Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

867 results · page 11 of 18

Sep 19, 2024MC4WP: Mailchimp for: Reflected Cross-Site ScriptingCVE-2024-8850 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email' parameter when a placeholder such as {email} is used for the field in versions 4.9.9 to 4.9.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
MC4WP: Mailchimp for
Affected
4.9.9 to 4.9.16
What to do
Affects 4.9.9 to 4.9.16. Update MC4WP: Mailchimp for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 13, 2024Email Obfuscate Shortcode: Stored Cross-Site ScriptingCVE-2024-8747 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Email Obfuscate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email-obfuscate' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Email Obfuscate Shortcode
Affected
up to 2.0
What to do
Affects up to 2.0. Update Email Obfuscate Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Sep 13, 2024WP Test Email: Reflected Cross-Site ScriptingCVE-2024-8664 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Test Email plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
WP Test Email
Affected
up to 1.1.7
What to do
Affects up to 1.1.7. Update WP Test Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 6, 2024Revision Manager TMC: Unauthorized arbitrary email sendingCVE-2024-7622 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the _a_ajaxQuickEmailTestCallback() function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to send emails with arbitrary content to any individual through the vulnerable web server.
Product
Revision Manager TMC
Affected
up to 2.8.19
What to do
Affects up to 2.8.19. Update Revision Manager TMC to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 30, 2024HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics: Stored Cross-Site ScriptingCVE-2024-5879 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' attribute of the HubSpot Meeting Widget in all versions up to, and including, 11.1.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics
Affected
up to 11.1.22
What to do
Affects up to 11.1.22. Update HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 26, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Cross-Site Request Forgery (CSRF)CVE-2024-43287 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.82.
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Affected
up to 3.1.82
What to do
Affects up to 3.1.82. Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 26, 2024Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: Cross-Site Request Forgery (CSRF)CVE-2024-39657 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.18.
Product
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
Affected
up to 2.6.18
What to do
Affects up to 2.6.18. Update Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 21, 2024AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for: Arbitrary file uploadsCVE-2024-7384 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive function in all versions up to, and including, 9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for
Affected
up to 9.7.2
What to do
Affects up to 9.7.2. Update AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 18, 2024weMail: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43238 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows DOM-Based XSS.This issue affects weMail: from n/a through <= 1.14.5.
Product
weMail
Affected
up to 1.14.5
What to do
Affects up to 1.14.5. Update weMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 13, 2024Send Users Email: Exposure of Sensitive Information to an Unauthorized ActorCVE-2024-38760 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in David Maucher Send Users Email allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Send Users Email: from n/a through 1.5.1.
Product
Send Users Email
Affected
up to 1.5.1
What to do
Affects up to 1.5.1. Update Send Users Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43126 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce allows Reflected XSS.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.14.
Product
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
Affected
up to 2.6.14
What to do
Affects up to 2.6.14. Update Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Aug 12, 2024Obfuscate Email: Full Path DisclosureCVE-2024-7413 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Obfuscate Email plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.8.1. This is due to the plugin allowing direct access to the bootstrap.php file which has display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.
Product
Obfuscate Email
Affected
up to 3.8.1
What to do
Affects up to 3.8.1. Update Obfuscate Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 30, 2024Send email only on Reply to My Comment: Does not have CSRF check in some placesCVE-2024-6224 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Product
Send email only on Reply to My Comment
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 30, 2024Send email only on Reply to My Comment: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-6223 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Send email only on Reply to My Comment
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update Send email only on Reply to My Comment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 29, 2024Email Encoder: Does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin pageCVE-2024-4483 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting
Product
Email Encoder
Fixed in
2.2.2
What to do
Update Email Encoder to 2.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 27, 2024AIomatic - Automatic AI Content Writer: Arbitrary email sending vulnerabilityCVE-2024-5969 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The AIomatic - Automatic AI Content Writer for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 2.0.5. This is due to insufficient limitations on the email recipient and the content in the 'aiomatic_send_email' function which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient.
Product
AIomatic - Automatic AI Content Writer
Affected
up to 2.0.5
What to do
Affects up to 2.0.5. Update AIomatic - Automatic AI Content Writer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jul 26, 2024Ultimate WordPress Auction: Unauthorized email creation and sendingCVE-2024-6591 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.
Product
Ultimate WordPress Auction
Affected
up to 4.2.7
What to do
Affects up to 4.2.7. Update Ultimate WordPress Auction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 22, 2024Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-37433 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.This issue affects Mailster: from n/a through <= 4.0.9.
Product
Mailster
Affected
up to 4.0.9
What to do
Affects up to 4.0.9. Update Mailster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 21, 2024CC & BCC for Woocommerce Order Emails: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37522 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dario Curasì CC & BCC for Woocommerce Order Emails allows Stored XSS.This issue affects CC & BCC for Woocommerce Order Emails: from n/a through 1.4.1.
Product
CC & BCC for Woocommerce Order Emails
Affected
up to 1.4.1
What to do
Affects up to 1.4.1. Update CC & BCC for Woocommerce Order Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024Change From Email: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-38738 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Marian Kadanka Change From Email allows Stored XSS.This issue affects Change From Email: from n/a through 1.2.1.
Product
Change From Email
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Change From Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 20, 2024WP Mail SMTP: Information exposureCVE-2024-6694 · WordPress plugins & themes · reported by WordfenceLow 2.7
The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment.
Product
WP Mail SMTP
Affected
up to 4.0.1
What to do
Affects up to 4.0.1. Update WP Mail SMTP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 17, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Unauthorized API accessCVE-2024-5703 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized API access due to a missing capability check in all versions up to, and including, 5.7.26. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access the API (provided it is enabled) and add, edit, and delete audience users.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.26
What to do
Affects up to 5.7.26. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 13, 2024CM Email Registration Blacklist and Whitelist: Does not have CSRF checkCVE-2024-5167 · WordPress plugins & themes · reported by WPScanHigh 8.1
The CM Email Registration Blacklist and Whitelist WordPress plugin before 1.4.9 does not have CSRF check when adding or deleting an item from the blacklist or whitelist, which could allow attackers to make a logged in admin add or delete settings from the blacklist or whitelist menu via a CSRF attack
Product
CM Email Registration Blacklist and Whitelist
Fixed in
1.4.9
What to do
Update CM Email Registration Blacklist and Whitelist to 1.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2024Comment Reply Email: Cross-Site Request Forgery (CSRF)CVE-2024-35773 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in WPJohnny, zerOneIT Comment Reply Email allows Cross-Site Scripting (XSS).This issue affects Comment Reply Email: from n/a through 1.3.
Product
Comment Reply Email
Affected
up to 1.3
What to do
Affects up to 1.3. Update Comment Reply Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 2, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Time-based SQL InjectionCVE-2024-6172 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37252 appears to be a duplicate of this issue.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.25
What to do
Affects up to 5.7.25. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 26, 2024Email Subscribers & Newsletters: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37252 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Icegram Email Subscribers & Newsletters allows SQL Injection.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.25.
Product
Email Subscribers & Newsletters
Affected
up to 5.7.25
What to do
Affects up to 5.7.25. Update Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 26, 2024BlossomThemes Email Newsletter: Server-Side Request Forgery (SSRF)CVE-2024-37098 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in Blossom Themes BlossomThemes Email Newsletter.This issue affects BlossomThemes Email Newsletter: from n/a through 2.2.6.
Product
BlossomThemes Email Newsletter
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update BlossomThemes Email Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 21, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Time-based SQL InjectionCVE-2024-5756 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.23
What to do
Affects up to 5.7.23. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages: Unauthorized modification of dataCVE-2024-3961 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tag_subscriber function in all versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to subscribe users to tags. Financial damages may occur to site owners if their API quota is exceeded.
Product
ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer: Unauthorized plugin settings updateCVE-2024-3602 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the disconnect_promolayer function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber access or higher, to remove the Promolayer connection.
Product
Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Cost Calculator Builder PRO: Arbitrary email sending vulnerabilityCVE-2024-4787 · WordPress plugins & themes · reported by WordfenceMedium 5.8
The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to insufficient limitations on the email recipient and the content in the 'send_pdf' and the 'send_pdf_front' functions which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient.
Product
Cost Calculator Builder PRO
Affected
up to 3.1.75
What to do
Affects up to 3.1.75. Update Cost Calculator Builder PRO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record docs.stylemixthemes.com wordfence.com
Jun 15, 2024WooCommerce - Social Login: Email VerificationCVE-2024-5868 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.
Product
WooCommerce - Social Login
Affected
up to 2.6.2
What to do
Affects up to 2.6.2. Update WooCommerce - Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Jun 13, 2024CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More: PHP Object InjectionCVE-2024-4371 · WordPress plugins & themes · reported by WordfenceCritical 9
The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.1 via deserialization of untrusted input from the recently_viewed_products cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Product
CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 13, 2024Easy WP SMTP by SendLayer – WordPress SMTP and Email Log: Information exposureCVE-2024-3073 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment.
Product
Easy WP SMTP by SendLayer – WordPress SMTP and Email Log
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Easy WP SMTP by SendLayer – WordPress SMTP and Email Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 13, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-4149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
Fixed in
3.2.3
What to do
Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 12, 2024CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More: Stored Cross-Site ScriptingCVE-2024-4564 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Shop Slider, Tabs Classic, and Image Comparison widgets in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More
Affected
up to 4.4.1
What to do
Affects up to 4.4.1. Update CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 11, 2024MailerLite – WooCommerce integration: Missing AuthorizationCVE-2023-52227 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.
Product
MailerLite – WooCommerce integration
Affected
up to 2.0.8
What to do
Affects up to 2.0.8. Update MailerLite – WooCommerce integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024weMail: Missing AuthorizationCVE-2024-34822 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in weDevs weMail.This issue affects weMail: from n/a through 1.14.2.
Product
weMail
Affected
up to 1.14.2
What to do
Affects up to 1.14.2. Update weMail to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 11, 2024Post SMTP Mailer/Email Log: Missing AuthorizationCVE-2023-52233 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Missing Authorization vulnerability in Post SMTP Post SMTP Mailer/Email Log.This issue affects Post SMTP Mailer/Email Log: from n/a through 2.8.6.
Product
Post SMTP Mailer/Email Log
Affected
up to 2.8.6
What to do
Affects up to 2.8.6. Update Post SMTP Mailer/Email Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 10, 2024Easy Forms for Mailchimp: Missing AuthorizationCVE-2024-35742 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
Product
Easy Forms for Mailchimp
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 9, 2024Email Subscribers & Newsletters: Missing AuthorizationCVE-2024-31352 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Email Subscribers & Newsletters.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.13.
Product
Email Subscribers & Newsletters
Affected
up to 5.7.13
What to do
Affects up to 5.7.13. Update Email Subscribers & Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 5, 2024Email Subscribers by Icegram Express: SQL InjectionCVE-2024-4295 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Email Subscribers by Icegram Express
Affected
up to 5.7.20
What to do
Affects up to 5.7.20. Update Email Subscribers by Icegram Express to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 5, 2024BuddyForms: Email Verification BypassCVE-2024-5149 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification.
Product
BuddyForms
Affected
up to 2.8.9
What to do
Affects up to 2.8.9. Update BuddyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 4, 2024Easy Forms for Mailchimp: Insertion of Sensitive Information into Log FileCVE-2024-25095 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
Product
Easy Forms for Mailchimp
Affected
up to 6.9.0
What to do
Affects up to 6.9.0. Update Easy Forms for Mailchimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35668 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue allows Reflected XSS.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.77.
Product
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Affected
up to 3.1.77
What to do
Affects up to 3.1.77. Update Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Contact Form Email: Improper Restriction of Excessive Authentication AttemptsCVE-2023-48318 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.
Product
Contact Form Email
Affected
up to 1.3.41
What to do
Affects up to 1.3.41. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Contact Form Email: Missing AuthorizationCVE-2023-28494 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31.
Product
Contact Form Email
Affected
up to 1.3.31
What to do
Affects up to 1.3.31. Update Contact Form Email to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 30, 2024POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications: Time-based SQL InjectionCVE-2024-5207 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications plugin for WordPress is vulnerable to time-based SQL Injection via the selected parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator access or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications
Affected
up to 2.9.3
What to do
Affects up to 2.9.3. Update POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 25, 2024Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation: Stored Cross-Site ScriptingCVE-2024-4045 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘campaign_id’ parameter in versions up to, and including, 2.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation
Affected
up to 2.16.1
What to do
Affects up to 2.16.1. Update Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 24, 2024Email Log: Unauthenticated Hook InjectionCVE-2024-0867 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Email Log plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 2.4.8 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
Product
Email Log
Affected
up to 2.4.8
What to do
Affects up to 2.4.8. Update Email Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.