Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,038 results · page 11 of 41
Apr 3, 2025Shopify to WooCommerce Migration: Missing AuthorizationCVE-2025-31795 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Plugin Devs Shopify to WooCommerce Migration migrate-shopify-to-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shopify to WooCommerce Migration: from n/a through <= 1.3.0.
- Product
- Shopify to WooCommerce Migration
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update Shopify to WooCommerce Migration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 2, 2025SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClustCVE-2025-29085 · Other software · reported by MITRECritical 9.8
SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Apr 2, 2025Shopper Approved Reviews: Unauthorized modification of data that can lead to privilege escalationCVE-2025-3063 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
- Product
- Shopper Approved Reviews
- Affected
- 2.0 to 2.1
- What to do
- Affects 2.0 to 2.1. Update Shopper Approved Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 1, 2025Shopper: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-31534 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shopperdotcom Shopper shopper allows SQL Injection.This issue affects Shopper: from n/a through <= 3.2.5.
- Product
- Shopper
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Shopper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025ShopCred: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31829 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devscred ShopCred shopcred allows DOM-Based XSS.This issue affects ShopCred: from n/a through <= 1.3.0.
- Product
- ShopCred
- Affected
- up to 1.3.0
- What to do
- Affects up to 1.3.0. Update ShopCred to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 28, 2025shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.CVE-2025-28094 · Other software · Shopxo · reported by MITREMedium 6.5
shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.CVE-2025-28093 · Other software · Shopxo · reported by MITREMedium 6.3
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.CVE-2025-28092 · Other software · Shopxo · reported by MITREMedium 6.3
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025GetShop ecommerce: Path Traversal: '.../...//'CVE-2024-54362 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in boggibill GetShop ecommerce getshop-ecommerce allows Path Traversal.This issue affects GetShop ecommerce: from n/a through <= 1.3.
- Product
- GetShop ecommerce
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update GetShop ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025Pitchfork is a preforking HTTP server for Rack applications.CVE-2025-30221 · Other software · Shopify · reported by GitHubMedium 4.3
Pitchfork is a preforking HTTP server for Rack applications. Versions prior to 0.11.0 are vulnerable to HTTP Response Header Injection when used in conjunction with Rack 3. The issue was fixed in Pitchfork release 0.11.0. No known workarounds are available.
- Product
- pitchfork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025wpShopGermany IT-RECHT KANZLEI: Cross-Site Request Forgery (CSRF)CVE-2025-30804 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in maennchen1.de wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei allows Cross Site Request Forgery.This issue affects wpShopGermany IT-RECHT KANZLEI: from n/a through <= 2.0.
- Product
- wpShopGermany IT-RECHT KANZLEI
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update wpShopGermany IT-RECHT KANZLEI to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2025A code execution vulnerability exists in the Xiaomi shop applicationproduct.CVE-2024-45354 · Computers, phones & browsers · Xiaomi · reported by security@xiaomi.comMedium 4.3
A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.
- Product
- Xiaomi shop application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2025A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their CVE-2025-25225 · Other software · hikashop.com · reported by security@joomla.orgMedium 6.5
A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator) to escalate their privileges to Super Admin Permissions.
- Product
- Hikashop component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhikashop.com
Mar 14, 2025CiyaShop - Multipurpose WooCommerce: PHP Object InjectionCVE-2024-13824 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CiyaShop - Multipurpose WooCommerce Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.19.0 via deserialization of untrusted input in the 'add_ciyashop_wishlist' and 'ciyashop_get_compare' functions. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Product
- CiyaShop - Multipurpose WooCommerce
- Affected
- up to 4.19.0
- What to do
- Affects up to 4.19.0. Update CiyaShop - Multipurpose WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Mar 12, 2025ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor): A Stored DOM-Based Cross-Site ScriptingCVE-2025-1527 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to a Stored DOM-Based Cross-Site Scripting via the plugin's Flash Sale Countdown module in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor)
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Mar 4, 2025yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface.CVE-2025-25426 · Other software · Guchengwuyue · reported by MITREHigh 7.2
yshopmall <=v1.9.0 is vulnerable to SQL Injection in the image listing interface.
- Product
- Yshopmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 3, 2025A vulnerability was found in Codezips Online Shopping Website 1.0.CVE-2025-1903 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability was found in Codezips Online Shopping Website 1.0. It has been rated as critical. This issue affects some unknown processing of the file /cart_add.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Shopping Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025WizShop: Path Traversal: '.../...//'CVE-2025-25122 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Path Traversal: '.../...//' vulnerability in hashshop WizShop wizshop allows Path Traversal.This issue affects WizShop: from n/a through <= 3.0.2.
- Product
- WizShop
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update WizShop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 3, 2025A vulnerability classified as critical was found in Codezips Online Shopping Website 1.0.CVE-2025-1858 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Codezips Online Shopping Website 1.0. This vulnerability affects unknown code of the file /success.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Shopping Website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2025Cross-Site Scripting (XSS) vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ paraCVE-2025-1776 · Other software · Soteshop · reported by cve-coordination@incibe.esMedium 6.1
Cross-Site Scripting (XSS) vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ parameter in /app-google-custom-search/searchResults. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.
- Product
- Soteshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.CVE-2025-26325 · Other software · Shopxo · reported by MITRECritical 9.8
ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary CVE-2025-22211 · Other software · webdesigner-profi.de · reported by security@joomla.orgLow 3.4
A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the country management area in backend.
- Product
- JoomShopping component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwebdesigner-profi.de
Feb 25, 2025A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL CVE-2025-22210 · Other software · hikashop.com · reported by security@joomla.orgHigh 7.2
A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the category management area in backend.
- Product
- Hikashop component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhikashop.com
Feb 24, 2025An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file.CVE-2024-57685 · Other software · Sparkshop · reported by MITREMedium 5.3
An issue in sparkshop v.1.1.7 and before allows a remote attacker to execute arbitrary code via a crafted phar file.
- Product
- Sparkshop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2025A vulnerability was found in ShopXO up to 6.4.0.CVE-2025-1611 · Other software · Shopxo · reported by VulDBMedium 5.1
A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService.php of the component Template Handler. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Shopxo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2025Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing.CVE-2025-27090 · Other software · BishopFox · reported by GitHubMedium 6.9
Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so. The only impact that has been shown is the exposure of the server's IP address to a third party. This issue has been addressed in version 1.5.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- sliver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025Ecwid by Lightspeed Ecommerce Shopping Cart: Cross-Site Request ForgeryCVE-2024-13795 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.12.27. This is due to missing or incorrect nonce validation on the ecwid_deactivate_feedback() function. This makes it possible for unauthenticated attackers to send deactivation messages on behalf of a site owner via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ecwid by Lightspeed Ecommerce Shopping Cart
- Affected
- up to 6.12.27
- What to do
- Affects up to 6.12.27. Update Ecwid by Lightspeed Ecommerce Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 18, 2025Shopwarden – Automated WooCommerce monitoring & testing: Cross-Site Request ForgeryCVE-2024-13315 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.11. This is due to missing or incorrect nonce validation on the save_setting() function. This makes it possible for unauthenticated attackers to update arbitrary options and achieve privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Shopwarden – Automated WooCommerce monitoring & testing
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Shopwarden – Automated WooCommerce monitoring & testing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 12, 2025Stored Cross-Site Scripting (XSS) vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user input through ‘/<admin_directory>/index.php’, CVE-2025-1230 · Websites & servers · Prestashop · reported by cve-coordination@incibe.esMedium 4.8
Stored Cross-Site Scripting (XSS) vulnerability in Prestashop 8.1.7, due to the lack of proper validation of user input through ‘/<admin_directory>/index.php’, affecting the ‘link’ parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
- Product
- Prestashop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Photoshop Elements versions 2025.0 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could resCVE-2025-21162 · Other software · Adobe · reported by AdobeMedium 5.5
Photoshop Elements versions 2025.0 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025ShopSite: Cross-Site Request ForgeryCVE-2024-13510 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ShopSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.10. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- ShopSite
- Affected
- up to 1.5.10
- What to do
- Affects up to 1.5.10. Update ShopSite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 30, 2025W2S – Migrate WooCommerce to Shopify: Arbitrary File ReadCVE-2024-12861 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The W2S – Migrate WooCommerce to Shopify plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.2.1 via the 'viw2s_view_log' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- W2S – Migrate WooCommerce to Shopify
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update W2S – Migrate WooCommerce to Shopify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 28, 2025Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2025-23213 · Other software · TandoorRecipes · reported by GitHubHigh 8.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The file upload feature allows to upload arbitrary files, including html and svg. Both can contain malicious content (XSS Payloads). This vulnerability is fixed in 1.5.28.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2025-23212 · Other software · TandoorRecipes · reported by GitHubHigh 7.7
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. The external storage feature allows any user to enumerate the name and content of files on the server. This vulnerability is fixed in 1.5.28.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2025Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.CVE-2025-23211 · Other software · TandoorRecipes · reported by GitHubCritical 9.9
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
- Product
- recipes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2025brodos.net Onlineshop: Stored Cross-Site ScriptingCVE-2024-12529 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The brodos.net Onlineshop Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'BrodosCategory' shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- brodos.net Onlineshop
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update brodos.net Onlineshop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 24, 2025InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.CVE-2024-57277 · Other software · reported by MITREMedium 5.7
InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2025ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up to and including 3.3CVE-2025-24027 · Websites & servers · PrestaShop · reported by GitHubMedium 6.2
ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting (XSS) vulnerability in versions up to and including 3.3.2. This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned. For example, if the shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored cross-site scripting in formatting objects. Commit d60f9a5634b4fc2d3a8831fb08fe2e1f23cbfa39 keeps formatted addresses from displaying a XSS stored in the database, and the fix is expected to be available in version 3.3.3. No workarounds are available aside from applying the fix and keeping all modules maintained and update.
- Product
- ps_contactinfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 202507FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/doAdminAction.php?act=editShop&shopId.CVE-2024-57611 · Other software · 07fly · reported by MITRELow 3.5
07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/doAdminAction.php?act=editShop&shopId.
- Product
- 07flycms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code executionCVE-2025-21127 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code execution. An attacker could manipulate the search path environment variable to point to a malicious library, resulting in the execution of arbitrary code when the application loads. Exploitation of this issue requires user interaction in that a victim must run the vulnerable application.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2025Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code eCVE-2025-21122 · Other software · Adobe · reported by AdobeHigh 7.8
Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Photoshop Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025Shopping Cart & eCommerce Store: Unauthorized modification of dataCVE-2024-12712 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the webhook function in all versions up to, and including, 5.7.8. This makes it possible for unauthenticated attackers to modify order statuses.
- Product
- Shopping Cart & eCommerce Store
- Affected
- up to 5.7.8
- What to do
- Affects up to 5.7.8. Update Shopping Cart & eCommerce Store to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 7, 2025Aurum - WordPress & WooCommerce Shopping: Unauthorized modification of dataCVE-2024-12781 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab_1cl_demo_install_package_content' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite content with imported demo content.
- Product
- Aurum - WordPress & WooCommerce Shopping
- Affected
- up to 4.0.2
- What to do
- Affects up to 4.0.2. Update Aurum - WordPress & WooCommerce Shopping to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocumentation.laborator.cowordfence.com
Jan 7, 2025Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords: Information ExposureCVE-2024-12159 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1 due to the print_php_information.php being publicly accessible. This makes it possible for unauthenticated attackers to extract sensitive configuration data that can be leveraged in another attack.
- Product
- Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 2, 2025ShopElement: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-56260 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StorePlugin ShopElement shopelement allows Stored XSS.This issue affects ShopElement: from n/a through <= 2.0.0.
- Product
- ShopElement
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update ShopElement to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2025Blossom Shop: Cross-Site Request Forgery (CSRF)CVE-2024-37412 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Blossom Shop blossom-shop allows Cross Site Request Forgery.This issue affects Blossom Shop: from n/a through <= 1.1.7.
- Product
- Blossom Shop
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Blossom Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2024Smart Shopify Product: Missing AuthorizationCVE-2024-56031 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Shopify Product: from n/a through <= 1.0.2.
- Product
- Smart Shopify Product
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Smart Shopify Product to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 27, 2024A vulnerability was found in Beijing Longda Jushang Technology DBShop商城系统 3.3 Release 231225.CVE-2024-12991 · Other software · Beijing Longda Jushang Technology · reported by VulDBMedium 5.3
A vulnerability was found in Beijing Longda Jushang Technology DBShop商城系统 3.3 Release 231225. It has been declared as problematic. This vulnerability affects unknown code of the file /home-order. The manipulation of the argument orderStatus with the input %22%3E%3Csvg%20onload=alert(5888)%3E leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DBShop商城系统
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2024Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality.CVE-2024-50944 · Other software · reported by MITRECritical 9.8
Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality. The issue lies in the quantity parameter in the CartController's AddToCart method.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2024Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart).CVE-2019-2483 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- Oracle iStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.