester: Arbitrary file uploadsCVE-2024-8066 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an Administrator, to upload a new .htaccess file allowing them to subsequently upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- File Manager Pro – Filester
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 26, 2024Booster for WooCommerce: Stored Cross-Site ScriptingCVE-2024-9170 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcj_product_meta shortcode in all versions up to, and including, 7.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with ShopManager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Booster for WooCommerce
- Affected
- up to 7.2.3
- What to do
- Affects up to 7.2.3. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Team Rosters: Deserialization of Untrusted DataCVE-2024-52439 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a through <= 4.8.2.
- Product
- Team Rosters
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Team Rosters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Booster for WooCommerce: Reflected Cross-Site ScriptingCVE-2024-9239 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Booster for WooCommerce
- Affected
- up to 7.2.3
- What to do
- Affects up to 7.2.3. Update Booster for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2024W3SPEEDSTER: Cross-Site Request Forgery (CSRF)CVE-2024-52392 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in w3speedster W3SPEEDSTER w3speedster-wp.This issue affects W3SPEEDSTER: from n/a through <= 7.25.
- Product
- W3SPEEDSTER
- Affected
- up to 7.25
- What to do
- Affects up to 7.25. Update W3SPEEDSTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024WoW Guild Armory Roster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51850 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bchristopeit WoW Guild Armory Roster guild-armory-roster allows Stored XSS.This issue affects WoW Guild Armory Roster: from n/a through <= 0.5.5.
- Product
- WoW Guild Armory Roster
- Affected
- up to 0.5.5
- What to do
- Affects up to 0.5.5. Update WoW Guild Armory Roster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Keymaster Chord Notation Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51809 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in intelligentDesign Keymaster Chord Notation Free keymaster-chord-notation-free allows Stored XSS.This issue affects Keymaster Chord Notation Free: from n/a through <= 1.0.2.
- Product
- Keymaster Chord Notation Free
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Keymaster Chord Notation Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024MDR Webmaster Tools: Cross-Site Request Forgery (CSRF)CVE-2024-51640 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Matt Rude MDR Webmaster Tools mdr-webmaster-tools allows Stored XSS.This issue affects MDR Webmaster Tools: from n/a through <= 1.1.
- Product
- MDR Webmaster Tools
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update MDR Webmaster Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Ads Booster by Ads Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-52428 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Peter Ads Booster by Ads Pro free-wp-booster-by-ads-pro allows PHP Local File Inclusion.This issue affects Ads Booster by Ads Pro: from n/a through <= 1.12.
- Product
- Ads Booster by Ads Pro
- Affected
- up to 1.12
- What to do
- Affects up to 1.12. Update Ads Booster by Ads Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Mapster WP Maps: Stored Cross-Site ScriptingCVE-2024-10592 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup class parameter in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Mapster WP Maps
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Nov 11, 2024MasterBip para Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51571 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masterbip MasterBip para Elementor masterbip-for-elementor allows DOM-Based XSS.This issue affects MasterBip para Elementor: from n/a through <= 1.6.3.
- Product
- MasterBip para Elementor
- Affected
- up to 1.6.3
- What to do
- Affects up to 1.6.3. Update MasterBip para Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Master Bar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51698 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luis Rock Master Bar master-bar allows Reflected XSS.This issue affects Master Bar: from n/a through <= 1.0.
- Product
- Master Bar
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Master Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 4, 2024RSVPMaker for Toastmasters: Unrestricted Upload of File with Dangerous TypeCVE-2024-50531 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in davidfcarr RSVPMaker for Toastmasters rsvpmaker-for-toastmasters allows Upload a Web Shell to a Web Server.This issue affects RSVPMaker for Toastmasters: from n/a through <= 6.2.4.
- Product
- RSVPMaker for Toastmasters
- Affected
- up to 6.2.4
- What to do
- Affects up to 6.2.4. Update RSVPMaker for Toastmasters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Blockbooster: Missing AuthorizationCVE-2024-43979 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.
- Product
- Blockbooster
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Blockbooster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Asset CleanUp: Page Speed Booster: Missing AuthorizationCVE-2024-43314 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.3.
- Product
- Asset CleanUp: Page Speed Booster
- Affected
- up to 1.3.9.3
- What to do
- Affects up to 1.3.9.3. Update Asset CleanUp: Page Speed Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masteriyo - LMS: Missing AuthorizationCVE-2024-43159 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.6.
- Product
- Masteriyo - LMS
- Affected
- up to 1.11.6
- What to do
- Affects up to 1.11.6. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masteriyo - LMS: Missing AuthorizationCVE-2024-43158 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.
- Product
- Masteriyo - LMS
- Affected
- up to 1.11.4
- What to do
- Affects up to 1.11.4. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Masterstudy Elementor Widgets: Missing AuthorizationCVE-2024-37269 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2.
- Product
- Masterstudy Elementor Widgets
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Masterstudy Elementor Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024MasterStudy LMS: Missing AuthorizationCVE-2024-37094 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12.
- Product
- MasterStudy LMS
- Affected
- up to 3.2.12
- What to do
- Affects up to 3.2.12. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024W3SPEEDSTER: Remote Code ExecutionCVE-2024-8512 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
- Product
- W3SPEEDSTER
- Affected
- up to 7.26
- What to do
- Affects up to 7.26. Update W3SPEEDSTER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024Masteriyo LMS – eLearning and Online Course Builder for: Unauthorized user profile modificationCVE-2024-10008 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.
- Product
- Masteriyo LMS – eLearning and Online Course Builder for
- Affected
- up to 1.13.3
- What to do
- Affects up to 1.13.3. Update Masteriyo LMS – eLearning and Online Course Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 29, 2024Masteriyo LMS – eLearning and Online Course Builder for: Stored Cross-Site ScriptingCVE-2024-10000 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with student-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Masteriyo LMS – eLearning and Online Course Builder for
- Affected
- up to 1.13.3
- What to do
- Affects up to 1.13.3. Update Masteriyo LMS – eLearning and Online Course Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 26, 2024Wp Social Login and Register Social Counter: Authentication bypassCVE-2024-9501 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.0.7. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.
- Product
- Wp Social Login and Register Social Counter
- Affected
- up to 3.0.7
- What to do
- Affects up to 3.0.7. Update Wp Social Login and Register Social Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2024Mapster WP Maps: Unauthorized modification of data that can lead to privilege escalationCVE-2024-9235 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an insufficient capability check on the mapster_wp_maps_set_option_from_js() function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with contributor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Mapster WP Maps
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Mapster WP Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Oct 22, 2024Anchor Episodes Index (Spotify for Podcasters): Stored Cross-Site ScriptingCVE-2024-10189 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Anchor Episodes Index (Spotify for Podcasters) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's anchor_episodes shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Anchor Episodes Index (Spotify for Podcasters)
- Affected
- up to 2.1.10
- What to do
- Affects up to 2.1.10. Update Anchor Episodes Index (Spotify for Podcasters) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 20, 2024Social Auto Poster: Cross-Site Request Forgery (CSRF)CVE-2024-49272 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in wpweb Social Auto Poster social-auto-poster allows Cross Site Request Forgery.This issue affects Social Auto Poster: from n/a through <= 5.3.15.
- Product
- Social Auto Poster
- Affected
- up to 5.3.15
- What to do
- Affects up to 5.3.15. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024APA Register Newsletter Form: Cross-Site Request Forgery (CSRF)CVE-2024-49621 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari APA Register Newsletter Form apa-register-newsletter-form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through <= 1.0.0.
- Product
- APA Register Newsletter Form
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update APA Register Newsletter Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024El mejor Cluster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49232 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in derethor El mejor Cluster mejorcluster allows DOM-Based XSS.This issue affects El mejor Cluster: from n/a through <= 1.1.15.
- Product
- El mejor Cluster
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update El mejor Cluster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024NextScripts: Social Networks Auto-Poster: Authorization bypassCVE-2020-36831 · WordPress plugins & themes · reported by WordfenceMedium 5
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged attackers, like subscribers, to perform restricted actions that would be otherwise locked to a administrative-level user.
- Product
- NextScripts: Social Networks Auto-Poster
- Affected
- up to 4.3.17
- What to do
- Affects up to 4.3.17. Update NextScripts: Social Networks Auto-Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.sucuri.netwpscan.com
Oct 11, 2024BlockMeister – Block Pattern Builder: Reflected Cross-Site ScriptingCVE-2024-9616 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BlockMeister – Block Pattern Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.10. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- BlockMeister – Block Pattern Builder
- Affected
- up to 3.1.10
- What to do
- Affects up to 3.1.10. Update BlockMeister – Block Pattern Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 9, 2024Marketing and SEO Booster: Stored Cross-Site ScriptingCVE-2024-9066 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Marketing and SEO Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- Marketing and SEO Booster
- Affected
- up to 1.9.10
- What to do
- Affects up to 1.9.10. Update Marketing and SEO Booster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Oct 8, 2024CMSMasters Content Composer: Stored Cross-Site ScriptingCVE-2024-7963 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CMSMasters Content Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's multiple shortcodes in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- CMSMasters Content Composer
- Affected
- up to 1.8.8
- What to do
- Affects up to 1.8.8. Update CMSMasters Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcmsmasters.networdfence.com
Oct 5, 2024Social Auto Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47369 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweb Social Auto Poster social-auto-poster allows Reflected XSS.This issue affects Social Auto Poster: from n/a through <= 5.3.15.
- Product
- Social Auto Poster
- Affected
- up to 5.3.15
- What to do
- Affects up to 5.3.15. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WP-Lister Lite for eBay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47380 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Reflected XSS.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.6.3.
- Product
- WP-Lister Lite for eBay
- Affected
- up to 3.6.3
- What to do
- Affects up to 3.6.3. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 25, 2024Masterstudy LMS Starter: Insertion of Sensitive Information into Log FileCVE-2024-43990 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a through 1.1.8.
- Product
- Masterstudy LMS Starter
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Masterstudy LMS Starter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2024Quiz and Survey Master (QSM): Does not sanitise and escape some of its settingsCVE-2024-8758 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.1.3
- What to do
- Update Quiz and Survey Master (QSM) to 9.1.3 or newer.
Sep 17, 2024Posterity: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43995 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sonalsinha21 Posterity allows Stored XSS.This issue affects Posterity: from n/a through 3.6.
- Product
- Posterity
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update Posterity to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Houzez Login Register: Privilege EscalationCVE-2024-21743 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5.
- Product
- Houzez Login Register
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Houzez Login Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 10, 2024Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor: Stored Cross-Site ScriptingCVE-2024-6282 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-jltma-wrapper-link element in all versions up to, and including 2.0.6.4 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
- Product
- Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
- Affected
- up to 2.0.6.4
- What to do
- Affects up to 2.0.6.4. Update Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2024Quiz and Survey Master (QSM): Fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embeddedCVE-2024-6879 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.1 fails to validate and escape certain Quiz fields before displaying them on a page or post where the Quiz is embedded, which could allows contributor and above roles to perform Stored Cross-Site Scripting (XSS) attacks.
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.1.1
- What to do
- Update Quiz and Survey Master (QSM) to 9.1.1 or newer.
Aug 18, 2024Masteriyo - LMS: Authorization Bypass Through User-Controlled KeyCVE-2024-43239 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.
- Product
- Masteriyo - LMS
- Affected
- up to 1.11.4
- What to do
- Affects up to 1.11.4. Update Masteriyo - LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024WP-Lister Lite for eBay: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43306 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.6.0.
- Product
- WP-Lister Lite for eBay
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update WP-Lister Lite for eBay to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2024WP2Speed Faster: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-37924 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wp2speed WP2Speed Faster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP2Speed Faster: from n/a through 1.0.1.
- Product
- WP2Speed Faster
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update WP2Speed Faster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 12, 2024Post Grid Master: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43156 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Reflected XSS.This issue affects Post Grid Master: from n/a through 3.4.10.
- Product
- Post Grid Master
- Affected
- up to 3.4.10
- What to do
- Affects up to 3.4.10. Update Post Grid Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 3, 2024File Manager Pro – Filester: Unauthorized modification of dataCVE-2024-7031 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njt_fs_saveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role that has been granted permissions by an Administrator, to update the plugin settings for user role restrictions, including allowing file types such as .php to be uploaded.
- Product
- File Manager Pro – Filester
- Affected
- up to 1.8.2
- What to do
- Affects up to 1.8.2. Update File Manager Pro – Filester to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 3, 2024Quiz and Survey Master (QSM): Does not properly sanitise and escape some of its Quizz settingsCVE-2024-6390 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Quiz and Survey Master (QSM) WordPress plugin before 9.1.0 does not properly sanitise and escape some of its Quizz settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks
- Product
- Quiz and Survey Master (QSM)
- Fixed in
- 9.1.0
- What to do
- Update Quiz and Survey Master (QSM) to 9.1.0 or newer.
Jul 26, 2024Master Currency WP: Stored Cross-Site ScriptingCVE-2024-6634 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Master Currency WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currencyconverterform shortcode in all versions up to, and including, 1.1.61 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Master Currency WP
- Affected
- up to 1.1.61
- What to do
- Affects up to 1.1.61. Update Master Currency WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 26, 2024During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests oCVE-2024-6490 · WordPress plugins & themes · reported by WPScanMedium 6.5
During testing of the Master Slider WordPress plugin through 3.9.10, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby delete all of the sliders inside Master Slider WordPress plugin through 3.9.10.
- Product
- Master Slider
- Affected
- up to 3.9.10
- What to do
- Affects up to 3.9.10. Update Master Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2024Social Auto Poster: Arbitrary file uploadsCVE-2024-6756 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. An attacker can use CVE-2024-6754 to exploit with subscriber-level access.
- Product
- Social Auto Poster
- Affected
- up to 5.3.14
- What to do
- Affects up to 5.3.14. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.