Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
706 results · page 10 of 15
Oct 16, 2024Ahime Image Printer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49245 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through <= 1.0.0.
- Product
- Ahime Image Printer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ahime Image Printer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024Top Bar – PopUps – by WPOptin: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47645 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows PHP Local File Inclusion.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.1.
- Product
- Top Bar – PopUps – by WPOptin
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Top Bar – PopUps – by WPOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024LiteSpeed Cache: Relative Path TraversalCVE-2024-47637 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.
- Product
- LiteSpeed Cache
- Affected
- up to 6.4.1
- What to do
- Affects up to 6.4.1. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024MaxSlider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47351 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.This issue affects MaxSlider: from n/a through <= 1.2.3.
- Product
- MaxSlider
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update MaxSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024BuddyPress Better Registration: Authentication Bypass Using an Alternate Path or ChannelCVE-2024-49247 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in SK BuddyPress Better Registration better-bp-registration allows Authentication Bypass.This issue affects BuddyPress Better Registration: from n/a through <= 1.6.
- Product
- BuddyPress Better Registration
- Affected
- up to 1.6
- What to do
- Affects up to 1.6. Update BuddyPress Better Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 14, 2024WPIDE – File Manager & Code Editor: Full Path DisclosureCVE-2024-9546 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- WPIDE – File Manager & Code Editor
- Affected
- up to 3.4.9
- What to do
- Affects up to 3.4.9. Update WPIDE – File Manager & Code Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 12, 2024WordPress File Upload: Path TraversalCVE-2024-9047 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
- Product
- WordPress File Upload
- Affected
- up to 4.24.11
- What to do
- Affects up to 4.24.11. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 5, 2024WP Timeline – Vertical and Horizontal timeline: Path Traversal: '.../...//'CVE-2024-47324 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Path Traversal: '.../...//' vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7.
- Product
- WP Timeline – Vertical and Horizontal timeline
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update WP Timeline – Vertical and Horizontal timeline to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Cities Shipping Zones for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47309 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Condless Cities Shipping Zones for WooCommerce cities-shipping-zones-for-woocommerce allows PHP Local File Inclusion.This issue affects Cities Shipping Zones for WooCommerce: from n/a through <= 1.2.7.
- Product
- Cities Shipping Zones for WooCommerce
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Cities Shipping Zones for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WPSPX: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44034 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Martin Greenwood WPSPX wpspx allows PHP Local File Inclusion.This issue affects WPSPX: from n/a through <= 1.0.2.
- Product
- WPSPX
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WPSPX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Instant Chat Floating Button for WordPress Websites: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44018 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Instant Chat Floating Button for WordPress Websites instant-chat-wp allows PHP Local File Inclusion.This issue affects Instant Chat Floating Button for WordPress Websites: from n/a through <= 1.0.5.
- Product
- Instant Chat Floating Button for WordPress Websites
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Instant Chat Floating Button for WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024CSS JS Files: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-9146 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in jamesdlow CSS JS Files css-js-files allows Path Traversal.This issue affects CSS JS Files: from n/a through <= 1.5.0.
- Product
- CSS JS Files
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update CSS JS Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Podiant: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44016 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in amarksteadman Podiant podiant allows PHP Local File Inclusion.This issue affects Podiant: from n/a through <= 1.1.
- Product
- Podiant
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Podiant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Users Control: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44015 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Users Control users-control allows PHP Local File Inclusion.This issue affects Users Control: from n/a through <= 1.0.16.
- Product
- Users Control
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update Users Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Vmax Project Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44014 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vmax Studio Vmax Project Manager vmax-project-manager allows PHP Local File Inclusion.This issue affects Vmax Project Manager: from n/a through <= 1.0.
- Product
- Vmax Project Manager
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Vmax Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024VR Calendar: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44013 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innate Images LLC VR Calendar vr-calendar-sync allows PHP Local File Inclusion.This issue affects VR Calendar: from n/a through <= 2.4.0.
- Product
- VR Calendar
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update VR Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WP Newsletter Subscription: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44012 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpdev33 WP Newsletter Subscription wp-newsletter-subscription allows PHP Local File Inclusion.This issue affects WP Newsletter Subscription: from n/a through <= 1.1.
- Product
- WP Newsletter Subscription
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Newsletter Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WP Ticket Ultra Help Desk & Support: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExpressTech Systems WP Ticket Ultra Help Desk & Support Plugin wp-ticket-ultra allows PHP Local File Inclusion.This issue affects WP Ticket Ultra Help Desk & Support Plugin: from n/a through <= 1.0.5.
- Product
- WP Ticket Ultra Help Desk & Support
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WP Ticket Ultra Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2024Checkout Mestres WP: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44030 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Absolute Path Traversal.This issue affects Checkout Mestres WP: from n/a through <= 8.6.
- Product
- Checkout Mestres WP
- Affected
- up to 8.6
- What to do
- Affects up to 8.6. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2024MH Board: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44017 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MinHyeong Lim MH Board mh-board allows PHP Local File Inclusion.This issue affects MH Board: from n/a through <= 1.3.2.1.
- Product
- MH Board
- Affected
- up to 1.3.2.1
- What to do
- Affects up to 1.3.2.1. Update MH Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 24, 2024Community by PeepSo – Social Network, Membership, Registration, User Profiles: Full Path DisclosureCVE-2024-7426 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.6.0. This is due to the plugin displaying errors and allowing direct access to the sse.php file. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Community by PeepSo – Social Network, Membership, Registration, User Profiles
- Affected
- up to 6.4.6.0
- What to do
- Affects up to 6.4.6.0. Update Community by PeepSo – Social Network, Membership, Registration, User Profiles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Sep 22, 2024ElementsKit Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.This issue affects ElementsKit Pro: from n/a through 3.6.0.
- Product
- ElementsKit Pro
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update ElementsKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2024Custom Post Limits: Full path disclosureCVE-2024-6544 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Custom Post Limits
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update Custom Post Limits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 13, 2024Favicon Generator (CLOSED): Does not have CSRF and path validation in the output_sub_admin_page_0() functionCVE-2024-7864 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not have CSRF and path validation in the output_sub_admin_page_0() function, allowing attackers to make logged in admins delete arbitrary files on the server
- Product
- Favicon Generator (CLOSED)
- Fixed in
- 2.1
- What to do
- Update Favicon Generator (CLOSED) to 2.1 or newer.
Sep 7, 2024Big File Uploads – Increase Maximum File Upload Size: Full Path DisclosureCVE-2024-8538 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.1.2. This is due the plugin not sanitizing a file path in an error message. This makes it possible for authenticated attackers, with author-level access and above, to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Big File Uploads – Increase Maximum File Upload Size
- Affected
- up to 2.1.2
- What to do
- Affects up to 2.1.2. Update Big File Uploads – Increase Maximum File Upload Size to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Sep 6, 2024Remember Me Controls: Full Path DisclosureCVE-2024-7415 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0.1. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Remember Me Controls
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Remember Me Controls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024Animated Number Counters: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43957 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sk. Abul Hasan Animated Number Counters allows PHP Local File Inclusion.This issue affects Animated Number Counters: from n/a through 1.9.
- Product
- Animated Number Counters
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Animated Number Counters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024Droip: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43955 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip: from n/a through 1.1.1.
- Product
- Droip
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024GiveWP – Donation Plugin and Fundraising Platform: Full Path DisclosureCVE-2024-6551 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.15.1. This is due to the plugin utilizing Symfony and leaving display_errors on within test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- GiveWP – Donation Plugin and Fundraising Platform
- Affected
- up to 3.15.1
- What to do
- Affects up to 3.15.1. Update GiveWP – Donation Plugin and Fundraising Platform to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 21, 2024Flamix: Bitrix24 and Contact Form 7 integrations: Full Path DisclosureCVE-2024-6568 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.1.0. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Flamix: Bitrix24 and Contact Form 7 integrations
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update Flamix: Bitrix24 and Contact Form 7 integrations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 19, 2024Landing Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43345 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion.This issue affects Landing Page Builder: from n/a through 1.5.2.0.
- Product
- Landing Page Builder
- Affected
- up to 1.5.2.0
- What to do
- Affects up to 1.5.2.0. Update Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024EmbedPress: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43328 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress allows PHP Local File Inclusion.This issue affects EmbedPress: from n/a through 4.0.9.
- Product
- EmbedPress
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Void Elementor Post Grid Addon for Elementor Page builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43281 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VOID CODERS Void Elementor Post Grid Addon for Elementor Page builder allows PHP Local File Inclusion.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through 2.3.
- Product
- Void Elementor Post Grid Addon for Elementor Page builder
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Void Elementor Post Grid Addon for Elementor Page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Woo Products Widgets For Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43271 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themelocation Woo Products Widgets For Elementor allows PHP Local File Inclusion.This issue affects Woo Products Widgets For Elementor: from n/a through 2.0.0.
- Product
- Woo Products Widgets For Elementor
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Woo Products Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Bit Form Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43248 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.This issue affects Bit Form Pro: from n/a through 2.6.4.
- Product
- Bit Form Pro
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Bit Form Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Timeline and History slider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43232 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP OnlineSupport, Essential Plugin Timeline and History slider allows PHP Local File Inclusion.This issue affects Timeline and History slider: from n/a through 2.3.
- Product
- Timeline and History slider
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Timeline and History slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024JetGridBuilder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43221 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetGridBuilder allows PHP Local File Inclusion.This issue affects JetGridBuilder: from n/a through 1.1.2.
- Product
- JetGridBuilder
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update JetGridBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 15, 2024Newsletters: Full Path DisclosureCVE-2024-7411 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Newsletters plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.9.9. This is due the plugin not preventing direct access to the /vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Newsletters
- Affected
- up to 4.9.9
- What to do
- Affects up to 4.9.9. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2024WPSection: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43165 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rashid87 WPSection allows PHP Local File Inclusion.This issue affects WPSection: from n/a through 1.3.8.
- Product
- WPSection
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update WPSection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024Ultimate Bootstrap Elements for Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43140 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.4.
- Product
- Ultimate Bootstrap Elements for Elementor
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Ultimate Bootstrap Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024Event Manager for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43138 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1.
- Product
- Event Manager for WooCommerce
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Event Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024WPCafe: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43135 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through 2.2.28.
- Product
- WPCafe
- Affected
- up to 2.2.28
- What to do
- Affects up to 2.2.28. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024BetterDocs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43129 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper BetterDocs allows PHP Local File Inclusion.This issue affects BetterDocs: from n/a through 3.5.8.
- Product
- BetterDocs
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024WooCommerce PDF Vouchers: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39651 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPWeb WooCommerce PDF Vouchers allows File Manipulation.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.
- Product
- WooCommerce PDF Vouchers
- Fixed in
- 4.9.5
- What to do
- Update WooCommerce PDF Vouchers to 4.9.5 or newer.
Aug 12, 2024Reveal Template: Full Path DisclosureCVE-2024-7416 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Reveal Template plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.7. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Reveal Template
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update Reveal Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 12, 2024PDF Builder for WPForms: Full Path DisclosureCVE-2024-7414 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PDF Builder for WPForms plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.116. This is due to the plugin allowing direct access to the composer-setup.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- PDF Builder for WPForms
- Affected
- up to 1.2.116
- What to do
- Affects up to 1.2.116. Update PDF Builder for WPForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 12, 2024Obfuscate Email: Full Path DisclosureCVE-2024-7413 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- Obfuscate Email
- Affected
- up to 3.8.1
- What to do
- Affects up to 3.8.1. Update Obfuscate Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 12, 2024No Update Nag: Full Path DisclosureCVE-2024-7412 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The No Update Nag plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.12. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- No Update Nag
- Affected
- up to 1.4.12
- What to do
- Affects up to 1.4.12. Update No Update Nag to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 12, 2024My Custom CSS PHP & ADS: Full Path DisclosureCVE-2024-7410 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The My Custom CSS PHP & ADS plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.3. This is due the plugin not preventing direct access to the /my-custom-css/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php file and and the file displaying/generating the full path. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
- Product
- My Custom CSS PHP & ADS
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update My Custom CSS PHP & ADS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Aug 12, 2024Linkify Text: Full Path DisclosureCVE-2024-7382 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Linkify Text plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.9.1. This is due to the plugin utilizing bootstrap and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own and requires another vulnerability to be present for damage to an affected website.
- Product
- Linkify Text
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update Linkify Text to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.