Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
582 results · page 12 of 12
Jul 7, 2023Site Kit by Google: Sensitive Information DisclosureCVE-2020-8934 · WordPress plugins & themes · reported by cve-coordination@google.comMedium 4.3
The Site Kit by Google plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 1.8.0 This is due to the lack of capability checks on the admin_enqueue_scripts action which displays the connection key. This makes it possible for authenticated attackers with any level of access obtaining owner access to a site in the Google Search Console. We recommend upgrading to V1.8.1 or above.
- Product
- Site Kit by Google
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Site Kit by Google to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jul 1, 2023Style Kits: Cross-Site Request ForgeryCVE-2021-4401 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to missing or incorrect nonce validation on the update_posts_stylekit() function. This makes it possible for unauthenticated attackers to update style kits for posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Style Kits
- Affected
- up to 1.8.0
- What to do
- Affects up to 1.8.0. Update Style Kits to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 29, 2023BookIt: Authentication bypassCVE-2023-2834 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
- Product
- BookIt
- Affected
- up to 2.3.7
- What to do
- Affects up to 2.3.7. Update BookIt to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlana.codesplugins.trac.wordpress.org
Jun 12, 2023WP Directory Kit: Unauthorized modification of data and loss of dataCVE-2023-2351 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_admin' function in versions up to, and including, 1.2.3. This makes it possible for authenticated attackers with subscriber-level permissions or above to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0.
- Product
- WP Directory Kit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 12, 2023WP Directory Kit: Local File InclusionCVE-2023-2278 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9 via the 'wdk_public_action' function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
- Product
- WP Directory Kit
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 12, 2023WP Directory Kit: Cross-Site Request ForgeryCVE-2023-2277 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the 'insert' function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious JavaScript via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- WP Directory Kit
- Affected
- up to 1.1.9
- What to do
- Affects up to 1.1.9. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2023WP Directory Kit: Unauthorized modification of data and loss of dataCVE-2023-2280 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0 and an additional partial patch was introduced in version 1.2.2, but the issue was not fully patched until 1.2.3.
- Product
- WP Directory Kit
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 5, 2023ConvertKit: Does not escape a parameter before outputting it back in an attributeCVE-2023-2337 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ConvertKit WordPress plugin before 2.2.1 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- ConvertKit
- Fixed in
- 2.2.1
- What to do
- Update ConvertKit to 2.2.1 or newer.
Jun 2, 2023WP Directory Kit: Reflected Cross-Site ScriptingCVE-2023-2835 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Directory Kit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions.CVE-2023-23714 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions.
- Affected
- up to 3.6.4.1
- What to do
- Affects up to 3.6.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 20, 2023real.Kit: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0364 · WordPress plugins & themes · reported by WPScanMedium 5.4
The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- real.Kit
- Fixed in
- 5.1.1
- What to do
- Update real.Kit to 5.1.1 or newer.
Mar 7, 2023The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file tCVE-2021-4330 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Envato Elements & Download and Template Kit – Import plugins for WordPress are vulnerable to arbitrary file uploads due to insufficient validation of file type upon extracting uploaded Zip files in the installFreeTemplateKit and uploadTemplateKitZipFile functions. This makes it possible for attackers with contributor-lever permissions and above to upload arbitrary files and potentially gain remote code execution in versions up to and including 1.0.13 of Template Kit – Import and versions up to and including 2.0.10 of Envato Elements & Download.
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 13, 2023TemplatesNext ToolKit: Does not validate some of its shortcode attributes before using them to generate an HTML tagCVE-2023-0333 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
- Product
- TemplatesNext ToolKit
- Fixed in
- 3.2.9
- What to do
- Update TemplatesNext ToolKit to 3.2.9 or newer.
Feb 13, 2023TemplatesNext ToolKit: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4678 · WordPress plugins & themes · reported by WPScanMedium 5.4
The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
- Product
- TemplatesNext ToolKit
- Fixed in
- 3.2.8
- What to do
- Update TemplatesNext ToolKit to 3.2.8 or newer.
Jan 30, 2023Social Sharing Toolkit: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4835 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Social Sharing Toolkit
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Social Sharing Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023ConvertKit: Does not validate and escapes some of its shortcode attributes before outputting them back in the pageCVE-2022-4508 · WordPress plugins & themes · reported by WPScanMedium 5.4
The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege users such as admins.
- Product
- ConvertKit
- Fixed in
- 2.0.5
- What to do
- Update ConvertKit to 2.0.5 or newer.
Jan 10, 2023Royal Elementor Addons: Insufficient access control in the 'wpr_import_templates_kit' AJAX actionCVE-2022-4704 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site configuration templates including images and settings.
- Product
- Royal Elementor Addons
- Affected
- up to 1.3.59
- What to do
- Affects up to 1.3.59. Update Royal Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various functions used to update the plugin settingsCVE-2022-3805 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
- Product
- Jeg Elementor Kit
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Dec 22, 2022Jeg Elementor Kit: Authorization bypass in various AJAX actionsCVE-2022-3794 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.
- Product
- Jeg Elementor Kit
- Affected
- up to 2.5.6
- What to do
- Affects up to 2.5.6. Update Jeg Elementor Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jul 11, 2022core plugin for kitestudio: Does not sanitise and escape some parameters before outputting them back in a response of an AJAX actionCVE-2022-1951 · WordPress plugins & themes · reported by WPScanMedium 6.1
The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting.
- Product
- core plugin for kitestudio
- Fixed in
- 2.3.1
- What to do
- Update core plugin for kitestudio to 2.3.1 or newer.
Jun 20, 2022Multi-page Toolkit: Does not have CSRF check in placeCVE-2022-1818 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
- Product
- Multi-page Toolkit
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Multi-page Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 7, 2022Store Toolkit for WooCommerce: Does not sanitise and escape the tab parameter before outputting it back in an admin page in an error messageCVE-2021-25077 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before outputting it back in an admin page in an error message, leading to a Reflected Cross-Site Scripting
- Product
- Store Toolkit for WooCommerce
- Fixed in
- 2.3.2
- What to do
- Update Store Toolkit for WooCommerce to 2.3.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Oct 11, 2021Gutenberg Block Editor Toolkit – EditorsKit: Does not sanitise and validate the Conditional Logic of the Custom Visibility settingsCVE-2021-24546 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code
- Product
- Gutenberg Block Editor Toolkit – EditorsKit
- Fixed in
- 1.31.6
- What to do
- Update Gutenberg Block Editor Toolkit – EditorsKit to 1.31.6 or newer.
May 5, 2021DeTheme Kit for Elementor: Has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24270 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “DeTheme Kit for Elementor” WordPress Plugin before 1.5.5.5 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- DeTheme Kit for Elementor
- Fixed in
- 1.5.5.5
- What to do
- Update DeTheme Kit for Elementor to 1.5.5.5 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021All-in-One Addons for Elementor – WidgetKit: Has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users suchCVE-2021-24267 · WordPress plugins & themes · reported by WPScanMedium 5.4
The “All-in-One Addons for Elementor – WidgetKit” WordPress Plugin before 2.3.10 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Product
- All-in-One Addons for Elementor – WidgetKit
- Fixed in
- 2.3.10
- What to do
- Update All-in-One Addons for Elementor – WidgetKit to 2.3.10 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
May 5, 2021The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lCVE-2021-24258 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Elements Kit Lite and Elements Kit Pro WordPress Plugins before 2.2.0 have a number of widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
- Fixed in
- 2.2.0
- What to do
- Update the plugin to 2.2.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Dec 27, 2019Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrCVE-2014-4548 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in tinymce/popup.php in the Ruven Toolkit plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the popup parameter.
- Product
- Ruven Toolkit
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Ruven Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comcodevigilant.com
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.CVE-2016-10923 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
- Product
- woocommerce-store-toolkit
- Fixed in
- 1.5.8
- What to do
- Update woocommerce-store-toolkit to 1.5.8 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.CVE-2016-10922 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
- Product
- woocommerce-store-toolkit
- Fixed in
- 1.5.7
- What to do
- Update woocommerce-store-toolkit to 1.5.7 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jan 9, 2019The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameCVE-2016-10736 · WordPress plugins & themes · reported by MITREMedium 6.1
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.
- Product
- Social Pug - Easy Social Share Buttons
- Fixed in
- 1.2.6
- What to do
- Update Social Pug - Easy Social Share Buttons to 1.2.6 or newer.
Full record and what to do →NVD recordadvisories.dxw.comadvisories.dxw.com
Nov 1, 2013Cross-site request forgery (CSRF) vulnerability in the Social Sharing Toolkit plugin 2.1.1 for WordPress allows remote attackers to hijack the authentication ofCVE-2013-2701 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Social Sharing Toolkit plugin 2.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that manipulate plugin settings via unknown vectors.
- Product
- Social Sharing Toolkit
- Affected
- 2.1.1 to 2.1.1
- What to do
- Affects 2.1.1 to 2.1.1. Update Social Sharing Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Oct 25, 2013Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2013-6280 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit plugin before 2.1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit
- Fixed in
- 2.1.2
- What to do
- Update Cross-site scripting (XSS) vulnerability in Social Sharing Toolkit to 2.1.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.