Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

1,207 results · page 11 of 25

May 24, 2024Event post: Unauthorized bulk metadata updateCVE-2024-1376 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. This makes it possible for authenticated attackers, with subscriber access or higher, to update post_meta_data.
Product
Event post
Affected
up to 5.9.4
What to do
Affects up to 5.9.4. Update Event post to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
May 23, 2024The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attackCVE-2024-4399 · WordPress plugins & themes · reported by WPScanCritical 9.1
The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2024This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the serverCVE-2024-4388 · WordPress plugins & themes · reported by WPScanHigh 7.5
This does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record wpscan.com wpscan.com
May 23, 2024Brizy – Page Builder: Unauthorized plugin setting updateCVE-2024-3711 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized plugin setting update due to a missing capability check on the functions action_request_disable, action_change_template, and action_request_enable in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with contributor access or above, to enable/disable the Brizy editor and modify the template used.
Product
Brizy – Page Builder
Affected
up to 2.4.43
What to do
Affects up to 2.4.43. Update Brizy – Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 20, 2024All in One SEO: Does not validate and escape some of its Post fields before outputting them backCVE-2024-3368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The All in One SEO WordPress plugin before 4.6.1.1 does not validate and escape some of its Post fields before outputting them back, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
All in One SEO
Fixed in
4.6.1.1
What to do
Update All in One SEO to 4.6.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 17, 2024socialdriver-framework: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-2697 · WordPress plugins & themes · reported by WPScanMedium 6.5
The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Product
socialdriver-framework
Fixed in
2024.0.0
What to do
Update socialdriver-framework to 2024.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Ultimate Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3241 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Ultimate Blocks
Fixed in
3.1.7
What to do
Update Ultimate Blocks to 3.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 14, 2024Post Grid Gutenberg Blocks and WordPress Blog: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-3239 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Post Grid Gutenberg Blocks and WordPress Blog
Fixed in
4.0.2
What to do
Update Post Grid Gutenberg Blocks and WordPress Blog to 4.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 3, 2024Carousel Slider: Does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embedCVE-2024-3703 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks
Product
Carousel Slider
Fixed in
2.2.10
What to do
Update Carousel Slider to 2.2.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 3, 2024Gutenverse: Does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embedCVE-2024-3692 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Gutenverse WordPress plugin before 1.9.1 does not validate the htmlTag option in various of its block before outputting it back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenverse
Fixed in
1.9.1
What to do
Update Gutenverse to 1.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 2, 2024WP Datepicker: Unauthorized modification of dataCVE-2024-3895 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_new_datepicker_ajax() function in all versions up to, and including, 2.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options that can be used for privilege escalation. This was partially patched in 2.0.9 and 2.1.0, and fully patched in 2.1.1.
Product
WP Datepicker
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 26, 2024WP Shortcodes Plugin — Shortcodes Ultimate: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3188 · WordPress plugins & themes · reported by WPScanMedium 6.3
The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Fixed in
7.1.0
What to do
Update WP Shortcodes Plugin — Shortcodes Ultimate to 7.1.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024MM-email2image: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-3075 · WordPress plugins & themes · reported by WPScanHigh 8.1
The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
MM-email2image
Affected
up to 0.2.5
What to do
Affects up to 0.2.5. Update MM-email2image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 26, 2024Social Sharing: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-2159 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Social Sharing
Fixed in
3.3.61
What to do
Update Social Sharing to 3.3.61 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 24, 2024Strong Testimonials: Does not validate and escape some of its Testimonial fields before outputting them back in a page/postCVE-2024-3261 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Strong Testimonials WordPress plugin before 3.1.12 does not validate and escape some of its Testimonial fields before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The attack requires a specific view to be performed
Product
Strong Testimonials
Fixed in
3.1.12
What to do
Update Strong Testimonials to 3.1.12 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 17, 2024MJ Update History: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32543 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Minoji MJ Update History allows Reflected XSS.This issue affects MJ Update History: from n/a through 1.0.4.
Product
MJ Update History
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update MJ Update History to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 17, 2024Easy Social Feed: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2024-1219 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin
Product
Easy Social Feed
Fixed in
6.5.6
What to do
Update Easy Social Feed to 6.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Order Delivery Date for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-32434 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Order Delivery Date for WooCommerce.This issue affects Order Delivery Date for WooCommerce: from n/a through 3.20.2.
Product
Order Delivery Date for WooCommerce
Affected
up to 3.20.2
What to do
Affects up to 3.20.2. Update Order Delivery Date for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 15, 2024The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URLCVE-2024-1849 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Customer Reviews WordPress plugin before 3.7.1 does not validate a parameter allowing contributor and above users to redirect a page to a malicious URL
Product
WP Customer Reviews
Fixed in
3.7.1
What to do
Update WP Customer Reviews to 3.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Responsive Tabs: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1846 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Tabs WordPress plugin before 4.0.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Tabs
Fixed in
4.0.7
What to do
Update Responsive Tabs to 4.0.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024Everest Backup: Does not properly validate backup files to be uploadedCVE-2023-7201 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Everest Backup WordPress plugin before 2.2.5 does not properly validate backup files to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
Everest Backup
Fixed in
2.2.5
What to do
Update Everest Backup to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 15, 2024WP User Profile Avatar: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6067 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP User Profile Avatar WordPress plugin through 1.0.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
WP User Profile Avatar
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update WP User Profile Avatar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 5, 2024Gutenberg Blocks by Kadence Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-2509 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Gutenberg Blocks by Kadence Blocks
Fixed in
3.2.26
What to do
Update Gutenberg Blocks by Kadence Blocks to 3.2.26 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Apr 2, 2024Page Builder Gutenberg Blocks: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2024-2369 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Page Builder Gutenberg Blocks
Fixed in
3.1.7
What to do
Update Page Builder Gutenberg Blocks to 3.1.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 25, 2024The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of posCVE-2024-1564 · WordPress plugins & themes · reported by WPScanMedium 4.3
The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode
Product
wp-schema-pro
Fixed in
2.7.16
What to do
Update wp-schema-pro to 2.7.16 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2024Tabs Shortcode and Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-0719 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Tabs Shortcode and Widget WordPress plugin through 1.17 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Tabs Shortcode and Widget
Affected
up to 1.17
What to do
Affects up to 1.17. Update Tabs Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2024Buttons Shortcode and Widget: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-0711 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Buttons Shortcode and Widget WordPress plugin through 1.16 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Buttons Shortcode and Widget
Affected
up to 1.16
What to do
Affects up to 1.16. Update Buttons Shortcode and Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2024Grid Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1658 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Grid Shortcodes
Fixed in
1.1.1
What to do
Update Grid Shortcodes to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2024Responsive Pricing Table: Does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embedCVE-2024-1333 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks
Product
Responsive Pricing Table
Fixed in
5.1.11
What to do
Update Responsive Pricing Table to 5.1.11 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 18, 2024Team Members: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2024-1331 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
Product
Team Members
Fixed in
5.3.2
What to do
Update Team Members to 5.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2024Ultimate Posts Widget: Does not validate and escape some of its Widget options before outputting them back in attributesCVE-2024-0561 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Ultimate Posts Widget
Fixed in
2.3.1
What to do
Update Ultimate Posts Widget to 2.3.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 11, 2024Enhanced Text Widget: Does not validate and escape some of its Widget options before outputting them back in attributesCVE-2024-0559 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Enhanced Text Widget WordPress plugin before 1.6.6 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Enhanced Text Widget
Fixed in
1.6.6
What to do
Update Enhanced Text Widget to 1.6.6 or newer.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Feb 28, 2024Royal Elementor Addons and Templates: Unauthorized post metadata updateCVE-2024-0516 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_update_form_action_meta function in all versions up to, and including, 1.3.87. This makes it possible for unauthenticated attackers to update certain metadata.
Product
Royal Elementor Addons and Templates
Affected
up to 1.3.87
What to do
Affects up to 1.3.87. Update Royal Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 27, 2024WP JobSearch: Does not validate files to be uploadedCVE-2023-6585 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server
Product
WP JobSearch
Fixed in
2.3.4
What to do
Update WP JobSearch to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 12, 2024Popup Builder: Does not validate a parameter before making a request to itCVE-2023-6294 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations.
Product
Popup Builder
Fixed in
4.2.6
What to do
Update Popup Builder to 4.2.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 5, 2024Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels: Unauthorized arbitrary options updateCVE-2024-0869 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the instant-images/license REST API endpoint in all versions up to, and including, 6.1.0. This makes it possible for authors and higher to update arbitrary options. CVE-2024-33569 appears to be a duplicate of this issue.
Product
Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels
Affected
up to 6.1.0
What to do
Affects up to 6.1.0. Update Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Royal Elementor Kit: Unauthorized arbitrary transient updateCVE-2024-0835 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler function in all versions up to, and including, 1.0.116. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to true and not arbitrary values.
Product
Royal Elementor Kit
Affected
up to 1.0.116
What to do
Affects up to 1.0.116. Update Royal Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org wordpress.org
Feb 5, 2024Order Delivery Date for WP e-Commerce: Stored Cross-Site ScriptingCVE-2024-0678 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note this only affects the version of the "order-delivery-date" plugin for WP Ecommerce which was hosted in the WordPress repository and is discontinued now. The version of the plugin hosted off of the repository titled 'Order Delivery Date' for WooCommerce is not affected.
Product
Order Delivery Date for WP e-Commerce
Affected
up to 1.2
What to do
Affects up to 1.2. Update Order Delivery Date for WP e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Cookie Information | Free GDPR Consent Solution: Arbitrary option updatesCVE-2023-6700 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Cookie Information | Free GDPR Consent Solution plugin for WordPress is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler in versions up to, and including, 2.0.22. This makes it possible for authenticated attackers, with subscriber-level access or higher, to edit arbitrary site options which can be used to create administrator accounts.
Product
Cookie Information | Free GDPR Consent Solution
Affected
up to 2.0.22
What to do
Affects up to 2.0.22. Update Cookie Information | Free GDPR Consent Solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 29, 2024TJ Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-6530 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TJ Shortcodes WordPress plugin through 0.1.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
TJ Shortcodes
Affected
up to 0.1.3
What to do
Affects up to 0.1.3. Update TJ Shortcodes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record research.cleantalk.org wpscan.com
Jan 16, 2024WP Customer Area: Does not properly validates user capabilities in some of its AJAX actionsCVE-2023-6824 · WordPress plugins & themes · reported by WPScanMedium 6.5
The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.
Product
WP Customer Area
Fixed in
8.2.1
What to do
Update WP Customer Area to 8.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024WP Customer Area: Does not properly validate users capabilities in some of its AJAX actionsCVE-2023-6741 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WP Customer Area WordPress plugin before 8.2.1 does not properly validate users capabilities in some of its AJAX actions, allowing malicious users to edit other users' account address.
Product
WP Customer Area
Fixed in
8.2.1
What to do
Update WP Customer Area to 8.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024All in One B2B for WooCommerce: Does not properly validate parametersCVE-2023-4703 · WordPress plugins & themes · reported by WPScanHigh 7.5
The All in One B2B for WooCommerce WordPress plugin through 1.0.3 does not properly validate parameters when updating user details, allowing an unauthenticated attacker to update the details of any user. Updating the password of an Admin user leads to privilege escalation.
Product
All in One B2B for WooCommerce
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update All in One B2B for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024My Account Page Editor: Does not validate the profile picture to be uploadedCVE-2023-4536 · WordPress plugins & themes · reported by WPScanHigh 8.8
The My Account Page Editor WordPress plugin before 1.3.2 does not validate the profile picture to be uploaded, allowing any authenticated users, such as subscriber to upload arbitrary files to the server, leading to RCE
Product
My Account Page Editor
Fixed in
1.3.2
What to do
Update My Account Page Editor to 1.3.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Lana Shortcodes: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-3372 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Lana Shortcodes WordPress plugin before 1.2.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Lana Shortcodes
Fixed in
1.2.0
What to do
Update Lana Shortcodes to 1.2.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Qubely: Does not validate and escape some of its block options before outputting them back in a page/post where the block is embedCVE-2023-0376 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Qubely
Fixed in
1.8.5
What to do
Update Qubely to 1.8.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024UpQode Google Maps: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0094 · WordPress plugins & themes · reported by WPScanMedium 5.4
The UpQode Google Maps WordPress plugin through 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
UpQode Google Maps
Affected
up to 1.0.5
What to do
Affects up to 1.0.5. Update UpQode Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Customer Reviews for WooCommerce: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0079 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Customer Reviews for WooCommerce WordPress plugin before 5.17.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Product
Customer Reviews for WooCommerce
Fixed in
5.17.0
What to do
Update Customer Reviews for WooCommerce to 5.17.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Contact Form Entries: Does not validate dataCVE-2022-3604 · WordPress plugins & themes · reported by WPScanHigh 7.8
The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection.
Product
Contact Form Entries
Fixed in
1.3.0
What to do
Update Contact Form Entries to 1.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 16, 2024Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (suchCVE-2022-1538 · WordPress plugins & themes · reported by WPScanHigh 7.2
Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed.
Fixed in
1.1.1
What to do
Update the plugin to 1.1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.