Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
726 results · page 10 of 15
Sep 14, 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): Privilege escalationCVE-2024-8246 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.8.11. This is due to plugin not properly restricting what users have access to set the default role on registration forms. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with a custom role that allows them to register as administrators.
- Product
- Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
- Affected
- up to 2.8.11
- What to do
- Affects up to 2.8.11. Update Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 4, 2024Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2024-6889 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Secure Copy Content Protection and Content Locking
- Fixed in
- 4.1.7
- What to do
- Update Secure Copy Content Protection and Content Locking to 4.1.7 or newer.
Sep 4, 2024Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2024-6888 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Secure Copy Content Protection and Content Locking
- Fixed in
- 4.1.7
- What to do
- Update Secure Copy Content Protection and Content Locking to 4.1.7 or newer.
Aug 29, 2024Page Builder Gutenberg Blocks: Does not escape the content of post embed via one of its blockCVE-2024-7132 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts (editor and admin by default) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- Page Builder Gutenberg Blocks
- Fixed in
- 3.1.13
- What to do
- Update Page Builder Gutenberg Blocks to 3.1.13 or newer.
Aug 18, 2024Structured Content: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43307 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content allows Stored XSS.This issue affects Structured Content: from n/a through 1.6.2.
- Product
- Structured Content
- Affected
- up to 1.6.2
- What to do
- Affects up to 1.6.2. Update Structured Content to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 17, 2024ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup: Stored Cross-Site ScriptingCVE-2024-7703 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.37 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
- Product
- ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
- Affected
- up to 4.0.37
- What to do
- Affects up to 4.0.37. Update ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 6, 2024Easy Table of Contents: Does not sanitise and escape some parametersCVE-2024-7082 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks.
- Product
- Easy Table of Contents
- Fixed in
- 2.0.68
- What to do
- Update Easy Table of Contents to 2.0.68 or newer.
Aug 1, 2024Remote Content Shortcode: Server-Side Request ForgeryCVE-2024-2090 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Remote Content Shortcode plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5 via the remote_content shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Remote Content Shortcode
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Remote Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jul 27, 2024AIomatic - Automatic AI Content Writer: Arbitrary email sending vulnerabilityCVE-2024-5969 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This is due to insufficient limitations on the email recipient and the content in the 'aiomatic_send_email' function which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient.
- Product
- AIomatic - Automatic AI Content Writer
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update AIomatic - Automatic AI Content Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Jul 22, 2024JSON Content Importer: Server-Side Request Forgery (SSRF)CVE-2024-38723 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Bernhard Kux JSON Content Importer.This issue affects JSON Content Importer: from n/a through 1.5.6.
- Product
- JSON Content Importer
- Affected
- up to 1.5.6
- What to do
- Affects up to 1.5.6. Update JSON Content Importer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 21, 2024GPT3 AI Content Writer: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37465 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Senol Sahin GPT3 AI Content Writer allows Stored XSS.This issue affects GPT3 AI Content Writer: from n/a through 1.8.66.
- Product
- GPT3 AI Content Writer
- Affected
- up to 1.8.66
- What to do
- Affects up to 1.8.66. Update GPT3 AI Content Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 20, 2024Multisite Content Copier/Updater: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38673 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Obtain Infotech Multisite Content Copier/Updater allows Reflected XSS.This issue affects Multisite Content Copier/Updater: from n/a through 1.5.0.
- Product
- Multisite Content Copier/Updater
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update Multisite Content Copier/Updater to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 15, 2024Insert or Embed Articulate Content into: Does not prevent authors from uploading arbitrary files to the siteCVE-2024-5630 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
- Product
- Insert or Embed Articulate Content into
- Fixed in
- 4.3000000024
- What to do
- Update Insert or Embed Articulate Content into to 4.3000000024 or newer.
Jul 13, 2024If-So Dynamic Content Personalization: Does not sanitise and escape some of its settingsCVE-2024-6070 · WordPress plugins & themes · reported by WPScanMedium 4.8
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- If-So Dynamic Content Personalization
- Fixed in
- 1.8.0.4
- What to do
- Update If-So Dynamic Content Personalization to 1.8.0.4 or newer.
Jul 13, 2024If-So Dynamic Content Personalization: Does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attributeCVE-2024-5713 · WordPress plugins & themes · reported by WPScanMedium 5.4
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
- Product
- If-So Dynamic Content Personalization
- Fixed in
- 1.8.0.4
- What to do
- Update If-So Dynamic Content Personalization to 1.8.0.4 or newer.
Jul 13, 2024Support SVG: Does not sanitize SVG file contentsCVE-2024-4272 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Support SVG WordPress plugin before 1.1.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
- Product
- Support SVG
- Fixed in
- 1.1.0
- What to do
- Update Support SVG to 1.1.0 or newer.
Jul 13, 2024SVG Block: Does not sanitize SVG file contentsCVE-2024-4269 · WordPress plugins & themes · reported by WPScanMedium 6.1
The SVG Block WordPress plugin before 1.1.20 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
- Product
- SVG Block
- Fixed in
- 1.1.20
- What to do
- Update SVG Block to 1.1.20 or newer.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6024 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when deleting groups or emails, which could allow attackers to make a logged in admin remove them via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6023 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when adding emails, which could allow attackers to make a logged in admin perform such action via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2024ContentLock: Does not have CSRF check in placeCVE-2024-6022 · WordPress plugins & themes · reported by WPScanHigh 8.8
The ContentLock WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- ContentLock
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update ContentLock to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 12, 2024Website Content in Page or Post: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2430 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Website Content in Page or Post
- Fixed in
- 2024.04.09
- What to do
- Update Website Content in Page or Post to 2024.04.09 or newer.
Jul 11, 2024Secure Copy Content Protection and Content Locking: Does not sanitise and escape some of its settingsCVE-2024-6138 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Secure Copy Content Protection and Content Locking WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Product
- Secure Copy Content Protection and Content Locking
- Fixed in
- 4.0.9
- What to do
- Update Secure Copy Content Protection and Content Locking to 4.0.9 or newer.
Jul 9, 2024The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress CVE-2024-6069 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pieregister_install_addon function in all versions up to, and including, 3.8.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins. As a result attackers might achieve code execution on the targeted server
- Affected
- up to 3.8.3.4
- What to do
- Affects up to 3.8.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 9, 2024Easy Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-6334 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
- Product
- Easy Table of Contents
- Fixed in
- 2.0.67.1
- What to do
- Update Easy Table of Contents to 2.0.67.1 or newer.
Jun 27, 2024Interactive Content: Does not validate uploadsCVE-2024-3111 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues
- Product
- Interactive Content
- Fixed in
- 1.15.8
- What to do
- Update Interactive Content to 1.15.8 or newer.
Jun 26, 2024Easy Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-5573 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Easy Table of Contents WordPress plugin before 2.0.66 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
- Product
- Easy Table of Contents
- Fixed in
- 2.0.66
- What to do
- Update Easy Table of Contents to 2.0.66 or newer.
Jun 19, 2024Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions: Cross-Site Request ForgeryCVE-2024-1407 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to subscribe to, modify, or cancel membership for a user via a forged request granted they can trick a user into performing an action such as clicking on a link.
- Product
- Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
- Affected
- up to 2.12.10
- What to do
- Affects up to 2.12.10. Update Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024SVGator: Does not sanitize SVG file contentsCVE-2024-4271 · WordPress plugins & themes · reported by WPScanMedium 4.6
The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
- Product
- SVGator
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update SVGator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024SVGMagic: Does not sanitize SVG file contentsCVE-2024-4270 · WordPress plugins & themes · reported by WPScanMedium 5.4
The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.
- Product
- SVGMagic
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update SVGMagic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 14, 2024LuckyWP Table of Contents: Does not sanitise and escape some of its settingsCVE-2024-2218 · WordPress plugins & themes · reported by WPScanMedium 4.6
The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- LuckyWP Table of Contents
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update LuckyWP Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 13, 2024WP Dummy Content Generator: Missing AuthorizationCVE-2023-37394 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 2.3.0.
- Product
- WP Dummy Content Generator
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update WP Dummy Content Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 11, 2024If-So Dynamic Content Personalization: Missing AuthorizationCVE-2024-34820 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in If So Plugin If-So Dynamic Content Personalization.This issue affects If-So Dynamic Content Personalization: from n/a through 1.7.1.
- Product
- If-So Dynamic Content Personalization
- Affected
- up to 1.7.1
- What to do
- Affects up to 1.7.1. Update If-So Dynamic Content Personalization to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 11, 2024Copymatic – AI Content Writer & Generator: Missing AuthorizationCVE-2024-35716 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.9.
- Product
- Copymatic – AI Content Writer & Generator
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Copymatic – AI Content Writer & Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 9, 2024Evergreen Content Poster: Missing AuthorizationCVE-2024-32824 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster.This issue affects Evergreen Content Poster: from n/a through <= 1.4.2.
- Product
- Evergreen Content Poster
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update Evergreen Content Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 9, 2024Secure Copy Content Protection and Content Locking: Missing AuthorizationCVE-2024-32787 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content Protection and Content Locking: from n/a through 3.7.1.
- Product
- Secure Copy Content Protection and Content Locking
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Secure Copy Content Protection and Content Locking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Insert or Embed Articulate Content into: Lacks validation of URLsCVE-2024-0756 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page.
- Product
- Insert or Embed Articulate Content into
- Affected
- up to 4.3000000023
- What to do
- Affects up to 4.3000000023. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 4, 2024WP Content Pilot – Autoblogging & Affiliate Marketing: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2023-45053 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing Plugin allows Code Injection.This issue affects WP Content Pilot – Autoblogging & Affiliate Marketing Plugin: from n/a through 1.3.3.
- Product
- WP Content Pilot – Autoblogging & Affiliate Marketing
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update WP Content Pilot – Autoblogging & Affiliate Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 4, 2024Events Calendar: Does not properly sanitize user-submitted contentCVE-2024-4180 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.
- Product
- Events Calendar
- Fixed in
- 6.4.0.1
- What to do
- Update Events Calendar to 6.4.0.1 or newer.
Jun 4, 2024Insert or Embed Articulate Content into: Is not properly filteringCVE-2024-0757 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files
- Product
- Insert or Embed Articulate Content into
- Affected
- up to 4.3000000023
- What to do
- Affects up to 4.3000000023. Update Insert or Embed Articulate Content into to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 1, 2024Content Blocks (Custom Post Widget): Stored Cross-Site ScriptingCVE-2024-3565 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_block' shortcode in all versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Content Blocks (Custom Post Widget)
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Content Blocks (Custom Post Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 1, 2024Content Blocks (Custom Post Widget): Local File InclusionCVE-2024-3564 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's 'content_block' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- Content Blocks (Custom Post Widget)
- Affected
- up to 3.3.0
- What to do
- Affects up to 3.3.0. Update Content Blocks (Custom Post Widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 30, 2024Remote Content Shortcode: Stored Cross-Site ScriptingCVE-2024-2089 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Remote Content Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'remote_content' shortcode in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Remote Content Shortcode
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Remote Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
May 22, 2024LuckyWP Table of Contents: Stored Cross-Site ScriptingCVE-2024-2953 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- LuckyWP Table of Contents
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update LuckyWP Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 22, 2024LuckyWP Table of Contents: Reflected Cross-Site ScriptingCVE-2024-2119 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- LuckyWP Table of Contents
- Affected
- up to 2.1.5
- What to do
- Affects up to 2.1.5. Update LuckyWP Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 22, 2024LuckyWP Table of Contents: Stored Cross-Site ScriptingCVE-2023-6487 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The LuckyWP Table of Contents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Header Title' field in all versions up to and including 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE-2024-2218 appears to be a duplicate of this issue.
- Product
- LuckyWP Table of Contents
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update LuckyWP Table of Contents to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
May 17, 2024Remote Content Shortcode: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-45652 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Justin Silver Remote Content Shortcode allows PHP Local File Inclusion.This issue affects Remote Content Shortcode: from n/a through 1.5.
- Product
- Remote Content Shortcode
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Remote Content Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Copymatic – AI Content Writer & Generator: Unrestricted Upload of File with Dangerous TypeCVE-2024-31351 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.6.
- Product
- Copymatic – AI Content Writer & Generator
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update Copymatic – AI Content Writer & Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 14, 2024Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease: Sensitive Information ExposureCVE-2024-0437 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the API. This makes it possible for authenticated attackers, with subscriber access or higher, to extract post titles and content, thus bypassing the plugin's password protection.
- Product
- Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease
- Affected
- up to 2.6.6
- What to do
- Affects up to 2.6.6. Update Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 14, 2024Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode): Stored Cross-Site ScriptingCVE-2024-4446 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagingType’ parameter in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode)
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 14, 2024Pods – Custom Content Types and Fields: Stored Cross-Site ScriptingCVE-2024-3956 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pod Form widget in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Pods – Custom Content Types and Fields
- Affected
- up to 3.2.1
- What to do
- Affects up to 3.2.1. Update Pods – Custom Content Types and Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.