Updated 5 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

699 results · page 12 of 14

Feb 5, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site Scripting through editing contextCVE-2024-0954 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting through editing context via the 'data-eael-wrapper-link' wrapper in all versions up to, and including, 5.9.7 due to insufficient input sanitization and output escaping on user supplied protocols. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 5.9.7
What to do
Affects up to 5.9.7. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Cryptocurrency Widgets – Price Ticker & Coins List: SQL InjectionCVE-2024-0709 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coinslist' parameter in versions 2.0 to 2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Cryptocurrency Widgets – Price Ticker & Coins List
Affected
2.0 to 2.6.5
What to do
Affects 2.0 to 2.6.5. Update Cryptocurrency Widgets – Price Ticker & Coins List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 5, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-0586 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Login/Register Element in all versions up to, and including, 5.9.4 due to insufficient input sanitization and output escaping on the custom login URL. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 5.9.4
What to do
Affects up to 5.9.4. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 5, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2024-0585 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Filterable Gallery widget in all versions up to, and including, 5.9.4 due to insufficient input sanitization and output escaping on the Image URL. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 5.9.4
What to do
Affects up to 5.9.4. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jan 31, 2024Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder: Cross-Site Request Forgery (CSRF)CVE-2024-22136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder.This issue affects Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder: from n/a through 3.1.5.
Product
Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder
Affected
up to 3.1.5
What to do
Affects up to 3.1.5. Update Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 31, 2024Custom Dashboard Widgets: Cross-Site Request Forgery (CSRF)CVE-2024-22290 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting (XSS).This issue affects Custom Dashboard Widgets: from n/a through 1.3.1.
Product
Custom Dashboard Widgets
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update Custom Dashboard Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 8, 2024CommentTweets: Does not have CSRF checks in some placesCVE-2023-6845 · WordPress plugins & themes · reported by WPScanHigh 8.8
The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
Product
CommentTweets
Affected
up to 0.6
What to do
Affects up to 0.6. Update CommentTweets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record magos-securitas.com wpscan.com
Jan 8, 2024Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: Deserialization of Untrusted DataCVE-2023-52225 · WordPress plugins & themes · reported by PatchstackCritical 10
Deserialization of Untrusted Data vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
Product
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Affected
up to 3.1
What to do
Affects up to 3.1. Update Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 5, 2024Custom Twitter Feeds – A Tweets Widget or X Feed Widget: Cross-Site Request Forgery (CSRF)CVE-2023-52136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.
Product
Custom Twitter Feeds – A Tweets Widget or X Feed Widget
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update Custom Twitter Feeds – A Tweets Widget or X Feed Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jan 4, 2024Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders: Stored Cross-Site ScriptingCVE-2023-7044 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom ID in all versions up to, and including, 5.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor access and higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Affected
up to 5.9.2
What to do
Affects up to 5.9.2. Update Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 3, 2024PowerPack Addons for Elementor (Free Widgets, Extensions and Templates): Cross-Site Request ForgeryCVE-2023-6984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.13. This is due to missing or incorrect nonce validation in the powerpack-lite-for-elementor/classes/class-pp-admin-settings.php file. This makes it possible for unauthenticated attackers to modify and reset plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
Affected
up to 2.7.13
What to do
Affects up to 2.7.13. Update PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Dec 28, 2023Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-50853 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms.This issue affects Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: from n/a through 1.75.0.
Product
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms
Affected
up to 1.75.0
What to do
Affects up to 1.75.0. Update Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 27, 2023Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site.CVE-2023-51700 · WordPress plugins & themes · reported by GitHubMedium 6.4
Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts.
Fixed in
1.0.1
What to do
Update the plugin to 1.0.1 or newer.
Full record and what to do →NVD record github.com github.com
Dec 21, 2023Event Monster – Event Management, Tickets Booking, Upcoming Event: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-47525 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through 1.3.2.
Product
Event Monster – Event Management, Tickets Booking, Upcoming Event
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Event Monster – Event Management, Tickets Booking, Upcoming Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Unrestricted Upload of File with Dangerous TypeCVE-2023-31231 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.65.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.65
What to do
Affects up to 1.5.65. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 20, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-26525 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.12.
Product
Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Affected
up to 3.7.12
What to do
Affects up to 3.7.12. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: Deserialization of Untrusted DataCVE-2023-34382 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy: from n/a through 3.7.19.
Product
Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
Affected
up to 3.7.19
What to do
Affects up to 3.7.19. Update Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 18, 2023SiteOrigin Widgets Bundle: Does not validate user input before using it to generate paths passed to include function/sCVE-2023-6295 · WordPress plugins & themes · reported by WPScanHigh 7.2
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
Product
SiteOrigin Widgets Bundle
Fixed in
1.51.0
What to do
Update SiteOrigin Widgets Bundle to 1.51.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: Cross-Site Request Forgery (CSRF)CVE-2023-33214 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Tagbox Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics.This issue affects Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics: from n/a through 3.1.
Product
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Affected
up to 3.1
What to do
Affects up to 3.1. Update Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023Social Share Buttons & Analytics Plugin – GetSocial.Io: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49189 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Getsocial, S.A. Social Share Buttons & Analytics Plugin – GetSocial.Io allows Stored XSS.This issue affects Social Share Buttons & Analytics Plugin – GetSocial.Io: from n/a through 4.3.12.
Product
Social Share Buttons & Analytics Plugin – GetSocial.Io
Affected
up to 4.3.12
What to do
Affects up to 4.3.12. Update Social Share Buttons & Analytics Plugin – GetSocial.Io to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 15, 2023WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49181 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce allows Stored XSS.This issue affects WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: from n/a through 3.1.40.
Product
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Affected
up to 3.1.40
What to do
Affects up to 3.1.40. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 14, 2023Dashboard Widgets Suite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49743 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Dashboard Widgets Suite allows Stored XSS.This issue affects Dashboard Widgets Suite: from n/a through 3.4.1.
Product
Dashboard Widgets Suite
Affected
up to 3.4.1
What to do
Affects up to 3.4.1. Update Dashboard Widgets Suite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 7, 2023Responsive Column Widgets: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-45762 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Michael Uno (miunosoft) Responsive Column Widgets.This issue affects Responsive Column Widgets: from n/a through 1.2.7.
Product
Responsive Column Widgets
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Responsive Column Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 30, 2023Import Spreadsheets from Microsoft Excel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48289 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Stored XSS.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through 10.1.3.
Product
Import Spreadsheets from Microsoft Excel
Affected
up to 10.1.3
What to do
Affects up to 10.1.3. Update Import Spreadsheets from Microsoft Excel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versioCVE-2023-47808 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versions.
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions.CVE-2023-47765 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions.
Fixed in
2.2.0
What to do
Update the plugin to 2.2.0 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 22, 2023UserPro: Unauthorized password resetsCVE-2023-2449 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (userpro_process_form). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-2448 and CVE-2023-2446, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
Product
UserPro
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update UserPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Nov 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions.CVE-2023-26535 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions.
Affected
up to 2.12.15
What to do
Affects up to 2.12.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 18, 2023Code Snippets: Cross-Site Request Forgery (CSRF)CVE-2023-47666 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Code Snippets Pro Code Snippets.This issue affects Code Snippets: from n/a through 3.5.0.
Product
Code Snippets
Affected
up to 3.5.0
What to do
Affects up to 3.5.0. Update Code Snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 17, 2023AppPresser: Unauthorized password resetsCVE-2023-4214 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
Product
AppPresser
Affected
up to 4.2.5
What to do
Affects up to 4.2.5. Update AppPresser to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.CVE-2023-46619 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions.
Affected
up to 1.0.15
What to do
Affects up to 1.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPGrim Classic Editor and Classic Widgets plugin <= 1.2.5 versions.CVE-2023-27434 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPGrim Classic Editor and Classic Widgets plugin <= 1.2.5 versions.
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 9, 2023Cross-Site Request Forgery (CSRF) vulnerability in Frédéric Sheedy Etsy Shop plugin <= 3.0.3 versions.CVE-2023-25975 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Frédéric Sheedy Etsy Shop plugin <= 3.0.3 versions.
Fixed in
3.0.4
What to do
Update the plugin to 3.0.4 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 20, 2023Woody code snippets: Cross-Site Request ForgeryCVE-2020-36759 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Woody code snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.9. This is due to missing or incorrect nonce validation on the runActions() function. This makes it possible for unauthenticated attackers to activate and deactivate snippets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Woody code snippets
Affected
up to 2.3.9
What to do
Affects up to 2.3.9. Update Woody code snippets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Oct 18, 2023Widgets for Google Reviews: Cross-Site Request ForgeryCVE-2023-3254 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Widgets for Google Reviews
Affected
up to 10.9
What to do
Affects up to 10.9. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 12, 2023Etsy Shop: Stored Cross-Site ScriptingCVE-2023-5470 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Etsy Shop
Affected
up to 3.0.4
What to do
Affects up to 3.0.4. Update Etsy Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets plugin <= 2.2.8 versions.CVE-2023-39165 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets plugin <= 2.2.8 versions.
Affected
up to 2.2.8
What to do
Affects up to 2.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Sep 27, 2023WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce: Stored Cross-Site ScriptingCVE-2023-4423 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.1.37.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Affected
up to 3.1.37.1
What to do
Affects up to 3.1.37.1. Update WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Sep 12, 2023WP User Control: Unauthorized password resetsCVE-2023-4915 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP User Control plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.5.3. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (in the WP User Control Widget). The function changes the user's password after providing the email. The new password is only sent to the user's email, so the attacker does not have access to the new password.
Product
WP User Control
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update WP User Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 17, 2023Caldera Forms Google Sheets Connector: Does not have CSRF checkCVE-2023-2330 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Caldera Forms Google Sheets Connector WordPress plugin before 1.3 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a CSRF attack
Product
Caldera Forms Google Sheets Connector
Fixed in
1.3
What to do
Update Caldera Forms Google Sheets Connector to 1.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 12, 2023WooCommerce Etsy Integration: Cross-Site Request ForgeryCVE-2021-4409 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the etcpf_delete_feed() function. This makes it possible for unauthenticated attackers to delete an export feed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
WooCommerce Etsy Integration
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update WooCommerce Etsy Integration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record blog.nintechnet.com blog.nintechnet.com
Jul 4, 2023CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro WordPress plugin through 5.0.2 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro
Affected
up to 5.0.2
Fixed in
5.0.2
What to do
Update CF7 Google Sheets Connector WordPress plugin before 5.0.2, cf7-google-sheets-connector-pro to 5.0.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 16, 2023Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Arbitrary file uploadsCVE-2023-3295 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation of files in the file manager functionality in versions up to, and including, 1.5.66 . This makes it possible for authenticated attackers, with contributor-level permissions and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The issue was partially patched in version 1.5.66 and fully patched in 1.5.67. CVE-2023-31231 appears to be a duplicate of this issue.
Product
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Affected
up to 1.5.66
What to do
Affects up to 1.5.66. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 9, 2023Elementor Addons, Widgets and Enhancements – Stax: Unauthorized modification of dataCVE-2023-2189 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the toggle_widget function in versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable Elementor widgets.
Product
Elementor Addons, Widgets and Enhancements – Stax
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Elementor Addons, Widgets and Enhancements – Stax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 9, 2023Elementor Addons, Widgets and Enhancements – Stax: Cross-Site Request ForgeryCVE-2023-1807 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.3. This is due to missing or incorrect nonce validation on the toggle_widget function. This makes it possible for unauthenticated attackers to enable or disable Elementor widgets via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Elementor Addons, Widgets and Enhancements – Stax
Affected
up to 1.4.3
What to do
Affects up to 1.4.3. Update Elementor Addons, Widgets and Enhancements – Stax to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema – All In One Schema Rich Snippets plugin <= 1.6.5 versions.CVE-2023-25058 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema – All In One Schema Rich Snippets plugin <= 1.6.5 versions.
Fixed in
1.6.6
What to do
Update the plugin to 1.6.6 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.CVE-2022-47164 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.
Affected
up to 3.7.7
What to do
Affects up to 3.7.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Apr 26, 2023Profile Builder – User Profile & User Registration Forms: Unauthorized password resetsCVE-2023-2297 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.
Product
Profile Builder – User Profile & User Registration Forms
Affected
up to 3.9.0
What to do
Affects up to 3.9.0. Update Profile Builder – User Profile & User Registration Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record lana.codes plugins.trac.wordpress.org
Apr 10, 2023A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress.CVE-2015-10100 · WordPress plugins & themes · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in Dynamic Widgets Plugin up to 1.5.10 on WordPress. This issue affects some unknown processing of the file classes/dynwid_class.php. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.11 is able to address this issue. The identifier of the patch is d0a19c6efcdc86d7093b369bc9e29a0629e57795. It is recommended to upgrade the affected component. The identifier VDB-225353 was assigned to this vulnerability.
Product
Dynamic Widgets
Affected
up to 1.5.10
What to do
Affects up to 1.5.10. Update Dynamic Widgets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com github.com
Apr 10, 2023Time Sheets: Does not sanitise and escape some of its settingsCVE-2023-0893 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Time Sheets WordPress plugin before 1.29.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Time Sheets
Fixed in
1.29.3
What to do
Update Time Sheets to 1.29.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.