Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
921 results · page 12 of 19
Oct 16, 2024MaxSlider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47351 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.This issue affects MaxSlider: from n/a through <= 1.2.3.
- Product
- MaxSlider
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update MaxSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Web Directory Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47379 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through <= 1.7.3.
- Product
- Web Directory Free
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Web Directory Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Cities Shipping Zones for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47309 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Condless Cities Shipping Zones for WooCommerce cities-shipping-zones-for-woocommerce allows PHP Local File Inclusion.This issue affects Cities Shipping Zones for WooCommerce: from n/a through <= 1.2.7.
- Product
- Cities Shipping Zones for WooCommerce
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Cities Shipping Zones for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WPSPX: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44034 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Martin Greenwood WPSPX wpspx allows PHP Local File Inclusion.This issue affects WPSPX: from n/a through <= 1.0.2.
- Product
- WPSPX
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WPSPX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Instant Chat Floating Button for WordPress Websites: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44018 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Instant Chat Floating Button for WordPress Websites instant-chat-wp allows PHP Local File Inclusion.This issue affects Instant Chat Floating Button for WordPress Websites: from n/a through <= 1.0.5.
- Product
- Instant Chat Floating Button for WordPress Websites
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Instant Chat Floating Button for WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024CSS JS Files: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-9146 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in jamesdlow CSS JS Files css-js-files allows Path Traversal.This issue affects CSS JS Files: from n/a through <= 1.5.0.
- Product
- CSS JS Files
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update CSS JS Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Podiant: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44016 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in amarksteadman Podiant podiant allows PHP Local File Inclusion.This issue affects Podiant: from n/a through <= 1.1.
- Product
- Podiant
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Podiant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Users Control: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44015 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Users Control users-control allows PHP Local File Inclusion.This issue affects Users Control: from n/a through <= 1.0.16.
- Product
- Users Control
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update Users Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Vmax Project Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44014 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vmax Studio Vmax Project Manager vmax-project-manager allows PHP Local File Inclusion.This issue affects Vmax Project Manager: from n/a through <= 1.0.
- Product
- Vmax Project Manager
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Vmax Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024VR Calendar: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44013 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innate Images LLC VR Calendar vr-calendar-sync allows PHP Local File Inclusion.This issue affects VR Calendar: from n/a through <= 2.4.0.
- Product
- VR Calendar
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update VR Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WP Newsletter Subscription: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44012 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpdev33 WP Newsletter Subscription wp-newsletter-subscription allows PHP Local File Inclusion.This issue affects WP Newsletter Subscription: from n/a through <= 1.1.
- Product
- WP Newsletter Subscription
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Newsletter Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WP Ticket Ultra Help Desk & Support: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44011 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExpressTech Systems WP Ticket Ultra Help Desk & Support Plugin wp-ticket-ultra allows PHP Local File Inclusion.This issue affects WP Ticket Ultra Help Desk & Support Plugin: from n/a through <= 1.0.5.
- Product
- WP Ticket Ultra Help Desk & Support
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update WP Ticket Ultra Help Desk & Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Cross-Site Request ForgeryCVE-2024-8520 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.6. This is due to missing or incorrect nonce validation on the admin_init or user_action_hook function. This makes it possible for unauthenticated attackers to modify a users membership status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 4, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2024-8519 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'um_loggedin' shortcode in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 3, 2024Social Web Suite – Social Media Auto Post, Social Media Auto Publish: Directory TraversalCVE-2024-8352 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Social Web Suite – Social Media Auto Post, Social Media Auto Publish
- Affected
- up to 4.1.11
- What to do
- Affects up to 4.1.11. Update Social Web Suite – Social Media Auto Post, Social Media Auto Publish to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 2, 2024Checkout Mestres WP: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44030 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mestres do WP Checkout Mestres WP checkout-mestres-wp allows Absolute Path Traversal.This issue affects Checkout Mestres WP: from n/a through <= 8.6.
- Product
- Checkout Mestres WP
- Affected
- up to 8.6
- What to do
- Affects up to 8.6. Update Checkout Mestres WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 2, 2024MH Board: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44017 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MinHyeong Lim MH Board mh-board allows PHP Local File Inclusion.This issue affects MH Board: from n/a through <= 1.3.2.1.
- Product
- MH Board
- Affected
- up to 1.3.2.1
- What to do
- Affects up to 1.3.2.1. Update MH Board to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2024ElementsKit Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43996 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ElementsKit ElementsKit Pro allows PHP Local File Inclusion.This issue affects ElementsKit Pro: from n/a through 3.6.0.
- Product
- ElementsKit Pro
- Affected
- up to 3.6.0
- What to do
- Affects up to 3.6.0. Update ElementsKit Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 17, 2024Name Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-43938 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.29.0.
- Product
- Name Directory
- Affected
- up to 1.29.0
- What to do
- Affects up to 1.29.0. Update Name Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2024Classified Listing – Classified ads & Business Directory: Unauthorized accessCVE-2024-7888 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions like export_forms(), import_forms(), update_fb_options(), and many more in all versions up to, and including, 3.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify forms and various other settings.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.1.7
- What to do
- Affects up to 3.1.7. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2024The Ultimate WordPress Toolkit – WP Extended: Directory TraversalCVE-2024-8104 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the download_file_ajax function. This makes it possible for authenticated attackers, with subscriber access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- The Ultimate WordPress Toolkit – WP Extended
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update The Ultimate WordPress Toolkit – WP Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 30, 2024Web Directory Free: Does not validate a parameter before using it in an include()CVE-2024-3673 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.
- Product
- Web Directory Free
- Fixed in
- 1.7.3
- What to do
- Update Web Directory Free to 1.7.3 or newer.
Aug 29, 2024Animated Number Counters: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43957 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sk. Abul Hasan Animated Number Counters allows PHP Local File Inclusion.This issue affects Animated Number Counters: from n/a through 1.9.
- Product
- Animated Number Counters
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Animated Number Counters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 29, 2024Droip: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43955 · WordPress plugins & themes · reported by PatchstackCritical 10
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip: from n/a through 1.1.1.
- Product
- Droip
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Droip to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Landing Page Builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43345 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion.This issue affects Landing Page Builder: from n/a through 1.5.2.0.
- Product
- Landing Page Builder
- Affected
- up to 1.5.2.0
- What to do
- Affects up to 1.5.2.0. Update Landing Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024EmbedPress: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43328 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper EmbedPress allows PHP Local File Inclusion.This issue affects EmbedPress: from n/a through 4.0.9.
- Product
- EmbedPress
- Affected
- up to 4.0.9
- What to do
- Affects up to 4.0.9. Update EmbedPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Void Elementor Post Grid Addon for Elementor Page builder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43281 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VOID CODERS Void Elementor Post Grid Addon for Elementor Page builder allows PHP Local File Inclusion.This issue affects Void Elementor Post Grid Addon for Elementor Page builder: from n/a through 2.3.
- Product
- Void Elementor Post Grid Addon for Elementor Page builder
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Void Elementor Post Grid Addon for Elementor Page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Woo Products Widgets For Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43271 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themelocation Woo Products Widgets For Elementor allows PHP Local File Inclusion.This issue affects Woo Products Widgets For Elementor: from n/a through 2.0.0.
- Product
- Woo Products Widgets For Elementor
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update Woo Products Widgets For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Bit Form Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43248 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bit Apps Bit Form Pro allows File Manipulation.This issue affects Bit Form Pro: from n/a through 2.6.4.
- Product
- Bit Form Pro
- Affected
- up to 2.6.4
- What to do
- Affects up to 2.6.4. Update Bit Form Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024Timeline and History slider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43232 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP OnlineSupport, Essential Plugin Timeline and History slider allows PHP Local File Inclusion.This issue affects Timeline and History slider: from n/a through 2.3.
- Product
- Timeline and History slider
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Timeline and History slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2024JetGridBuilder: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43221 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetGridBuilder allows PHP Local File Inclusion.This issue affects JetGridBuilder: from n/a through 1.1.2.
- Product
- JetGridBuilder
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update JetGridBuilder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 18, 2024GeoDirectory: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43145 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AyeCode Ltd GeoDirectory.This issue affects GeoDirectory: from n/a through 2.3.61.
- Product
- GeoDirectory
- Affected
- up to 2.3.61
- What to do
- Affects up to 2.3.61. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 17, 2024BackWPup: Directory TraversalCVE-2023-5505 · WordPress plugins & themes · reported by WordfenceMedium 6.8
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by the server. Additionally, default settings will place an index.php and a .htaccess file into the chosen directory (unless already present) when the first backup job is run that are intended to prevent directory listing and file access. This means that an attacker could set the backup directory to the root of another site in a shared environment and thus disable that site.
- Product
- BackWPup
- Affected
- up to 4.0.1
- What to do
- Affects up to 4.0.1. Update BackWPup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 13, 2024WPSection: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43165 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rashid87 WPSection allows PHP Local File Inclusion.This issue affects WPSection: from n/a through 1.3.8.
- Product
- WPSection
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update WPSection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024Ultimate Bootstrap Elements for Elementor: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43140 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in G5Theme Ultimate Bootstrap Elements for Elementor allows PHP Local File Inclusion.This issue affects Ultimate Bootstrap Elements for Elementor: from n/a through 1.4.4.
- Product
- Ultimate Bootstrap Elements for Elementor
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Ultimate Bootstrap Elements for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024Event Manager for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43138 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MagePeople Team Event Manager for WooCommerce allows PHP Local File Inclusion.This issue affects Event Manager for WooCommerce: from n/a through 4.2.1.
- Product
- Event Manager for WooCommerce
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Event Manager for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024WPCafe: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43135 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through 2.2.28.
- Product
- WPCafe
- Affected
- up to 2.2.28
- What to do
- Affects up to 2.2.28. Update WPCafe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024BetterDocs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-43129 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPDeveloper BetterDocs allows PHP Local File Inclusion.This issue affects BetterDocs: from n/a through 3.5.8.
- Product
- BetterDocs
- Affected
- up to 3.5.8
- What to do
- Affects up to 3.5.8. Update BetterDocs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 13, 2024WooCommerce PDF Vouchers: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39651 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPWeb WooCommerce PDF Vouchers allows File Manipulation.This issue affects WooCommerce PDF Vouchers: from n/a before 4.9.5.
- Product
- WooCommerce PDF Vouchers
- Fixed in
- 4.9.5
- What to do
- Update WooCommerce PDF Vouchers to 4.9.5 or newer.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39624 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39621 · WordPress plugins & themes · reported by PatchstackHigh 8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024ListingPro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-39619 · WordPress plugins & themes · reported by PatchstackCritical 9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4.
- Product
- ListingPro
- Affected
- up to 2.9.4
- What to do
- Affects up to 2.9.4. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024JetWidgets for Elementor and WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38772 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetWidgets for Elementor and WooCommerce allows PHP Local File Inclusion.This issue affects JetWidgets for Elementor and WooCommerce: from n/a through 1.1.7.
- Product
- JetWidgets for Elementor and WooCommerce
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update JetWidgets for Elementor and WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024The Pack Elementor addons: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38768 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Webangon The Pack Elementor addons allows PHP Local File Inclusion, Path Traversal.This issue affects The Pack Elementor addons: from n/a through 2.0.8.6.
- Product
- The Pack Elementor addons
- Affected
- up to 2.0.8.6
- What to do
- Affects up to 2.0.8.6. Update The Pack Elementor addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 1, 2024MakeStories (for Google Web Stories): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-38746 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in MakeStories Team MakeStories (for Google Web Stories) allows Path Traversal, Server Side Request Forgery.This issue affects MakeStories (for Google Web Stories): from n/a through 3.0.3.
- Product
- MakeStories (for Google Web Stories)
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update MakeStories (for Google Web Stories) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 30, 2024Web Directory Free: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2024-3669 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Web Directory Free
- Fixed in
- 1.7.2
- What to do
- Update Web Directory Free to 1.7.2 or newer.
Jul 30, 2024pmpro-member-directory: Does not prevent users with at least the contributor role from leaking other users' sensitive informationCVE-2024-1287 · WordPress plugins & themes · reported by WPScanMedium 6.5
The pmpro-member-directory WordPress plugin before 1.2.6 does not prevent users with at least the contributor role from leaking other users' sensitive information, including password hashes via an SQLi vector.
- Product
- pmpro-member-directory
- Fixed in
- 1.2.6
- What to do
- Update pmpro-member-directory to 1.2.6 or newer.
Jul 22, 2024DirectoryPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-38755 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Designinvento DirectoryPress allows SQL Injection.This issue affects DirectoryPress: from n/a through 3.6.10.
- Product
- DirectoryPress
- Affected
- up to 3.6.10
- What to do
- Affects up to 3.6.10. Update DirectoryPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 21, 2024WP Directory Kit: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37487 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wpdirectorykit.Com WP Directory Kit allows Reflected XSS.This issue affects WP Directory Kit: from n/a through 1.3.5.
- Product
- WP Directory Kit
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 16, 2024WordPress File Upload: Directory TraversalCVE-2024-5852 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'uploadpath' parameter of the wordpress_file_upload shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload limited files to arbitrary locations on the web server.
- Product
- WordPress File Upload
- Affected
- up to 4.24.7
- What to do
- Affects up to 4.24.7. Update WordPress File Upload to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.