Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,084 results · page 13 of 22
Dec 13, 2024Directorist: Missing AuthorizationCVE-2023-35052 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpWax - WP Business Directory Plugin and Classified Listings Directory Directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through 7.5.4.
- Product
- Directorist
- Affected
- up to 7.5.4
- What to do
- Affects up to 7.5.4. Update Directorist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 13, 2024The Simple Link Directory: Arbitrary shortcode executionCVE-2024-12417 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Simple Link Directory
- Affected
- up to 8.4.5
- What to do
- Affects up to 8.4.5. Update The Simple Link Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 10, 2024Best WordPress Gallery Plugin – FooGallery: Directory TraversalCVE-2023-6947 · WordPress plugins & themes · reported by WordfenceHigh 7.7
The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive information such as folder structure.
- Product
- Best WordPress Gallery Plugin – FooGallery
- Affected
- up to 2.4.26
- What to do
- Affects up to 2.4.26. Update Best WordPress Gallery Plugin – FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Dec 9, 2024Lenxel Core for Lenxel(LNX) LMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-53790 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PHP Local File Inclusion.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.
- Product
- Lenxel Core for Lenxel(LNX) LMS
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Lenxel Core for Lenxel(LNX) LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Real Estate Directory: Missing AuthorizationCVE-2023-28532 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in wpdirectorykit.com Real Estate Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Directory: from n/a through 1.0.5.
- Product
- Real Estate Directory
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Real Estate Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2024Fantastic Content Protector Free: Missing AuthorizationCVE-2023-25048 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Fantastic Plugins Fantastic Content Protector Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fantastic Content Protector Free: from n/a through 2.6.
- Product
- Fantastic Content Protector Free
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Fantastic Content Protector Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 7, 2024Smoove connector for Elementor forms: Reflected Cross-Site ScriptingCVE-2024-11367 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Smoove connector for Elementor forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Smoove connector for Elementor forms
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Smoove connector for Elementor forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 6, 2024Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!: Reflected Cross-Site ScriptingCVE-2024-11436 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
- Affected
- up to 1.4.19
- What to do
- Affects up to 1.4.19. Update Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 4, 2024Listdom – Business Directory and Classified Ads Listings: Stored Cross-Site ScriptingCVE-2024-11854 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Listdom – Business Directory and Classified Ads Listings
- Affected
- up to 3.7.0
- What to do
- Affects up to 3.7.0. Update Listdom – Business Directory and Classified Ads Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 3, 2024Form Data Collector: Reflected Cross-Site ScriptingCVE-2024-11461 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Form Data Collector plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Form Data Collector
- Affected
- up to 2.2.3
- What to do
- Affects up to 2.2.3. Update Form Data Collector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 28, 2024Jobify: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52481 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Astoundify Jobify jobify allows Relative Path Traversal.This issue affects Jobify: from n/a through < 4.3.0.
- Product
- Jobify
- Fixed in
- 4.2.4
- What to do
- Update Jobify to 4.2.4 or newer.
Nov 26, 2024Product Input Fields for WooCommerce: Directory TraversalCVE-2024-10857 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- Product Input Fields for WooCommerce
- Affected
- up to 1.9
- What to do
- Affects up to 1.9. Update Product Input Fields for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 23, 2024MP3 Sticky Player: Directory TraversalCVE-2024-10803 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Please note the vendor released the patched version as the same version as the affected version.
- Product
- MP3 Sticky Player
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update MP3 Sticky Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
Nov 21, 2024Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Unauthorized profile picture updatesCVE-2024-10528 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to unauthorized profile picture updates due to a missing capability check on the wp_ajax_um_resize_image() and ajax_resize_image() functions in all versions up to, and including, 2.8.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the profile pictures of other users.
- Product
- Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
- Affected
- up to 2.8.9
- What to do
- Affects up to 2.8.9. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Bootscraper: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52449 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Navneil Naicer Bootscraper allows PHP Local File Inclusion.This issue affects Bootscraper: from n/a through 2.1.0.
- Product
- Bootscraper
- Affected
- up to 2.1.0
- What to do
- Affects up to 2.1.0. Update Bootscraper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Ultimate Classified Listings: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52448 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in webcodingplace Ultimate Classified Listings ultimate-classified-listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through <= 1.7.
- Product
- Ultimate Classified Listings
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update Ultimate Classified Listings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 20, 2024Opal Woo Custom Product Variation: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52444 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpopal Opal Woo Custom Product Variation opal-woo-custom-product-variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through <= 1.1.3.
- Product
- Opal Woo Custom Product Variation
- Affected
- up to 1.1.3
- What to do
- Affects up to 1.1.3. Update Opal Woo Custom Product Variation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 19, 2024Classified Listing – Classified ads & Business Directory: Unauthorized modification of data that can lead to privilege escalationCVE-2024-11194 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtcl_import_settings' function in all versions up to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site. The vulnerability is limited in that the option updated must have a value that is an array.
- Product
- Classified Listing – Classified ads & Business Directory
- Affected
- up to 3.1.15.1
- What to do
- Affects up to 3.1.15.1. Update Classified Listing – Classified ads & Business Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 16, 2024Referrer Detector: Deserialization of Untrusted DataCVE-2024-52410 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in Phoenixheart Referrer Detector referrer-detector allows Object Injection.This issue affects Referrer Detector: from n/a through <= 4.2.1.0.
- Product
- Referrer Detector
- Affected
- up to 4.2.1.0
- What to do
- Affects up to 4.2.1.0. Update Referrer Detector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024WOLF: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52396 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RealMag777 WOLF bulk-editor allows Path Traversal.This issue affects WOLF: from n/a through <= 1.0.8.3.
- Product
- WOLF
- Affected
- up to 1.0.8.3
- What to do
- Affects up to 1.0.8.3. Update WOLF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024DigiPass: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52378 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 DigiPass digipass allows Absolute Path Traversal.This issue affects DigiPass: from n/a through <= 0.3.0.
- Product
- DigiPass
- Affected
- up to 0.3.0
- What to do
- Affects up to 0.3.0. Update DigiPass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 14, 2024Global Gateway e4 | Payeezy Gateway |: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-52371 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway | globe-gateway-e4.This issue affects Global Gateway e4 | Payeezy Gateway |: from n/a through <= 2.0.
- Product
- Global Gateway e4 | Payeezy Gateway |
- Affected
- up to 2.0
- What to do
- Affects up to 2.0. Update Global Gateway e4 | Payeezy Gateway | to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 12, 2024LUNA RADIO PLAYER: Directory TraversalCVE-2024-10816 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LUNA RADIO PLAYER plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.24.01.24 via the js/fallback.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Product
- LUNA RADIO PLAYER
- Affected
- up to 6.24.01.24
- What to do
- Affects up to 6.24.01.24. Update LUNA RADIO PLAYER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordradioplayer.luna-universe.comwordfence.com
Nov 11, 2024The Novel Design Store Directory: Unrestricted Upload of File with Dangerous TypeCVE-2024-51788 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Wolfe The Novel Design Store Directory noveldesign-store-directory allows Upload a Web Shell to a Web Server.This issue affects The Novel Design Store Directory: from n/a through <= 4.3.0.
- Product
- The Novel Design Store Directory
- Affected
- up to 4.3.0
- What to do
- Affects up to 4.3.0. Update The Novel Design Store Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024GeoDirectory: Missing AuthorizationCVE-2024-43981 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.
- Product
- GeoDirectory
- Affected
- up to 2.3.70
- What to do
- Affects up to 2.3.70. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Newspack Blocks: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37423 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8.
- Product
- Newspack Blocks
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Newspack Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024WishList Member X: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37108 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WishList Products WishList Member X allows Path Traversal.This issue affects WishList Member X: from n/a through 3.26.6.
- Product
- WishList Member X
- Affected
- up to 3.26.6
- What to do
- Affects up to 3.26.6. Update WishList Member X to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50509 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- Product
- Woocommerce Product Design
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 30, 2024Woocommerce Product Design: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-50508 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- Product
- Woocommerce Product Design
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Woocommerce Product Design to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 29, 2024aDirectory: Unrestricted Upload of File with Dangerous TypeCVE-2024-50420 · WordPress plugins & themes · reported by PatchstackCritical 10
Unrestricted Upload of File with Dangerous Type vulnerability in aDirectory aDirectory adirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through <= 1.3.
- Product
- aDirectory
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update aDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024GeoDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50437 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.80.
- Product
- GeoDirectory
- Affected
- up to 2.3.80
- What to do
- Affects up to 2.3.80. Update GeoDirectory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2024BuddyPress: Directory TraversalCVE-2024-10011 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory and enables file uploads to directories outside of the web root. Depending on server configuration it may be possible to upload files with double extensions.
- Product
- BuddyPress
- Affected
- up to 14.1.0
- What to do
- Affects up to 14.1.0. Update BuddyPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodex.buddypress.orggithub.com
Oct 20, 2024SSV Events: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49286 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV Events ssv-events allows PHP Local File Inclusion.This issue affects SSV Events: from n/a through <= 3.2.7.
- Product
- SSV Events
- Affected
- up to 3.2.7
- What to do
- Affects up to 3.2.7. Update SSV Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024PDF-Rechnungsverwaltung: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49287 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in mh6webentwicklung PDF-Rechnungsverwaltung pdf-rechnungsverwaltung allows PHP Local File Inclusion.This issue affects PDF-Rechnungsverwaltung: from n/a through <= 0.0.1.
- Product
- PDF-Rechnungsverwaltung
- Affected
- up to 0.0.1
- What to do
- Affects up to 0.0.1. Update PDF-Rechnungsverwaltung to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024SSV MailChimp: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49285 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV MailChimp ssv-mailchimp allows PHP Local File Inclusion.This issue affects SSV MailChimp: from n/a through <= 3.1.5.
- Product
- SSV MailChimp
- Affected
- up to 3.1.5
- What to do
- Affects up to 3.1.5. Update SSV MailChimp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 17, 2024FREE DOWNLOAD MANAGER: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49315 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through <= 1.0.0.
- Product
- FREE DOWNLOAD MANAGER
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update FREE DOWNLOAD MANAGER to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024Ahime Image Printer: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-49245 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in nahimsalami Ahime Image Printer ahime-image-printer.This issue affects Ahime Image Printer: from n/a through <= 1.0.0.
- Product
- Ahime Image Printer
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Ahime Image Printer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024Top Bar – PopUps – by WPOptin: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47645 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Danish Ali Malik Top Bar – PopUps – by WPOptin wpoptin allows PHP Local File Inclusion.This issue affects Top Bar – PopUps – by WPOptin: from n/a through <= 2.0.1.
- Product
- Top Bar – PopUps – by WPOptin
- Affected
- up to 2.0.1
- What to do
- Affects up to 2.0.1. Update Top Bar – PopUps – by WPOptin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2024MaxSlider: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47351 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The CSSIgniter Team MaxSlider maxslider allows Path Traversal.This issue affects MaxSlider: from n/a through <= 1.2.3.
- Product
- MaxSlider
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update MaxSlider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 10, 2024Pedalo Connector: Authentication bypassCVE-2024-9822 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log to the first user, who is usually the administrator, or if it does not exist, then to the first administrator.
- Product
- Pedalo Connector
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Pedalo Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 5, 2024Web Directory Free: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47379 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Reflected XSS.This issue affects Web Directory Free: from n/a through <= 1.7.3.
- Product
- Web Directory Free
- Affected
- up to 1.7.3
- What to do
- Affects up to 1.7.3. Update Web Directory Free to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Cities Shipping Zones for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-47309 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Condless Cities Shipping Zones for WooCommerce cities-shipping-zones-for-woocommerce allows PHP Local File Inclusion.This issue affects Cities Shipping Zones for WooCommerce: from n/a through <= 1.2.7.
- Product
- Cities Shipping Zones for WooCommerce
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update Cities Shipping Zones for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WPSPX: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44034 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Martin Greenwood WPSPX wpspx allows PHP Local File Inclusion.This issue affects WPSPX: from n/a through <= 1.0.2.
- Product
- WPSPX
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update WPSPX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Instant Chat Floating Button for WordPress Websites: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44018 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Instant Chat Floating Button for WordPress Websites instant-chat-wp allows PHP Local File Inclusion.This issue affects Instant Chat Floating Button for WordPress Websites: from n/a through <= 1.0.5.
- Product
- Instant Chat Floating Button for WordPress Websites
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Instant Chat Floating Button for WordPress Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024CSS JS Files: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-9146 · WordPress plugins & themes · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in jamesdlow CSS JS Files css-js-files allows Path Traversal.This issue affects CSS JS Files: from n/a through <= 1.5.0.
- Product
- CSS JS Files
- Affected
- up to 1.5.0
- What to do
- Affects up to 1.5.0. Update CSS JS Files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Podiant: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44016 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in amarksteadman Podiant podiant allows PHP Local File Inclusion.This issue affects Podiant: from n/a through <= 1.1.
- Product
- Podiant
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Podiant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Users Control: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44015 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in istmoplugins Users Control users-control allows PHP Local File Inclusion.This issue affects Users Control: from n/a through <= 1.0.16.
- Product
- Users Control
- Affected
- up to 1.0.16
- What to do
- Affects up to 1.0.16. Update Users Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024Vmax Project Manager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44014 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vmax Studio Vmax Project Manager vmax-project-manager allows PHP Local File Inclusion.This issue affects Vmax Project Manager: from n/a through <= 1.0.
- Product
- Vmax Project Manager
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Vmax Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024VR Calendar: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44013 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innate Images LLC VR Calendar vr-calendar-sync allows PHP Local File Inclusion.This issue affects VR Calendar: from n/a through <= 2.4.0.
- Product
- VR Calendar
- Affected
- up to 2.4.0
- What to do
- Affects up to 2.4.0. Update VR Calendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 5, 2024WP Newsletter Subscription: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-44012 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpdev33 WP Newsletter Subscription wp-newsletter-subscription allows PHP Local File Inclusion.This issue affects WP Newsletter Subscription: from n/a through <= 1.1.
- Product
- WP Newsletter Subscription
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update WP Newsletter Subscription to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.