Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
673 results · page 10 of 14
Mar 27, 2025Trust.Reviews: Missing AuthorizationCVE-2025-30883 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trust.Reviews: from n/a through <= 2.3.
- Product
- Trust.Reviews
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Trust.Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025AliNext: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30859 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in guru-aliexpress AliNext ali2woo-lite allows Phishing.This issue affects AliNext: from n/a through <= 3.5.1.
- Product
- AliNext
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update AliNext to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025FunnelKit Automations: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30795 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects FunnelKit Automations: from n/a through <= 3.5.1.
- Product
- FunnelKit Automations
- Affected
- up to 3.5.1
- What to do
- Affects up to 3.5.1. Update FunnelKit Automations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Scheduled & Automatic Order Status Controller for WooCommerce: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-30781 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order Status Controller for WooCommerce: from n/a through <= 3.7.1.
- Product
- Scheduled & Automatic Order Status Controller for WooCommerce
- Affected
- up to 3.7.1
- What to do
- Affects up to 3.7.1. Update Scheduled & Automatic Order Status Controller for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025TranslatePress: Deserialization of Untrusted DataCVE-2025-30773 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.
- Product
- TranslatePress
- Affected
- up to 2.9.6
- What to do
- Affects up to 2.9.6. Update TranslatePress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 26, 2025Trust Payments Gateway for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-28942 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trust Payments Trust Payments Gateway for WooCommerce trust-payments-hosted-payment-pages-integration allows SQL Injection.This issue affects Trust Payments Gateway for WooCommerce: from n/a through <= 1.1.4.
- Product
- Trust Payments Gateway for WooCommerce
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Trust Payments Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 15, 2025Booking and Rental Manager: Deserialization of Untrusted DataCVE-2025-26921 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.2.6.
- Product
- Booking and Rental Manager
- Affected
- up to 2.2.6
- What to do
- Affects up to 2.2.6. Update Booking and Rental Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 11, 2025AS English Admin: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-28896 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects AS English Admin: from n/a through <= 1.0.0.
- Product
- AS English Admin
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update AS English Admin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 4, 2025Admin and Site Enhancements (ASE): Retrieves client IP addresses from potentially untrusted headersCVE-2024-13685 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.
- Product
- Admin and Site Enhancements (ASE)
- Fixed in
- 7.6.10
- What to do
- Update Admin and Site Enhancements (ASE) to 7.6.10 or newer.
Mar 3, 2025ProfileGrid: Deserialization of Untrusted DataCVE-2025-26999 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue affects ProfileGrid : from n/a through <= 5.9.4.3.
- Product
- ProfileGrid
- Affected
- up to 5.9.4.3
- What to do
- Affects up to 5.9.4.3. Update ProfileGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025Events Calendar for GeoDirectory: Deserialization of Untrusted DataCVE-2025-26967 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Stiofan Events Calendar for GeoDirectory events-for-geodirectory allows Object Injection.This issue affects Events Calendar for GeoDirectory: from n/a through <= 2.3.14.
- Product
- Events Calendar for GeoDirectory
- Affected
- up to 2.3.14
- What to do
- Affects up to 2.3.14. Update Events Calendar for GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025WordPress Assistant: Deserialization of Untrusted DataCVE-2025-26885 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant: from n/a through <= 1.5.1.
- Product
- WordPress Assistant
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update WordPress Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 25, 2025Flexmls® IDX: Deserialization of Untrusted DataCVE-2025-26900 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in flexmls Flexmls® IDX flexmls-idx allows Object Injection.This issue affects Flexmls® IDX: from n/a through <= 3.14.27.
- Product
- Flexmls® IDX
- Affected
- up to 3.14.27
- What to do
- Affects up to 3.14.27. Update Flexmls® IDX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025NHR Options Table Manager: Deserialization of Untrusted DataCVE-2025-27301 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Nazmul Hasan Robin NHR Options Table Manager nhrrob-options-table-manager allows Object Injection.This issue affects NHR Options Table Manager: from n/a through <= 1.1.2.
- Product
- NHR Options Table Manager
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update NHR Options Table Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 24, 2025ADFO: Deserialization of Untrusted DataCVE-2025-27300 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in giuliopanda ADFO admin-form allows Object Injection.This issue affects ADFO: from n/a through <= 1.9.1.
- Product
- ADFO
- Affected
- up to 1.9.1
- What to do
- Affects up to 1.9.1. Update ADFO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 22, 2025Responsive Slider by MetaSlider: Deserialization of Untrusted DataCVE-2025-26763 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Object Injection.This issue affects Responsive Slider by MetaSlider: from n/a through <= 3.94.0.
- Product
- Responsive Slider by MetaSlider
- Affected
- up to 3.94.0
- What to do
- Affects up to 3.94.0. Update Responsive Slider by MetaSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 3, 2025Taxi Booking Manager for WooCommerce: Deserialization of Untrusted DataCVE-2025-24661 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Object Injection.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.1.8.
- Product
- Taxi Booking Manager for WooCommerce
- Affected
- up to 1.1.8
- What to do
- Affects up to 1.1.8. Update Taxi Booking Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025KB Support: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24741 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in LOGON KB Support kb-support.This issue affects KB Support: from n/a through <= 1.6.7.
- Product
- KB Support
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update KB Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025LearnPress: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24740 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress learnpress.This issue affects LearnPress: from n/a through <= 4.2.7.1.
- Product
- LearnPress
- Affected
- up to 4.2.7.1
- What to do
- Affects up to 4.2.7.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025Save as PDF: Deserialization of Untrusted DataCVE-2025-24671 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF: from n/a through <= 4.4.0.
- Product
- Save as PDF
- Affected
- up to 4.4.0
- What to do
- Affects up to 4.4.0. Update Save as PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025FundPress: Deserialization of Untrusted DataCVE-2025-24601 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0.6.
- Product
- FundPress
- Affected
- up to 2.0.6
- What to do
- Affects up to 2.0.6. Update FundPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Muzaara Google Ads Report: Deserialization of Untrusted DataCVE-2025-23914 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through <= 3.1.
- Product
- Muzaara Google Ads Report
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Muzaara Google Ads Report to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025WOOEXIM: Deserialization of Untrusted DataCVE-2025-23944 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.
- Product
- WOOEXIM
- Affected
- up to 5.0.0
- What to do
- Affects up to 5.0.0. Update WOOEXIM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 22, 2025Quick Count: Deserialization of Untrusted DataCVE-2025-23932 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <= 3.00.
- Product
- Quick Count
- Affected
- up to 3.00
- What to do
- Affects up to 3.00. Update Quick Count to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49699 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 21, 2025ARPrice: Deserialization of Untrusted DataCVE-2024-49688 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.
- Product
- ARPrice
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update ARPrice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 13, 2025GiveWP: Deserialization of Untrusted DataCVE-2025-22777 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.
- Product
- GiveWP
- Affected
- up to 3.19.3
- What to do
- Affects up to 3.19.3. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comsecurityonline.info
Jan 13, 2025TRUSTist REVIEWer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22567 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in trustist TRUSTist REVIEWer trustist-reviewer allows Reflected XSS.This issue affects TRUSTist REVIEWer: from n/a through <= 2.0.
- Product
- TRUSTist REVIEWer
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update TRUSTist REVIEWer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2025WC Price History for Omnibus: Deserialization of Untrusted DataCVE-2025-22510 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.
- Product
- WC Price History for Omnibus
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update WC Price History for Omnibus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025PlainInventory: Deserialization of Untrusted DataCVE-2024-56291 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.
- Product
- PlainInventory
- Affected
- up to 3.1.6
- What to do
- Affects up to 3.1.6. Update PlainInventory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025Locatoraid Store Locator: Deserialization of Untrusted DataCVE-2024-56283 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.50.
- Product
- Locatoraid Store Locator
- Affected
- up to 3.9.50
- What to do
- Affects up to 3.9.50. Update Locatoraid Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 7, 2025WPGuppy: Deserialization of Untrusted DataCVE-2024-49222 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Object Injection.This issue affects WPGuppy: from n/a through <= 1.1.0.
- Product
- WPGuppy
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update WPGuppy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024WP SuperBackup: Deserialization of Untrusted DataCVE-2024-56068 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.
- Product
- WP SuperBackup
- Affected
- up to 2.3.3
- What to do
- Affects up to 2.3.3. Update WP SuperBackup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2024VRPConnector: Deserialization of Untrusted DataCVE-2024-56058 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in denniskravetstns VRPConnector vrpconnector allows Object Injection.This issue affects VRPConnector: from n/a through <= 2.0.1.
- Product
- VRPConnector
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update VRPConnector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 16, 2024ForumWP: Deserialization of Untrusted DataCVE-2024-54367 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Ultimate Member ForumWP forumwp allows Object Injection.This issue affects ForumWP: from n/a through <= 2.1.0.
- Product
- ForumWP
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update ForumWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024WP Mega Menu: Deserialization of Untrusted DataCVE-2024-54282 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu wp-megamenu allows Object Injection.This issue affects WP Mega Menu: from n/a through <= 1.4.2.
- Product
- WP Mega Menu
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update WP Mega Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024Mail Picker: Deserialization of Untrusted DataCVE-2024-54273 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in PickPlugins Mail Picker mail-picker allows Object Injection.This issue affects Mail Picker: from n/a through <= 1.0.14.
- Product
- Mail Picker
- Affected
- up to 1.0.14
- What to do
- Affects up to 1.0.14. Update Mail Picker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Login Widget With Shortcode: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-54255 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue affects Login Widget With Shortcode: from n/a through <= 6.1.2.
- Product
- Login Widget With Shortcode
- Affected
- up to 6.1.2
- What to do
- Affects up to 6.1.2. Update Login Widget With Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024QRMenu Restaurant QR Menu Lite: Deserialization of Untrusted DataCVE-2024-52445 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in ModelTheme QRMenu Restaurant QR Menu Lite qrmenu-lite allows Object Injection.This issue affects QRMenu Restaurant QR Menu Lite: from n/a through <= 1.0.4.
- Product
- QRMenu Restaurant QR Menu Lite
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update QRMenu Restaurant QR Menu Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Geolocator: Deserialization of Untrusted DataCVE-2024-52443 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in masikonis Geolocator geolocator allows Object Injection.This issue affects Geolocator: from n/a through <= 1.1.
- Product
- Geolocator
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Geolocator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Xpresslane Fast Checkout: Deserialization of Untrusted DataCVE-2024-52440 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in xpresslane Xpresslane Fast Checkout xpresslane-integration-for-woocommerce allows Object Injection.This issue affects Xpresslane Fast Checkout: from n/a through <= 1.0.0.
- Product
- Xpresslane Fast Checkout
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Xpresslane Fast Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Team Rosters: Deserialization of Untrusted DataCVE-2024-52439 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mark O'Donnell Team Rosters team-rosters allows Object Injection.This issue affects Team Rosters: from n/a through <= 4.8.2.
- Product
- Team Rosters
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Team Rosters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Popup by Supsystic: Deserialization of Untrusted DataCVE-2024-52434 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsystic: from n/a through <= 1.10.29.
- Product
- Popup by Supsystic
- Affected
- up to 1.10.29
- What to do
- Affects up to 1.10.29. Update Popup by Supsystic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024My Geo Posts Free: Deserialization of Untrusted DataCVE-2024-52433 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo Posts Free: from n/a through <= 1.2.
- Product
- My Geo Posts Free
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update My Geo Posts Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024NIX Anti-Spam Light: Deserialization of Untrusted DataCVE-2024-52432 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Object Injection.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.
- Product
- NIX Anti-Spam Light
- Affected
- up to 0.0.4
- What to do
- Affects up to 0.0.4. Update NIX Anti-Spam Light to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Lis Video Gallery: Deserialization of Untrusted DataCVE-2024-52430 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through <= 0.2.1.
- Product
- Lis Video Gallery
- Affected
- up to 0.2.1
- What to do
- Affects up to 0.2.1. Update Lis Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Event Tickets with Ticket Scanner: Deserialization of Untrusted DataCVE-2024-52427 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SSI) Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.3.11.
- Product
- Event Tickets with Ticket Scanner
- Affected
- up to 2.3.11
- What to do
- Affects up to 2.3.11. Update Event Tickets with Ticket Scanner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024WDES Responsive Mobile Menu: Deserialization of Untrusted DataCVE-2024-52414 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu wdes-responsive-mobile-menu allows Object Injection.This issue affects WDES Responsive Mobile Menu: from n/a through <= 5.3.18.
- Product
- WDES Responsive Mobile Menu
- Affected
- up to 5.3.18
- What to do
- Affects up to 5.3.18. Update WDES Responsive Mobile Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Airin Blog: Deserialization of Untrusted DataCVE-2024-52413 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in dmcwebzone Airin Blog airin-blog allows Object Injection.This issue affects Airin Blog: from n/a through <= 1.6.1.
- Product
- Airin Blog
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Airin Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 16, 2024Xin: Deserialization of Untrusted DataCVE-2024-52412 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Stephen Cui Xin allows Object Injection.This issue affects Xin: from n/a through 1.0.8.1.
- Product
- Xin
- Affected
- up to 1.0.8.1
- What to do
- Affects up to 1.0.8.1. Update Xin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.