Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,023 results · page 12 of 21
Dec 9, 2024Integrate Google Drive: Missing AuthorizationCVE-2023-32117 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through 1.1.99.
- Product
- Integrate Google Drive
- Affected
- up to 1.1.99
- What to do
- Affects up to 1.1.99. Update Integrate Google Drive to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Product Category Tree: Missing AuthorizationCVE-2023-29173 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AWESOME TOGI Product Category Tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Category Tree: from n/a through 2.5.
- Product
- Product Category Tree
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Product Category Tree to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-25455 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Protected Posts Logout Button: Missing AuthorizationCVE-2023-25454 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protected Posts Logout Button: from n/a through 1.4.5.
- Product
- Protected Posts Logout Button
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Protected Posts Logout Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): Missing AuthorizationCVE-2023-24375 · WordPress plugins & themes · reported by PatchstackLow 3.5
Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14.
- Product
- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- up to 7.5.14
- What to do
- Affects up to 7.5.14. Update WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Reviews and Rating – Google My Business: Missing AuthorizationCVE-2023-23986 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Noah Hearle, Design Extreme Reviews and Rating – Google My Business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reviews and Rating – Google My Business: from n/a through 4.14.
- Product
- Reviews and Rating – Google My Business
- Affected
- up to 4.14
- What to do
- Affects up to 4.14. Update Reviews and Rating – Google My Business to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Easy Google Analytics for: Missing AuthorizationCVE-2023-23887 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Shaon Easy Google Analytics for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Google Analytics for WordPress: from n/a through 1.6.0.
- Product
- Easy Google Analytics for
- Affected
- up to 1.6.0
- What to do
- Affects up to 1.6.0. Update Easy Google Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Cost of Goods for WooCommerce: Missing AuthorizationCVE-2023-23868 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in WPFactory Cost of Goods for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost of Goods for WooCommerce: from n/a through 2.8.6.
- Product
- Cost of Goods for WooCommerce
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Cost of Goods for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 6, 2024Gold Addons for Elementor: Unauthorized modification of dataCVE-2024-12110 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Gold Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate() and deactivate() functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate and deactivate licenses.
- Product
- Gold Addons for Elementor
- Affected
- up to 1.3.2
- What to do
- Affects up to 1.3.2. Update Gold Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 3, 2024Goodlayers Core: Reflected Cross-Site ScriptingCVE-2024-11200 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Goodlayers Core plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘font-family’ parameter in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Goodlayers Core
- Affected
- up to 2.0.7
- What to do
- Affects up to 2.0.7. Update Goodlayers Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgoodlayers.comwordfence.com
Dec 2, 2024Google Plus Share and +1 Button: Cross-Site Request Forgery (CSRF)CVE-2024-53723 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in acbaltaci Google Plus Share and +1 Button google-plus-share-and-plusone-button allows Stored XSS.This issue affects Google Plus Share and +1 Button: from n/a through <= 1.0.
- Product
- Google Plus Share and +1 Button
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Google Plus Share and +1 Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024GoQSmile: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52455 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goqsystem GoQSmile goqsmile allows Reflected XSS.This issue affects GoQSmile: from n/a through <= 1.0.1.
- Product
- GoQSmile
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update GoQSmile to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024GoQMieruca: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52454 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goqsystem GoQMieruca goqmieruca allows Reflected XSS.This issue affects GoQMieruca: from n/a through <= 1.0.3.
- Product
- GoQMieruca
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update GoQMieruca to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 2, 2024What Would Seth Godin Do: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51900 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in James Hunt What Would Seth Godin Do what-would-seth-godin-do allows Stored XSS.This issue affects What Would Seth Godin Do: from n/a through <= 2.1.1.
- Product
- What Would Seth Godin Do
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update What Would Seth Godin Do to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 30, 2024Ni WooCommerce Cost Of Goods: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-53783 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.
- Product
- Ni WooCommerce Cost Of Goods
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update Ni WooCommerce Cost Of Goods to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Idealien Category Enhancements: Cross-Site Request Forgery (CSRF)CVE-2024-53734 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Jamie O Idealien Category Enhancements idealien-category-enhancements allows Stored XSS.This issue affects Idealien Category Enhancements: from n/a through <= 1.2.
- Product
- Idealien Category Enhancements
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Idealien Category Enhancements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin forCVE-2024-11203 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘provider_name parameter in all versions up to, and including, 4.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 4.1.3
- What to do
- Affects up to 4.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 28, 2024Logo Slider: Does not sanitise and escape some of its Logo and Slider settingsCVE-2024-10896 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting
- Product
- Logo Slider
- Fixed in
- 4.5.0
- What to do
- Update Logo Slider to 4.5.0 or newer.
Nov 28, 2024Logo Slider: Does not sanitise and escape some of its Logo SettingsCVE-2024-10473 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.
- Product
- Logo Slider
- Fixed in
- 4.5.0
- What to do
- Update Logo Slider to 4.5.0 or newer.
Nov 23, 2024FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider: PHP Object InjectionCVE-2024-9511 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.82 via deserialization of untrusted input in the 'formatResult' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The vulnerability was partially patched in version 2.2.82.
- Product
- FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider
- Affected
- up to 2.2.82
- What to do
- Affects up to 2.2.82. Update FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 21, 2024Dino Game – Embed Google Chrome Dinosaur Game in: Stored Cross-Site ScriptingCVE-2024-11388 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Dino Game – Embed Google Chrome Dinosaur Game in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dino-game' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Dino Game – Embed Google Chrome Dinosaur Game in
- Affected
- up to 1.1.0
- What to do
- Affects up to 1.1.0. Update Dino Game – Embed Google Chrome Dinosaur Game in to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 20, 2024Contact Page With Google Map: Path Traversal: '.../...//'CVE-2024-52447 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Path Traversal: '.../...//' vulnerability in corporatezen222 Contact Page With Google Map contact-page-with-google-map allows Path Traversal.This issue affects Contact Page With Google Map: from n/a through <= 1.6.1.
- Product
- Contact Page With Google Map
- Affected
- up to 1.6.1
- What to do
- Affects up to 1.6.1. Update Contact Page With Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Featured product by category name: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51911 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ketan Patel Featured product by category name featured-product-by-category-name allows DOM-Based XSS.This issue affects Featured product by category name: from n/a through <= 1.1.
- Product
- Featured product by category name
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Featured product by category name to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Google Visualization Charts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51862 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baptiste Wicht Google Visualization Charts google-visualization-charts allows Stored XSS.This issue affects Google Visualization Charts: from n/a through <= 0.1.
- Product
- Google Visualization Charts
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update Google Visualization Charts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Plenigo: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51832 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plenigo Plenigo plenigo allows Stored XSS.This issue affects Plenigo: from n/a through <= 1.12.0.
- Product
- Plenigo
- Affected
- up to 1.12.0
- What to do
- Affects up to 1.12.0. Update Plenigo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024WE – Client Logo Carousel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51821 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordpresteem WE – Client Logo Carousel we-client-logo-carousel allows Stored XSS.This issue affects WE – Client Logo Carousel: from n/a through <= 1.4.
- Product
- WE – Client Logo Carousel
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update WE – Client Logo Carousel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Jigoshop – Store Exporter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50519 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Jigoshop – Store Exporter jigoshop-exporter allows Reflected XSS.This issue affects Jigoshop – Store Exporter: from n/a through <= 1.5.8.
- Product
- Jigoshop – Store Exporter
- Affected
- up to 1.5.8
- What to do
- Affects up to 1.5.8. Update Jigoshop – Store Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 18, 2024Google for WooCommerce: Information DisclosureCVE-2024-10486 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible print_php_information.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PHP configuration, which can be used to aid other attacks.
- Product
- Google for WooCommerce
- Affected
- up to 2.8.6
- What to do
- Affects up to 2.8.6. Update Google for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 11, 2024CRM 2go: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-52350 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nrmendez CRM 2go crm2go allows DOM-Based XSS.This issue affects CRM 2go: from n/a through <= 1.0.
- Product
- CRM 2go
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update CRM 2go to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 11, 2024Gboy Custom Google Map: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51882 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopalkumar315 Gboy Custom Google Map gboy-custom-google-map allows Blind SQL Injection.This issue affects Gboy Custom Google Map: from n/a through <= 1.2.
- Product
- Gboy Custom Google Map
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Gboy Custom Google Map to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 11, 2024Simple Goods: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51574 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Goods Simple Goods simple-goods allows Stored XSS.This issue affects Simple Goods: from n/a through <= 0.1.3.
- Product
- Simple Goods
- Affected
- up to 0.1.3
- What to do
- Affects up to 0.1.3. Update Simple Goods to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Wp Slide Categorywise: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51690 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in neelam.samariya Wp Slide Categorywise wp-slide-categorywise allows Reflected XSS.This issue affects Wp Slide Categorywise: from n/a through <= 1.1.
- Product
- Wp Slide Categorywise
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Wp Slide Categorywise to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Jigoshop – Store Toolkit: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-51712 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Visser Jigoshop – Store Toolkit jigoshop-store-toolkit allows Reflected XSS.This issue affects Jigoshop – Store Toolkit: from n/a through <= 1.4.0.
- Product
- Jigoshop – Store Toolkit
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Jigoshop – Store Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Golf Tracker: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-51607 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in percent20 Golf Tracker golf-tracker allows SQL Injection.This issue affects Golf Tracker: from n/a through <= 0.7.
- Product
- Golf Tracker
- Affected
- up to 0.7
- What to do
- Affects up to 0.7. Update Golf Tracker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 9, 2024Category Ajax Filter: Local File InclusionCVE-2024-10871 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Category Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.2 via the 'params[caf-post-layout]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where files with a .php extension can be uploaded and included.
- Product
- Category Ajax Filter
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update Category Ajax Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 8, 2024Simple Shortcode for Google Maps: Stored Cross-Site ScriptingCVE-2024-10621 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Shortcode for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pw_map shortcode in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Simple Shortcode for Google Maps
- Affected
- up to 1.5.4
- What to do
- Affects up to 1.5.4. Update Simple Shortcode for Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 1, 2024WP GoToWebinar: Missing AuthorizationCVE-2024-38695 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Martin Gibson WP GoToWebinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP GoToWebinar: from n/a through 15.6.
- Product
- WP GoToWebinar
- Affected
- up to 15.6
- What to do
- Affects up to 15.6. Update WP GoToWebinar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024Google Docs RSVP: Cross-Site Request Forgery (CSRF)CVE-2024-49672 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs RSVP: from n/a through <= 2.0.1.
- Product
- Google Docs RSVP
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Google Docs RSVP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2024FormFacade – WordPress plugin for Google Forms: Reflected Cross-Site ScriptingCVE-2024-9613 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- FormFacade – WordPress plugin for Google Forms
- Affected
- up to 1.3.6
- What to do
- Affects up to 1.3.6. Update FormFacade – WordPress plugin for Google Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 22, 2024Category and Taxonomy Image: Stored Cross-Site ScriptingCVE-2024-9591 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Category and Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_category_image' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Category and Taxonomy Image
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Category and Taxonomy Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 22, 2024Category and Taxonomy Meta Fields: Stored Cross-Site ScriptingCVE-2024-9590 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image meta field value in the 'wpaft_add_meta_textinput' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with editor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Category and Taxonomy Meta Fields
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 22, 2024Category and Taxonomy Meta Fields: Stored Cross-Site ScriptingCVE-2024-9589 · WordPress plugins & themes · reported by WordfenceMedium 5.5
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_meta_name' parameter in the 'wpaft_option_page' function in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- Category and Taxonomy Meta Fields
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 22, 2024Category and Taxonomy Meta Fields: Cross-Site Request ForgeryCVE-2024-9588 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible for unauthenticated attackers to add and delete taxonomy meta, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Category and Taxonomy Meta Fields
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Category and Taxonomy Meta Fields to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 20, 2024GoogleDrive folder list: Cross-Site Request Forgery (CSRF)CVE-2024-49335 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in sh4d0w28 GoogleDrive folder list googledrive-folder-list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through <= 2.2.2.
- Product
- GoogleDrive folder list
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update GoogleDrive folder list to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 20, 2024Google Map Locations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49606 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Google Map Locations google-map-locations allows Reflected XSS.This issue affects Google Map Locations: from n/a through <= 1.0.
- Product
- Google Map Locations
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Google Map Locations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Advanced Category and Custom Taxonomy Image: Stored Cross-Site ScriptingCVE-2024-9425 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Advanced Category and Custom Taxonomy Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ad_tax_image shortcode in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Advanced Category and Custom Taxonomy Image
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Advanced Category and Custom Taxonomy Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 18, 2024AB Categories Search Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49240 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajberasategui AB Categories Search Widget ab-categories-search-widget allows Reflected XSS.This issue affects AB Categories Search Widget : from n/a through <= 0.2.5.
- Product
- AB Categories Search Widget
- Affected
- up to 0.2.5
- What to do
- Affects up to 0.2.5. Update AB Categories Search Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024Add Categories Post Footer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-49239 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nikhilvaghela Add Categories Post Footer add-categories-post-footer allows Reflected XSS.This issue affects Add Categories Post Footer: from n/a through <= 2.2.2.
- Product
- Add Categories Post Footer
- Affected
- up to 2.2.2
- What to do
- Affects up to 2.2.2. Update Add Categories Post Footer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024Logo Slider: Does not validate and escape some of its Slider Settings before outputting them back in attributesCVE-2024-5429 · WordPress plugins & themes · reported by WPScanHigh 7.6
The Logo Slider WordPress plugin before 4.1.0 does not validate and escape some of its Slider Settings before outputting them back in attributes, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- Logo Slider
- Fixed in
- 4.1.0
- What to do
- Update Logo Slider to 4.1.0 or newer.
Oct 16, 2024Disc Golf Manager: Deserialization of Untrusted DataCVE-2024-48026 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in GMRobbins Disc Golf Manager disc-golf-manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through <= 1.0.0.
- Product
- Disc Golf Manager
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Disc Golf Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.